Log collection requires configured agent sources and data routing. In this case, an engineer queries six months of verbose VM logs for a five-minute incident. “VM monitoring agent/data collection rules and destination workspace” would not satisfy that requirement; the supported action is “Restrict the KQL time range and relevant resource identifiers”. Focused query ranges improve performance and relevance.

KQL summarize with bin groups timestamped events into time windows. In this case, an engineer queries six months of verbose VM logs for a five-minute incident. “Use summarize with bin(TimeGenerated, 1h) over filtered request records” would not satisfy that requirement; the supported action is “Restrict the KQL time range and relevant resource identifiers”. Focused query ranges improve performance and relevance.

Resource metrics may exist even if guest diagnostic collection is not configured. In this case, an engineer queries six months of verbose VM logs for a five-minute incident. “Platform metrics and guest log collection use different pipelines” would not satisfy that requirement; the supported action is “Restrict the KQL time range and relevant resource identifiers”. Focused query ranges improve performance and relevance.

Diagnostic settings send supported resource logs to configured destinations. In this case, an Azure VM's CPU is high but Azure Monitor Logs show no guest performance rows. “Diagnostic settings for the relevant storage service with Log Analytics destination” would not satisfy that requirement; the supported action is “VM monitoring agent/data collection rules and destination workspace”. Log collection requires configured agent sources and data routing.

Focused query ranges improve performance and relevance. In this case, an Azure VM's CPU is high but Azure Monitor Logs show no guest performance rows. “Restrict the KQL time range and relevant resource identifiers” would not satisfy that requirement; the supported action is “VM monitoring agent/data collection rules and destination workspace”. Log collection requires configured agent sources and data routing.

Early predicates reduce the volume of relevant rows to analyze. In this case, an Azure VM's CPU is high but Azure Monitor Logs show no guest performance rows. “Filter by TimeGenerated and selective conditions early in the KQL query” would not satisfy that requirement; the supported action is “VM monitoring agent/data collection rules and destination workspace”. Log collection requires configured agent sources and data routing.

Diagnostic settings send supported resource logs to configured destinations. In this case, a metric chart shows VM CPU but guest process details are absent. “Diagnostic settings for the relevant storage service with Log Analytics destination” would not satisfy that requirement; the supported action is “Platform metrics and guest log collection use different pipelines”. Resource metrics may exist even if guest diagnostic collection is not configured.

Early predicates reduce the volume of relevant rows to analyze. In this case, a metric chart shows VM CPU but guest process details are absent. “Filter by TimeGenerated and selective conditions early in the KQL query” would not satisfy that requirement; the supported action is “Platform metrics and guest log collection use different pipelines”. Resource metrics may exist even if guest diagnostic collection is not configured.

Focused query ranges improve performance and relevance. In this case, a metric chart shows VM CPU but guest process details are absent. “Restrict the KQL time range and relevant resource identifiers” would not satisfy that requirement; the supported action is “Platform metrics and guest log collection use different pipelines”. Resource metrics may exist even if guest diagnostic collection is not configured.

Diagnostic settings can route supported categories to storage for retention. In this case, a storage team needs to route Blob service diagnostic logs to a central workspace. “Send diagnostic logs to an approved storage account archive destination” would not satisfy that requirement; the supported action is “Diagnostic settings for the relevant storage service with Log Analytics destination”. Diagnostic settings send supported resource logs to configured destinations.

Workspace retention and archival destinations are separate architecture decisions. In this case, a storage team needs to route Blob service diagnostic logs to a central workspace. “Add an independent authorized storage or Event Hubs destination if required” would not satisfy that requirement; the supported action is “Diagnostic settings for the relevant storage service with Log Analytics destination”. Diagnostic settings send supported resource logs to configured destinations.

Log collection requires configured agent sources and data routing. In this case, a storage team needs to route Blob service diagnostic logs to a central workspace. “VM monitoring agent/data collection rules and destination workspace” would not satisfy that requirement; the supported action is “Diagnostic settings for the relevant storage service with Log Analytics destination”. Diagnostic settings send supported resource logs to configured destinations.

Diagnostic settings can route supported categories to storage for retention. In this case, an admin enables diagnostic settings only on the storage account root and misses Blob request logs. “Send diagnostic logs to an approved storage account archive destination” would not satisfy that requirement; the supported action is “Service-level diagnostic settings for the blob subresource”. Storage services can expose diagnostic categories on separate subresources.

Log collection requires configured agent sources and data routing. In this case, an admin enables diagnostic settings only on the storage account root and misses Blob request logs. “VM monitoring agent/data collection rules and destination workspace” would not satisfy that requirement; the supported action is “Service-level diagnostic settings for the blob subresource”. Storage services can expose diagnostic categories on separate subresources.

Workspace retention and archival destinations are separate architecture decisions. In this case, an admin enables diagnostic settings only on the storage account root and misses Blob request logs. “Add an independent authorized storage or Event Hubs destination if required” would not satisfy that requirement; the supported action is “Service-level diagnostic settings for the blob subresource”. Storage services can expose diagnostic categories on separate subresources.

Diagnostic settings send supported resource logs to configured destinations. In this case, a compliance unit requires retention of exported platform logs independent of the workspace. “Diagnostic settings for the relevant storage service with Log Analytics destination” would not satisfy that requirement; the supported action is “Send diagnostic logs to an approved storage account archive destination”. Diagnostic settings can route supported categories to storage for retention.

