Azure Monitor, the service that watches everything you run in Azure. Screenshot from azure.microsoft.com.
Azure Monitor is the built-in monitoring service in Microsoft Azure, opened from the Azure portal: it collects numbers and logs from your apps, servers and cloud services, then charts them and alerts you when something goes wrong. There is nothing to install for the basics.
Every Azure resource reports to it from the moment you create it. Basic performance charts and the activity log are free, with no setup. You pay only when you send in extra data, such as detailed logs from your servers or apps.
It also watches servers in your own building or in other clouds through Azure Arc, and it monitors AI agents built in Microsoft Foundry and Copilot Studio.
Below: what Azure Monitor collects, the tools you will use, how alerts work, a step-by-step first alert, and what is free versus paid. Questions? Reach out to us directly.
What Is Azure Monitor?
Azure Monitor is the one place to see how everything in Azure is doing. Microsoft calls it an observability service, which simply means it helps you see inside your systems: are they up, are they fast, and what went wrong when they failed.
It does four jobs. It collects data, stores it, lets you chart and search it, and acts on it with alerts or automatic scaling. Microsoft Defender for Cloud and Microsoft Sentinel use the same data platform, so the skills carry over.
You reach it by searching for Monitor in the Azure portal, but most resources also show their own monitoring charts right on their Overview page.
New to Azure itself? Start with our guide to Microsoft Azure, which explains subscriptions, resource groups and the free account.
Metrics, Logs and Traces Explained
Azure Monitor works with three kinds of data. Most beginners only need the first two to start.
Behind the scenes there are two stores. A Log Analytics workspace holds logs and traces, which you search with KQL (Kusto Query Language). An Azure Monitor workspace holds Prometheus and OpenTelemetry metrics, open standards for metrics that many apps already use, which you search with PromQL. The names are confusingly close, but they are separate things.
Metrics explorer shows 30 days per chart. Platform metrics are kept for 93 days, so pan the chart to see older data, or send metrics to a Log Analytics workspace to keep them longer.
Where Azure Monitor Gets Its Data
Azure resources
Every resource sends platform metrics and an activity log on its own. Add a diagnostic setting to also send its detailed resource logs to a workspace.
Virtual machines and servers
Install the Azure Monitor Agent and choose what to collect with data collection rules. Servers outside Azure connect through Azure Arc.
Applications
Application Insights collects requests, errors and response times from your app code using OpenTelemetry, an open standard.
Kubernetes
Container insights and Azure Monitor managed service for Prometheus watch your clusters, pods and containers.
Microsoft Entra ID
Sign-in and audit logs from Entra ID can flow in, so you can alert on unusual account activity.
Your own data
Send custom logs from any app or script with the Logs Ingestion API.
Following an older tutorial?
Guides from before 2024 tell you to install the Log Analytics agent (also called MMA or OMS). Microsoft retired it in August 2024. Use the Azure Monitor Agent instead, which collects the same kinds of data through data collection rules.
Key Azure Monitor Tools
These screenshots come from Microsoft Learn and show the tools you will use most.
Charts on every resource
Open any Azure resource and its Overview page already shows key charts, such as traffic and response time for a storage account. Metrics explorer lets you build your own charts and pin them to a dashboard.
Log Analytics
Log Analytics is where you search logs. Simple mode lets you filter with clicks, and KQL mode lets you write queries like the one in the screenshot, which counts failed operations.
KQL is also used by Microsoft Sentinel and Defender, so learning it pays off twice.
Application Insights
Application Insights watches your web apps: page views, slow requests and errors. The application map draws every part of your app and how they call each other, with failure rates on each link.
It also tracks AI agents, including token use, response time and errors.
VM insights
VM insights shows CPU, memory, disk and network for all your virtual machines at once, so you can spot the one that is struggling without opening each machine.
Workbooks and dashboards
Workbooks are interactive reports that mix charts, tables and text. Start from Microsoft’s gallery of ready-made workbooks, or build your own.
Prefer Grafana? Azure Monitor has Grafana dashboards in the portal, and Azure Managed Grafana for full Grafana.
Autoscale
Add or remove servers automatically based on load, a schedule, or both, so you pay for capacity only when you need it.
Azure Copilot Observability Agent
Ask questions about your systems in plain words, and let the agent investigate alerts and group related ones into a single issue.
Smart alerts
Dynamic thresholds learn what normal looks like for a metric, and smart detection flags odd behavior in your apps.
Network Watcher
Tools for checking network paths, connections and traffic between your Azure resources.
How Azure Monitor Alerts Work
An alert rule has three parts: what to watch (the scope, such as one VM), which signal (such as CPU percentage), and the condition (such as above 80% on average). When the condition is met, the alert fires and runs an action group.
An action group is a reusable list of who to tell and what to do: send an email or text message, call a phone, push to the Azure mobile app, or run automation such as a Logic App. Create one once and use it on many alert rules.
Step by Step: Create Your First Alert
This example emails you when a virtual machine’s CPU stays high. The same steps work for any resource and signal.
1 Sign in to the Azure portal at portal.azure.com, search for Monitor and open it.
2 Select Alerts, then Create, then Alert rule.
3 On the Scope tab, pick the resource you want to watch, such as your virtual machine, and select Apply.
4 On the Condition tab, choose a signal, such as Percentage CPU.
5 Set the logic: for example, greater than 80, averaged over 5 minutes.
6 On the Actions tab, select Create action group and add an email notification with your address.
7 On the Details tab, name the rule and choose a severity, from 0 (critical) to 4 (verbose).
8 Select Review + create, then Create. The rule starts checking right away.
Is Azure Monitor Free?
Partly. The basics cost nothing, and you pay mainly for the log data you send in and keep. Here is how it splits.
Watch your log volume. Logs are where surprise bills come from. Only collect what you will use, and check Usage and estimated costs in your Log Analytics workspace each month. Current prices are on the Azure Monitor pricing page, and our guide to reducing Azure costs has more ways to save.
Frequently Asked Questions
What is the difference between Azure Monitor and Application Insights?
What is KQL?
Can Azure Monitor watch servers outside Azure?
How long does Azure Monitor keep my data?
Can Azure Monitor alerts reach my phone?
Does Azure Monitor work with Grafana?
Support and Community
- Azure Monitor, Microsoft’s own product page.
- Azure Monitor documentation on Microsoft Learn, with tutorials for metrics, logs and alerts.
- KQL reference on Microsoft Learn, to learn the query language step by step.
- Microsoft Q&A for Azure Monitor, where Microsoft engineers and users answer questions.
- r/AZURE on Reddit, a large community for Azure questions and tips.
More Windows software guides: What Is Microsoft Azure? · Azure AI Search · Azure PowerShell · Azure PowerShell Commands · Reducing Azure Costs · Azure Data Studio Replacements
Discover more from Windows Mode
Subscribe to get the latest posts sent to your email.
Add your first comment to this post