AZ-104
Deep Dive
Diagnostics in Azure go beyond metrics: Diagnostic Settings, Activity Log, Resource Health and Service Health form the visibility ecosystem for what's happening with your resources and the Azure platform. The AZ-104 exam evaluates all of these components.
Contents
Diagnostic Settings are the per-resource configuration that determines which telemetry data is exported and to which destinations. Without Diagnostic Settings, resource logs and granular metrics are NOT captured outside the resource.
What can be captured
Metrics
The resource's metrics (the same ones available in Metrics Explorer). Useful for exporting to Storage for long retention or to Event Hub for streaming.
Resource Logs (categories)
Each resource exposes specific log categories. E.g. SQL has SQLInsights, Errors, QueryStoreRuntimeStatistics. You can select individual categories or "All Logs".
Available destinations
Log Analytics Workspace
Near real-time analysis with KQL. Log-based alerts. The most common destination for operations.
Storage Account
Long-term archiving. JSON format in containers named by log type. For compliance/auditing with years of retention.
Event Hub
Real-time streaming to external systems. Ideal for SIEM (Splunk, Sentinel, QRadar), data lakes or custom processing.
Partner Solution
Direct integration with certified partner solutions (Datadog, Elastic, etc.).
Scope of Diagnostic Settings
Per individual resource
Each resource has its own "Diagnostic Settings" section. Configure them one by one or use Azure Policy to apply automatically to all resources of a type in a subscription/group.
Subscription (Activity Log)
The Activity Log has its own Diagnostic Settings at the subscription level. Configured under Monitor → Activity Log → Diagnostic Settings.
The Activity Log records all write operations (PUT, POST, DELETE) performed on Azure resources — who did what action on which resource, when, and the result. It's the audit trail of Azure's control plane.
Important fields in each entry
Activity Log categories
• Administrative: CRUD operations on resources
• Security: alerts from Microsoft Defender for Cloud
• Service Health: Azure incidents and maintenance
• Alert: Azure Monitor alerts fired
• Autoscale: automatic scaling actions
• Recommendation: Azure Advisor recommendations
• Policy: Azure Policy evaluations
Retention and export
Azure Resource Health reports on the health of the specific resource — distinguishing whether a problem is caused by the Azure platform or by the user's configuration. It lets you tell apart an Azure outage from a problem the customer needs to fix.
Resource Health states
Available
The resource is working correctly. No issues detected.
Unavailable
The resource has known issues. It can be an Azure incident (platform) or a user issue (configuration).
Degraded
The resource works but with reduced capacity or warnings.
Unknown
Azure has not received signals from the resource for more than 10 minutes. Transient state or the resource is offline.
How to use Resource Health
Azure Service Health reports on the health of Azure services globally and their impact on your subscription. It includes active incidents, planned maintenance and health advisories.
Service Issues
Active outages in Azure services that may affect your subscription. Includes affected region(s), impacted services, root cause (post-incident) and resolution status.
Planned Maintenance
Scheduled maintenance that may require customer action or cause brief downtime. Microsoft notifies in advance (generally 2+ weeks).
Health Advisories
Notices of deprecated features, behavior changes or recommended actions. They don't imply an outage but require attention before deadlines.
Key difference: Service Health vs Resource Health
Service Health
Reports on Azure's infrastructure. If East US has an Azure Compute outage, Service Health shows it. It's not specific to your resources.
Resource Health
Reports on YOUR specific resource. Your specific VM (vm-prod-01) is Available or Unavailable — and whether it's due to Azure or your own configuration.
Azure Advisor is Azure's personalized recommendations service. It analyzes your resource configuration and recommends improvements across five main categories.
Reliability (High Availability)
Security
Performance
Cost
Operational Excellence
Cost Analysis
Visualizes spend by service, resource group, tag, location. Allows filtering and grouping in multiple ways. Identifies the most costly resources and spending trends.
Budgets
Define spending thresholds and get alerted when they are reached. Automatic actions (action groups) can be configured when exceeding 50%, 80%, 100% of the budget.
Did you get this topic?
Test what you just learned
An administrator accidentally deletes a critical resource group. In which Azure service can they find exactly who performed the deletion, at what time and from which IP?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.