Skip to main content
Enable Azure Monitor Alerts Azure Monitor Alerts notify you about important events occurring in your Azure subscription. Azure provides a unified authoring experience so you can create alert rules for Activity Logs, Service Health events, Log Analytics (log query) results, platform and custom metrics, and more — all using the same workflow. Alerts are classified by severity and user response, and integrate with Action Groups to deliver notifications and automate remediation. Action Groups define how alerts notify responders and trigger automated actions. You can deliver email, SMS, push notifications, or voice calls, and trigger automation such as Runbooks, Functions, Logic Apps, or webhooks.
A presentation slide titled "Enable Azure Monitor Alert" showing three colored callouts — "Unified authoring experience", "Classify based on severity and response", and "Integrate with action groups" — alongside a screenshot of the Azure portal Alerts dashboard listing multiple critical alerts.

​
Alert rule authoring: 4 main stages

When authoring an alert rule there are four main stages to follow. These apply whether you create rules for metrics, logs, or activity log events:
A presentation slide titled "Enable Azure Monitor Alert" showing a screenshot of the Azure portal's "Create an alert rule" form and four colorful tiles labeled Scope, Condition, Action, and Rule details. The slide includes subscription/resource group and alert rule settings like severity and region.

​
Action Groups: notifications and automation

Action Groups let you configure two types of actions:
  • Notification preferences — email, SMS, push notification, voice calls, or integrations (ITSM, webhooks, connectors).
  • Automation preferences — Automation Runbook, Azure Function, Event Hub, ITSM, Logic App, secure webhook, or standard webhook.
Use Action Groups to notify the right on-call recipients and to automate common remediation (for example, automatically creating a service-desk ticket through an ITSM connector when an alert fires).
A slide titled "Enable Azure Monitor Alert" showing Notifications and Actions panels alongside a screenshot of the Azure portal "Create an action group" dialog. Colorful buttons list action types such as Automation Runbook, Logic App, Azure Function, Webhook, Event Hub and ITSM.

​
Demo: Create an alert rule from Log Analytics

You can create alert rules directly from a Log Analytics query. Example: count App Service HTTP logs in the last 25 minutes.
If this query returns a value you want to monitor (e.g., the demo returned 51), you can set a threshold to trigger an alert when the count exceeds a chosen value (for instance, > 100 in 25 minutes). The Scope for the alert will automatically be the Log Analytics workspace used by the query.
A screenshot of the Microsoft Azure portal showing the "Create an alert rule" page on the Scope tab, with a resource named "law-monitoring" selected. The page shows navigation tabs (Condition, Actions, Details, Tags, Review + create) and buttons for "Review + create" and "Next: Condition."
When configuring the Condition, set these key parameters:
  • Operator, threshold, and evaluation frequency (how often Azure evaluates the rule).
  • Aggregation type (Average, Min, Max, Total, Count).
  • Lookback window (how much historical data is evaluated).
The portal shows an estimated monthly cost for metric alerts and lets you proceed to define Actions.
A screenshot of the Microsoft Azure portal showing the "Create an alert rule" page with fields for Resource ID, dimensions, and alert logic (operator, threshold value, and evaluation frequency). The page also shows an estimated monthly cost and action buttons like "Review + create," "Previous," and "Next: Actions."

