Applies toAzure Monitor, Log Analytics, Azure Monitor Agent, Azure Monitor Baseline Alerts
1. Workspace layout
| Option | When |
|---|---|
| One central workspace per region (in the management subscription) | Default for most organisations: simple queries, one place for Sentinel |
| Separate workspace per business unit | Strict data separation or billing needs |
| Per-application workspaces | Avoid; cross-workspace queries and access become messy |
Use resource-context RBAC so app teams see only logs of resources they can access, even in a shared workspace.
2. Diagnostic settings via policy
Assign the built-in initiative that enables diagnostic settings to Log Analytics for supported resource types at the top management group. New Key Vaults, SQL databases and App Services then log automatically.
az monitor diagnostic-settings list --resource <resource-id> -o table # spot check
3. Azure Monitor Agent with data collection rules
az monitor data-collection rule create -g rg-mgmt -n dcr-vm-baseline --location centralindia \
--rule-file dcr-vm-baseline.json
Collect only what you use: Windows System/Application errors and warnings, Linux syslog warning+, performance counters every 60 seconds. Every extra table costs money.
4. Baseline alerts (start small)
| Alert | Signal |
|---|---|
| VM unavailable | VM Availability Metric < 1 |
| VM CPU sustained high | Percentage CPU > 90% for 15 minutes |
| OS disk space low | Log query on InsightsMetrics / Perf, free space < 10% |
| App Service 5xx | Http5xx count above threshold |
| SQL DB high DTU/CPU | cpu_percent > 90% for 15 minutes |
| Backup job failed | Backup vault/Recovery Services vault diagnostic events |
| Service Health | Incidents and planned maintenance in your regions |
The Azure Monitor Baseline Alerts (AMBA) policy sets can deploy many of these at scale.
InsightsMetrics
| where Namespace == "LogicalDisk" and Name == "FreeSpacePercentage"
| summarize FreePct = min(Val) by Computer, Disk = tostring(parse_json(Tags)["vm.azm.ms/mountId"])
| where FreePct < 10
5. Action groups and routing
- One action group per team (email, Teams/webhook, ITSM).
- Severity: Sev0–1 page on-call, Sev2–3 create tickets.
- Use alert processing rules to suppress alerts during planned maintenance windows.
HA and DR notes
- Log Analytics workspaces are regional. For DR, create a workspace in the DR region (or keep the central one if it's in a third region) and point DR resources' diagnostic settings at it via policy parameters.
- Keep alert rules in code so you can redeploy them for the DR region.
Tip
Review alerts monthly: delete the ones nobody acted on, and add one for every incident that wasn't alerted. An alert set that pages too often gets ignored.