MSDEVBUILD / azure

Azure Monitor, Log Analytics, Alerts and Application Insights

Azure portal · dashboard health $ az vm create --name web01 failed… replacing ✓ auto-healed Fixes itself
Azure Monitor collects heartbeats and diaries from everything you run, and buzzes when something is wrong.

😟 THE PROBLEM

The site slows down at night and nobody knows why or when.

😊 THE SOLUTION

Collect metrics and logs with Azure Monitor and set meaningful alerts.

  • No data to investigate✓ Metrics and logs in one place
  • Searching logs by hand✓ Log Analytics with KQL
  • Problems found by customers✓ Alerts and Application Insights
🛠️ Solved with: Azure Monitor · Log Analytics · App Insights
Module 3: Management & Governance ⏱ 7 min read Updated 11 Nov 2026

Quick answer

Azure Monitor collects, analyses and acts on metrics and logs from your Azure resources, applications, operating systems and on-premises sources. Log Analytics lets you query log data using KQL. Azure Monitor alerts notify you or run automation when conditions are met. Application Insights monitors your web applications' performance, failures and usage.

Exam objective: 3.4.3 Describe Azure Monitor, including Log Analytics, Azure Monitor alerts, and Azure Monitor Application Insights. (Skills measured as of July 20, 2026)

Start with a question

Your website slowed down at 9:14 p.m. How do you find out why, and how do you get woken up next time?

Azure Monitor collects the evidence, Log Analytics helps you investigate it, and alerts wake you up next time.

Explain it like I’m 10

The technical explanation

  1. 1 Collect

    Metrics and logs from apps, OS, Azure resources, subscriptions and on-premises.

  2. 2 Analyse

    Metrics explorer, Log Analytics (KQL), workbooks, Application Insights.

  3. 3 Respond

    Alerts with action groups (email, SMS, webhooks) and autoscale.

  4. 4 Visualise

    Dashboards, workbooks, Power BI and Grafana.

How Azure Monitor works

A sample KQL query in Log Analytics:

AppRequests
| where TimeGenerated > ago(1h) and Success == false
| summarize failures = count() by Name
| order by failures desc

Real-world business scenario

Food delivery

An online food ordering site

The problem
Customers reported slow checkouts, but the team had no data to find the cause.
What they used
Application Insights on the web app, Log Analytics for server logs, and alerts on response time and error rate.
Why that choice
End-to-end visibility and proactive alerts.
The result
A slow database dependency was spotted in Application Insights and fixed; alerts now catch issues before customers do.

When to use it and when not to

✓ Use it when…

  • Every production workload: metrics, logs, Application Insights and meaningful alerts.

✕ Think twice when…

  • Alerting on everything, which causes alert fatigue.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is Azure Monitor?

Model answer

Azure's monitoring service. It collects numbers like CPU and memory, and logs of what happened, from my resources and apps, so I can see problems, analyse them and get alerts.

Intermediate Explain Log Analytics, alerts and Application Insights.

Model answer

Log Analytics is where I write KQL queries against collected logs. Alerts watch metrics, logs or the activity log and notify me through action groups, or trigger automation, when a condition is met. Application Insights monitors live web apps: request rates, response times, failures, dependencies, page views and availability tests.

Experienced developer How do you avoid alert fatigue?

Model answer

Alert on symptoms users feel (error rate, latency) rather than every metric, use dynamic thresholds, group alerts by severity with clear owners, route critical ones to on-call and the rest to dashboards, and review alerts after incidents to tune or remove noisy ones.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which tool lets you write KQL queries against log data collected by Azure Monitor?

Question 2

Question 2 of 3

Which feature monitors a web application's response times, failure rates and dependencies?

Question 3

Question 3 of 3

What do Azure Monitor alerts use to send emails, SMS or call webhooks?

Quick revision

Key points

  • Azure Monitor collects metrics and logs from many sources.
  • Log Analytics queries logs with KQL.
  • Alerts notify or automate through action groups.
  • Application Insights monitors application performance and usage.

Important terminology

Metrics
Numeric values collected at regular intervals, such as CPU percentage.
Logs
Records of events and data, queried with KQL in Log Analytics.
KQL
Kusto Query Language, used to query logs.
Action group
A set of notification and automation actions (email, SMS, webhook, Logic App) triggered by alerts.
Application Insights
Application performance monitoring (APM) feature of Azure Monitor.

Common mistakes

  • Confusing Azure Monitor (your resources) with Service Health (Azure platform issues).

Exam tips

  • "Query log data with KQL" = Log Analytics.
  • "Monitor web app response times and failures" = Application Insights.

Five quick revision questions

  1. 1.What two main types of data does Azure Monitor collect?Show

    Metrics and logs.

  2. 2.Which tool runs KQL queries on logs?Show

    Log Analytics.

  3. 3.What delivers alert notifications such as email or SMS?Show

    Action groups.

  4. 4.Which feature monitors application performance?Show

    Application Insights.

  5. 5.Can Azure Monitor collect data from on-premises?Show

    Yes, with agents (and Azure Arc).

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: SLAs and the Service Lifecycle