​
Activity Log alerts

You can also create alerts for Activity Log events. These are useful for tracking control-plane operations such as creating or deleting resources. For example, author an alert to trigger when a specific operation like “Create Web App” or “Delete database” occurs.
A screenshot of the Microsoft Azure portal showing the "law-monitoring" Log Analytics workspace Activity log, listing recent operations (mostly "List Workspace Shared Keys") with statuses, timestamps, and subscription/resource-group filters applied.
Follow these steps to create a CPU alert for a Virtual Machine:
  1. In the Azure portal, open the Virtual Machine and navigate to the Alerts blade. Choose “Create a custom alert rule”.
  2. Scope: select one or more VMs to monitor.
  3. Condition: choose a signal — for VM monitoring select a platform metric such as Percentage CPU.
A screenshot of the Microsoft Azure portal showing the "Create an alert rule" workflow with the Condition tab selected. The right-hand "Select a signal" pane lists resource health and platform metrics like Available Memory Bytes, CPU Credits, and various data disk metrics.
  1. Threshold type: choose Static or Dynamic.
    • Static evaluates the metric against a fixed threshold (e.g., Average CPU > 80%).
    • Dynamic learns historical behavior and alerts on anomalies to reduce noise from expected spikes.
Use dynamic thresholds to reduce noisy alerts for workloads with variable usage patterns. Use static thresholds when you have a clear SLA or capacity limit to enforce.
Set an aggregation (Average), threshold value (for example, 80%), and evaluation frequency (for example, evaluate every 1 minute with a 5‑minute lookback). The example below uses a static threshold: Average CPU > 80%.
A screenshot of the Microsoft Azure portal’s "Create an alert rule" page showing the Condition tab configured for the "Percentage CPU" signal with a static threshold set to 80% (aggregation: Average). A preview chart on the right displays the CPU percentage time series over the last 6 hours.
  1. Actions: create or select an Action Group. Provide a name (for example, “VM notification”) and add at least one notification type (email, SMS, push, voice) or automation action (Runbook, Function, Logic App, webhook, ITSM).
  2. Details: set the alert rule name (e.g., “CPU alert for Windows and Linux”), severity (Critical), and whether the rule is enabled on creation.
Once created, validate the alert by generating CPU load on the target VM.

​
SSH to the Linux VM and generate load

Connect to the VM via SSH:
First-time SSH fingerprint prompt example:
After login, update packages and install the stress tool:
Run stress to load the CPU (example: 4 CPU workers for 1000 seconds):
Open htop or top to observe near-100% CPU on vCPUs while stress runs. Example htop output shows the stress processes consuming CPU:

​
Monitor the VM metrics in the Azure portal

In the portal go to Monitoring > Metrics and select CPU (Average). The spike created by the stress process will be visible; Azure evaluates the configured lookback (5 minutes in this example) and aggregation (Average) to determine whether the rule condition is met.
Screenshot of the Microsoft Azure Metrics page showing a line chart for "Percentage CPU" of a virtual machine (linux-ra-vm) with the CPU around 90%. A time-range/custom selector panel is open on the right showing the 9:35–9:41 PM interval.
When the condition is satisfied (Average CPU > 80% over the configured lookback), Azure triggers the alert and the Action Group sends notifications. An example email notification includes the rule name, target resource, operator, threshold, and the value that caused the alert:
You can review fired alerts and alert history in the portal. The Alerts blade displays status (Fired or Resolved) and allows setting a user response (New, Acknowledged, Closed) or closing the alert after remediation.
Screenshot of the Microsoft Azure portal on the Monitor > Alerts page. It shows one critical alert (cpu-alert-win-linux) for the linux-ra-vm with condition "Fired."

​
Acknowledge and close alerts

On the Alerts page you can set the user response to communicate the incident lifecycle to your team. Typical states:
  • New — newly fired alert awaiting triage.
  • Acknowledged — someone is investigating or working on remediation.
  • Closed — issue resolved and alert closed.
Use acknowledgement to avoid duplicated work across responders and close alerts once the root cause is resolved.
A screenshot of the Microsoft Azure Monitor Alerts pane showing a critical alert named "cpu-alert-win-linux" for the VM linux-ra-vm. The alert details include a CPU usage graph showing a spike (about 28%) and the alert is marked acknowledged.

​
Summary

Use Azure Monitor Alerts to:
  • Author alert rules consistently across metrics, logs, and activity logs.
  • Classify alerts by severity and track user response (New, Acknowledged, Closed).
  • Route notifications and automate responses via Action Groups (email, SMS, push, voice, Runbooks, Functions, Logic Apps, ITSM, webhooks).
  • Choose static or dynamic thresholds depending on workload characteristics and noise tolerance.
This completes the Azure Monitor Alerts portion relevant to the AZ-104 exam.
A presentation slide titled "Enable Azure Monitor Alert" showing an Azure portal screenshot of the "Create an alert rule" form with fields for subscription, resource group, severity and alert name. Below the screenshot are colorful rounded buttons labeled Scope, Condition, Action, and Rule details.

Watch Video