Azure Monitor alerts

Which rule

Action groups say who or what is told (email, SMS, voice, push, webhook, Secure Webhook, Logic Apps, Functions, Event Hubs, ITSM, runbooks); groupShortName is at most 12 characters. Turn on the common alert schema so every receiver gets one payload shape. Alert processing rules add action groups or suppress notifications at scale (for example during maintenance) without editing rules. Metric, log search and processing-rule counts per subscription are quotas: read the current values on the service limits page and use multi-resource rules or splitting by dimensions before asking for more.

Notification rate limits (fixed): no more than 100 emails an hour per address per region, one SMS and one voice call every five minutes per number, and 1,500 webhook calls a minute per subscription. Rate-limited receivers get a notice and are paused.

Bicep: an action group and a metric alert

// An action group and a metric alert: App Service 5xx responses above 10 in 5 minutes
param appServiceId string
param onCallEmail string

resource onCall 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: 'ag-oncall'
  location: 'global'
  properties: {
    groupShortName: 'oncall' // at most 12 characters
    enabled: true
    emailReceivers: [
      {
        name: 'oncall-email'
        emailAddress: onCallEmail
        useCommonAlertSchema: true
      }
    ]
  }
}

resource http5xx 'Microsoft.Insights/metricAlerts@2026-01-01' = {
  name: 'alert-app-http5xx'
  location: 'global'
  properties: {
    severity: 2
    enabled: true
    scopes: [appServiceId]
    evaluationFrequency: 'PT1M'
    windowSize: 'PT5M'
    criteria: {
      'odata.type': 'Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria'
      allOf: [
        {
          criterionType: 'StaticThresholdCriterion'
          name: 'http5xx'
          metricName: 'Http5xx'
          metricNamespace: 'Microsoft.Web/sites'
          operator: 'GreaterThan'
          threshold: 10
          timeAggregation: 'Total'
        }
      ]
    }
    autoMitigate: true
    actions: [
      {
        actionGroupId: onCall.id
      }
    ]
  }
}

Bicep: a log search alert with its own identity

A system-assigned identity on a log search alert is created without permissions: grant it read on what it queries, or the rule goes unhealthy.

// A log search alert with its own identity, allowed to read the workspace it queries
param location string = resourceGroup().location
param workspaceName string
param actionGroupId string

resource ws 'Microsoft.OperationalInsights/workspaces@2026-03-01' existing = {
  name: workspaceName
}

resource failedLogins 'Microsoft.Insights/scheduledQueryRules@2026-03-01' = {
  name: 'alert-failed-logins'
  location: location
  identity: {
    type: 'SystemAssigned' // created without permissions: see the role assignment below
  }
  properties: {
    severity: 2
    enabled: true
    scopes: [ws.id]
    evaluationFrequency: 'PT5M'
    windowSize: 'PT15M'
    criteria: {
      allOf: [
        {
          query: 'AuditEvents_CL | where Action == "login" and Outcome == "failure"'
          timeAggregation: 'Count'
          operator: 'GreaterThan'
          threshold: 20
          failingPeriods: {
            numberOfEvaluationPeriods: 1
            minFailingPeriodsToAlert: 1
          }
        }
      ]
    }
    autoMitigate: true
    actions: {
      actionGroups: [actionGroupId]
    }
  }
}

var logAnalyticsReader = '73c42c96-874c-492b-b04d-ab87d138a893'

resource ruleCanQuery 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  scope: ws
  name: guid(ws.id, failedLogins.id, logAnalyticsReader)
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', logAnalyticsReader)
    principalId: failedLogins.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

The table comes from reference/monitor/diagnostic-settings-and-data-collection.md.

Errors saving a log search alert rule

Rules that don't fire, or fire wrongly

• Log search alert silent: check the rule's Resource health; log latency (over about 4 minutes of delay, prefer a metric alert); Mute actions or automatically resolve set; the target moved, renamed or deleted (re-create the rule); the identity lacks permissions; the query started failing (a table with no data for 30 days, a custom table not created yet, a deleted resource in a cross-resource query).
• Log search alert misfires: very late data (over about 30 minutes) can trigger it; alerting on missing data (heartbeats) works poorly with logs.
• Metric alert silent: the alert is already active (stateful); wrong dimensions, aggregation or granularity; the first evaluation period missing; the alert fired but its actions were muted or rate-limited.

Action group errors (test the action group to see them)