AZ-104
Deep Dive
Azure Monitor is Azure's centralized observability platform. The AZ-104 exam evaluates Monitor's architecture, how to configure data collection and the available analysis and action tools.
Contents
Azure Monitor is Azure's unified monitoring service. It collects, analyzes and acts on telemetry data from resources in Azure, on-premises and other clouds. It provides a single platform for metrics, logs, alerts and visualization.
Collect
Analyze
Act
Data types in Azure Monitor
Metrics
Time series of numeric values. Collected every 1 minute. Stored for 93 days. Lightweight and fast for near real-time alerts.
Logs
Structured or semi-structured records. Stored in a Log Analytics Workspace. Allow complex KQL queries. Include Activity Log, Resource Logs, and agent data.
Traces
Application Insights data for code instrumentation: request traces, dependency calls, exceptions, custom events.
Data sources
Azure Platform
Metrics and logs automatically generated by Azure resources (VMs, Storage, SQL, etc.). No configuration needed.
Activity Log
Log of operations on Azure resources (create, update, delete, RBAC changes). 90 days of free retention.
Resource Diagnostic Logs
Detailed logs of the resource — require configuring "Diagnostic Settings" to send them to Log Analytics, Storage or Event Hub.
Guest OS (Azure Monitor Agent)
Metrics and logs from the VM's operating system. Requires Azure Monitor Agent (AMA) + Data Collection Rule.
Application Insights
Application code telemetry. Requires SDK or auto-instrumentation.
Diagnostic Settings — critical configuration
Diagnostic Settings on each Azure resource determine whether diagnostic logs and metrics are sent to a destination. Without configuring them, detailed resource data will not be available in Log Analytics.
Log Analytics Workspace
Analysis with KQL, alerts, dashboards
Storage Account
Long-term archiving, auditing, compliance
Event Hub
Streaming to external SIEM (Splunk, QRadar, Sentinel)
Metric characteristics
Important metrics by service
Activity Log
Records all control-plane operations on Azure resources. Who did what, when, and the result.
Resource Logs (Diagnostic Logs)
Detailed logs of operations within the resource (data plane). Require Diagnostic Settings to be collected.
An Action Group is a collection of actions executed when an alert fires. It's reusable: multiple alerts can share the same action group. An alert can have multiple action groups.
| Action type | Description | Typical use |
|---|---|---|
| Email / SMS / Push / Voice | Direct notification to people | Immediately alert the operations team |
| Azure Function | Executes an Azure Function | Automatic remediation (restart VM, adjust configuration) |
| Logic App | Triggers a Logic Apps workflow | Create tickets in ITSM, send to Teams/Slack, complex flows |
| Webhook | Calls an HTTP URL with the alert's payload | Integrate with external systems (PagerDuty, OpsGenie, custom) |
| Automation Runbook | Runs a runbook in Azure Automation | Complex automated remediation with PowerShell/Python |
| ITSM | Creates a ticket in ITSM (ServiceNow, Cherwell) | Integration with corporate incident management |
| Event Hub | Publishes an event to Event Hub | Streaming alerts to external analytics systems |
Azure Workbooks
Interactive reports in Azure Monitor. Combine text, KQL queries, metrics and parameters in a single view. Shareable across teams.
Azure Dashboards
Custom views in the Azure Portal. Pin metric charts, Log Analytics queries, resource status. For continuous operational monitoring.
Did you get this topic?
Test what you just learned
An administrator wants to view detailed logs of SQL queries executed against an Azure SQL Database over the past 7 days. When searching in Log Analytics they can't find the data. What is the most likely cause?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.