Azure Monitor Alerts & Action Groups
Alert rules, severities, action groups and alert processing rules that turn telemetry into a notification.
Readiness
0%
2h baseline
Exam memorization points
- An alert rule is a signal plus a condition plus an action group plus a severity.
- Severity scale runs from 0 (Critical) to 4 (Verbose) - lower numbers are more severe.
- Action groups group receivers: email, SMS, voice, push, webhook, ITSM, Logic App, Automation Runbook, Function and Event Hub.
- Alert processing rules apply to a scope and can suppress action groups, for example during a maintenance window.
- Stateful alerts fire once and resolve when the condition clears; stateless alerts fire on every evaluation.
- Log search alerts are billed for the query execution plus the log data scanned, which is why evaluation frequency matters.
Traps & distractors
- Mixing up alert rules (create alerts) with alert processing rules (filter or suppress them).
- Forgetting that an alert rule is scoped: a subscription-scope metric alert behaves differently from a resource-scope one.
- Setting an evaluation frequency finer than the metric's resolution, which the portal rejects or silently adjusts.
- Assuming a resolved stateful alert will re-notify on the next occurrence without the condition clearing first.
- Expecting webhooks to work without checking the common alert schema, which changes the payload shape.
Suggested lab
Alert, notify and suppress
Build the alerting lifecycle end to end.
- 1Create an action group with an email receiver and a webhook receiver.
- 2Create a metric alert on VM CPU with a 5-minute window and severity 1, referencing the action group.
- 3Generate CPU load and confirm the alert fires and later resolves.
- 4Create a log search alert on a KQL query and compare the configuration surface with the metric alert.
- 5Add an alert processing rule that suppresses the action group during a scheduled window.
Microsoft Learn
- Overview of alerts in Azure Monitordoc
- Search Microsoft Learn: Azure Monitor action groups alert processing rules severity statefulsearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight56% × 25% = 13.9
This topic's domain carries 12.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
2h
Complexity
3 / 5
Remaining to target
1h 42m
Status weight
0%
Topics: alert, action group, severity, webhook, suppression, stateful, log search alert
Weak neighbours in Monitoring