Storage services can expose diagnostic categories on separate subresources. In this case, a compliance unit requires retention of exported platform logs independent of the workspace. “Service-level diagnostic settings for the blob subresource” would not satisfy that requirement; the supported action is “Send diagnostic logs to an approved storage account archive destination”. Diagnostic settings can route supported categories to storage for retention.

Detection and notification routing require separate configuration. In this case, a compliance unit requires retention of exported platform logs independent of the workspace. “The alert rule's associated action groups and receiver configuration” would not satisfy that requirement; the supported action is “Send diagnostic logs to an approved storage account archive destination”. Diagnostic settings can route supported categories to storage for retention.

Diagnostic settings send supported resource logs to configured destinations. In this case, a team sends logs only to Log Analytics and expects its deletion to preserve an archive. “Diagnostic settings for the relevant storage service with Log Analytics destination” would not satisfy that requirement; the supported action is “Add an independent authorized storage or Event Hubs destination if required”. Workspace retention and archival destinations are separate architecture decisions.

Storage services can expose diagnostic categories on separate subresources. In this case, a team sends logs only to Log Analytics and expects its deletion to preserve an archive. “Service-level diagnostic settings for the blob subresource” would not satisfy that requirement; the supported action is “Add an independent authorized storage or Event Hubs destination if required”. Workspace retention and archival destinations are separate architecture decisions.

Detection and notification routing require separate configuration. In this case, a team sends logs only to Log Analytics and expects its deletion to preserve an archive. “The alert rule's associated action groups and receiver configuration” would not satisfy that requirement; the supported action is “Add an independent authorized storage or Event Hubs destination if required”. Workspace retention and archival destinations are separate architecture decisions.

Short evaluation windows can treat transient spikes as incidents. In this case, an operational alert should email a team and invoke a remediation runbook. “Adjust aggregation granularity and alert threshold based on desired signal” would not satisfy that requirement; the supported action is “An action group containing the supported notification and automation receivers”. Action groups define alert-driven notifications and action targets.

Workspace retention and archival destinations are separate architecture decisions. In this case, an operational alert should email a team and invoke a remediation runbook. “Add an independent authorized storage or Event Hubs destination if required” would not satisfy that requirement; the supported action is “An action group containing the supported notification and automation receivers”. Action groups define alert-driven notifications and action targets.

Azure Monitor metric alert sensitivity depends on aggregation and evaluation timing. In this case, an operational alert should email a team and invoke a remediation runbook. “Configure metric threshold, evaluation frequency and aggregation window” would not satisfy that requirement; the supported action is “An action group containing the supported notification and automation receivers”. Action groups define alert-driven notifications and action targets.

Short evaluation windows can treat transient spikes as incidents. In this case, an alert condition evaluates true but no team receives a message. “Adjust aggregation granularity and alert threshold based on desired signal” would not satisfy that requirement; the supported action is “The alert rule's associated action groups and receiver configuration”. Detection and notification routing require separate configuration.

Azure Monitor metric alert sensitivity depends on aggregation and evaluation timing. In this case, an alert condition evaluates true but no team receives a message. “Configure metric threshold, evaluation frequency and aggregation window” would not satisfy that requirement; the supported action is “The alert rule's associated action groups and receiver configuration”. Detection and notification routing require separate configuration.

Workspace retention and archival destinations are separate architecture decisions. In this case, an alert condition evaluates true but no team receives a message. “Add an independent authorized storage or Event Hubs destination if required” would not satisfy that requirement; the supported action is “The alert rule's associated action groups and receiver configuration”. Detection and notification routing require separate configuration.

Processing rules avoid repeated editing of individual alert definitions. In this case, a CPU metric alert must trigger only after a threshold persists over the evaluation window. “Use a scoped alert processing rule for the maintenance window” would not satisfy that requirement; the supported action is “Configure metric threshold, evaluation frequency and aggregation window”. Azure Monitor metric alert sensitivity depends on aggregation and evaluation timing.

Alert processing rules can control downstream notifications during maintenance. In this case, a CPU metric alert must trigger only after a threshold persists over the evaluation window. “Alert processing rule with a time-bound suppression schedule” would not satisfy that requirement; the supported action is “Configure metric threshold, evaluation frequency and aggregation window”. Azure Monitor metric alert sensitivity depends on aggregation and evaluation timing.

Detection and notification routing require separate configuration. In this case, a CPU metric alert must trigger only after a threshold persists over the evaluation window. “The alert rule's associated action groups and receiver configuration” would not satisfy that requirement; the supported action is “Configure metric threshold, evaluation frequency and aggregation window”. Azure Monitor metric alert sensitivity depends on aggregation and evaluation timing.

Detection and notification routing require separate configuration. In this case, a metric alert fires briefly from a single spike and causes noise. “The alert rule's associated action groups and receiver configuration” would not satisfy that requirement; the supported action is “Adjust aggregation granularity and alert threshold based on desired signal”. Short evaluation windows can treat transient spikes as incidents.

Processing rules avoid repeated editing of individual alert definitions. In this case, a metric alert fires briefly from a single spike and causes noise. “Use a scoped alert processing rule for the maintenance window” would not satisfy that requirement; the supported action is “Adjust aggregation granularity and alert threshold based on desired signal”. Short evaluation windows can treat transient spikes as incidents.

Alert processing rules can control downstream notifications during maintenance. In this case, a metric alert fires briefly from a single spike and causes noise. “Alert processing rule with a time-bound suppression schedule” would not satisfy that requirement; the supported action is “Adjust aggregation granularity and alert threshold based on desired signal”. Short evaluation windows can treat transient spikes as incidents.