Azure Monitor is Microsoft’s comprehensive telemetry collection, monitoring, and observability service for Azure, hybrid, and multicloud resources. It provides end-to-end visibility across your entire technology stack—from infrastructure and networks down to application code and end-user experiences.
Architecture & Data Flow
Azure Monitor operates on a core telemetry pipeline that collects data from every layer of your environment, aggregates it into central datastores, and surfaces it through visualization, analytics, and automated alerting.
1. Core Data Types: Metrics vs. Logs
Azure Monitor segregates incoming telemetry into two primary formats:
| Data Type | Description | Primary Use Case | Storage & Retention |
| Metrics | Lightweight, numerical time-series values representing the state of a system at a specific point in time (e.g., CPU %, Available Memory, Request Rate). | Near real-time alerting, health dashboards, and auto-scaling triggers. | Stored in a lightweight time-series database for 93 days. |
| Logs | Structured or unstructured text events and activity records rich with metadata (e.g., Syslog, Windows Event Logs, HTTP Access Logs, Diagnostic Traces). | Deep root-cause analysis, trend auditing, complex security queries, and compliance reporting. | Stored in Log Analytics Workspaces queryable via KQL (Kusto Query Language); retainable up to 7 years. |
2. Telemetry Data Sources
Azure Monitor automatically or via agents collects data from five distinct layers:
- Core Platform & Subscription Data: Azure Activity Logs, Entra ID Sign-In logs, Resource Health status, and service-level platform metrics (collected automatically without setup).
- Resource Diagnostics: Specific resource logs (e.g., Key Vault secret access, SQL Database execution logs, Network Security Group flow logs) streamed via Diagnostic Settings.
- Guest Operating Systems (IaaS): Performance counters, OS event logs, and Syslog collected from VMs (in Azure, AWS, GCP, or on-premises) via the Azure Monitor Agent (AMA).
- Application Code: Application performance monitoring (APM) telemetry collected via the Application Insights SDK or OpenTelemetry.
- Network & Custom Sources: Synthetic ping tests, network hop metrics, and custom REST API log ingestions.
3. Key Features & Capabilities
Application Insights (APM)
A feature of Azure Monitor designed for web developers and DevOps teams.
- Request & Dependency Tracking: Tracks incoming HTTP request performance and downstream dependency calls (SQL, Redis, HTTP APIs).
- Distributed Tracing: Maps requests end-to-end as they pass through microservices.
- Exceptions & Telemetry: Captures unhandled stack traces and live application log output.
Log Analytics & KQL
The querying engine powering Azure Monitor.
- Runs Kusto Query Language (KQL) to query millions of log records in seconds.
- Allows joining data across different services, building custom charts, and feeding metrics directly into alerting rules.
Action Groups & Automated Alerts
- Metric Alerts: Triggers immediately when numerical thresholds are crossed (e.g., CPU > 90% for 5 minutes).
- Log Search Alerts: Executes scheduled KQL queries and alerts when matching event records exceed a set threshold.
- Action Groups: Coordinates responses when alerts fire—sending emails/SMS, calling Webhooks, triggering Azure Logic Apps/Functions, or opening tickets in ITSM tools (ServiceNow).
Insights & Workbooks
- Insights: Pre-packaged monitoring experiences tailored to specific services (e.g., VM Insights, Container Insights for AKS, Network Insights, Key Vault Insights).
- Workbooks: Interactive, customizable reporting dashboards combining text, live KQL query results, and metrics charts.