Alert Processing Rules

What it is

In Azure Monitor, an alert processing rule (formerly recommended action groups rules / action rules) is a set of conditions that changes how alerts already fired are handled — it suppresses notifications you don’t want or changes which action groups get notified, at scale. It applies as the alert fires, so it is about reducing noise on matched alerts, not about defining alert conditions.

Why it exists

Alerts are noisy: a maintenance window firing thousands of pager pages, or a scheduled job duplicating equivalent alarms every few minutes. Rather than editing every alert rule, administrators set a processing layer that says “for these resources, at this time, mute (or re-route) the actions.” It is the deduplication/suppression mechanism, distinct from the action group that defines who to notify.

Key ideas

• Two actions you can take:
  • Suppress notifications — silence a matched alert’s actions entirely, or for a window (e.g., a maintenance window or same-alert duplicates).
  • Trigger notifications — change the actions taken: add/remove action groups, or replace the groups used, so the right team gets the alert (or only the right teams, deduplicating out the others).
• Scope (filter/set) — every rule targets a scope: one resource, a resource group, or a whole subscription. Within that scope it also filters by conditions such as severity, resource type, or specific resource name.
• Evaluation order — rules are applied in order when an alert fires; once one concludes (or stops further processing) it may preempt later rules. This is used for ordered suppressions, e.g. top-level subscription rule, then finer resource rules.
• Used for — maintenance windows, standard-schedule deduplication, and routing to different teams based on severity or resource.

Key exam facts — how it differs from the other layers

• An alert rule says what condition triggers an alert (keep this two-line clarification straight).
• An action group says who is notified (the phone/pager/email recipients for any alert that uses that group).
• An alert processing rule sits on top of both: after the alert fires, it cuts down or reshapes which action groups actually run. It can suppress or modify — it does not change what the alert rule computes.
• A processing rule without an alert rule has nothing to act on — the processing layer only transforms alerts that were actually raised.

Related

azure-monitor · metric-alert · action-group · log-analytics · kql · azure-monitor-insights

📘 Source: Microsoft Learn — Alert processing rules