Azure Monitor
The umbrella telemetry platform: metrics, logs, traces and changes, plus the diagnostic plumbing that feeds them.
Readiness
0%
2h 10m baseline
Exam memorization points
- Four data types: metrics (numeric time series), logs (structured records queried with KQL), traces (distributed request telemetry) and changes.
- Platform metrics are collected automatically and retained for 93 days; guest OS metrics require an agent and a data collection rule.
- The activity log records control-plane operations per subscription and is retained for 90 days in the portal; export it with a subscription-level diagnostic setting.
- Diagnostic settings route resource logs and metrics to a Log Analytics workspace, a storage account or an Event Hub.
- The Azure Monitor Agent replaces the legacy Log Analytics agent and is configured through data collection rules.
- Alert types are metric alerts, log search alerts and activity log alerts, each with its own signal and cost profile.
Traps & distractors
- Assuming telemetry lands in Log Analytics by default. Most resources produce nothing until a diagnostic setting is configured.
- Querying guest CPU from platform metrics. Guest OS metrics require the agent; only host metrics exist without it.
- Confusing the activity log (control plane, for example a VM restart) with resource logs (data plane, for example an application error).
- Forgetting that diagnostic settings are per resource, except for the activity log which is configured at the subscription scope.
Suggested lab
Build the telemetry pipeline for one VM
Prove which data appears automatically and which needs configuration.
- 1Create a Log Analytics workspace and note the region and retention.
- 2On a VM, create a diagnostic setting sending activity log and platform metrics to the workspace.
- 3Install the Azure Monitor Agent with a data collection rule for performance counters.
- 4Query Heartbeat and Perf tables to confirm both activity and guest telemetry arrived.
- 5Create a metric alert on Percentage CPU and compare it with a log search alert on the Perf table.
Microsoft Learn
- Azure Monitor overviewdoc
- Search Microsoft Learn: Azure Monitor diagnostic settings Azure Monitor Agent data collection rulesearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight56% × 25% = 13.9
This topic's domain carries 12.5% of the exam objectives.
- Dependency leverage41% × 20% = 8.2
3 later topics depend on it.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Baseline study time
2h 10m
Complexity
3 / 5
Remaining to target
1h 51m
Status weight
0%
Topics: monitor, metrics, logs, diagnostic settings, activity log, ama, dcr
Weak neighbours in Monitoring