Bird
Raised Fist0
Azurecloud~7 mins

Alerts and action groups in Azure - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Introduction
Sometimes things go wrong with your cloud resources. Alerts help you know when a problem happens. Action groups tell Azure what to do when an alert fires, like sending an email or calling a phone number.
When you want to get notified if a virtual machine stops working.
When you need to send a text message if your website is down.
When you want to automatically run a script after a storage account hits a limit.
When you want to alert your team by email if CPU usage is too high.
When you want to group multiple notification methods together for easy reuse.
Config File - alert-rule.json
alert-rule.json
{
  "location": "global",
  "properties": {
    "description": "Alert when CPU usage is over 80%",
    "severity": 2,
    "enabled": true,
    "scopes": [
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/Microsoft.Compute/virtualMachines/example-vm"
    ],
    "evaluationFrequency": "PT1M",
    "windowSize": "PT5M",
    "criteria": {
      "allOf": [
        {
          "metricName": "Percentage CPU",
          "metricNamespace": "Microsoft.Compute/virtualMachines",
          "operator": "GreaterThan",
          "threshold": 80,
          "timeAggregation": "Average",
          "criterionType": "StaticThresholdCriterion"
        }
      ]
    },
    "autoMitigate": true,
    "actions": [
      {
        "actionGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/microsoft.insights/actionGroups/example-actiongroup"
      }
    ]
  }
}

This JSON defines an alert rule in Azure Monitor.

  • location: Set to global because alerts are not region-specific.
  • description: Explains what the alert does.
  • severity: Level 2 means medium importance.
  • scopes: The resource to watch, here a virtual machine.
  • evaluationFrequency and windowSize: How often and over what time the metric is checked.
  • criteria: The condition to trigger the alert, here CPU over 80% average.
  • autoMitigate: Automatically resolve alert if condition clears.
  • actions: The action group to notify when alert fires.
Commands
Create an action group named example-actiongroup that sends an email to admin@example.com when triggered.
Terminal
az monitor action-group create --resource-group example-rg --name example-actiongroup --short-name exag --email-receivers name=Admin email=admin@example.com
Expected OutputExpected
{ "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/microsoft.insights/actionGroups/example-actiongroup", "location": "global", "name": "example-actiongroup", "resourceGroup": "example-rg", "shortName": "exag", "type": "microsoft.insights/actionGroups" }
→
--resource-group - Specifies the resource group where the action group is created
→
--name - Names the action group
→
--email-receivers - Defines who receives email notifications
Create an alert named high-cpu-alert that watches the example VM's CPU and triggers if average CPU is over 80% in 5 minutes, checking every minute, sending notifications via the action group.
Terminal
az monitor metrics alert create --name high-cpu-alert --resource-group example-rg --scopes /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/Microsoft.Compute/virtualMachines/example-vm --condition "avg Percentage CPU > 80" --description "Alert when CPU usage is over 80%" --action /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/microsoft.insights/actionGroups/example-actiongroup --window-size 5m --evaluation-frequency 1m --severity 2
Expected OutputExpected
Created metric alert 'high-cpu-alert' in resource group 'example-rg'
→
--scopes - Specifies the resource to monitor
→
--condition - Defines the metric condition to trigger the alert
→
--action - Links the alert to an action group for notifications
Check the details of the alert to confirm it was created correctly.
Terminal
az monitor metrics alert show --name high-cpu-alert --resource-group example-rg
Expected OutputExpected
{ "name": "high-cpu-alert", "resourceGroup": "example-rg", "description": "Alert when CPU usage is over 80%", "severity": 2, "enabled": true, "scopes": [ "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/Microsoft.Compute/virtualMachines/example-vm" ], "criteria": { "allOf": [ { "metricName": "Percentage CPU", "operator": "GreaterThan", "threshold": 80 } ] }, "actions": [ { "actionGroupId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/microsoft.insights/actionGroups/example-actiongroup" } ] }
→
--name - Specifies the alert name to show
→
--resource-group - Specifies the resource group of the alert
Key Concept

If you remember nothing else from this pattern, remember: alerts watch your resources and action groups tell Azure how to notify or respond when something needs attention.

Common Mistakes
Not linking an alert to an action group
The alert triggers but no notification or action happens, so you don't know about the problem.
Always specify an action group when creating an alert to ensure notifications are sent.
Using incorrect resource IDs in scopes or action group IDs
Azure cannot find the resource or action group, so the alert or notification fails silently.
Copy the full resource ID exactly from Azure portal or CLI to avoid typos.
Setting evaluation frequency or window size too large or too small
Too large delays alerting; too small causes noisy alerts.
Choose evaluation frequency and window size that balance timely alerts and noise, like 1 minute frequency and 5 minutes window.
Summary
Create an action group to define who and how to notify when an alert fires.
Create a metric alert that watches a resource's metric and triggers based on a condition.
Verify the alert details to ensure it is set up correctly and linked to the action group.

Practice

(1/5)
1. What is the main purpose of an alert in Azure Monitor?
easy
A. To create virtual machines automatically
B. To notify you when a specific condition occurs in your cloud resources
C. To store data backups securely
D. To manage user permissions in Azure

Solution

  1. Step 1: Understand what alerts monitor

    Alerts watch cloud resources and trigger when certain conditions happen, like high CPU or errors.

  2. Step 2: Identify alert purpose

    The main goal is to notify you so you can act quickly and keep systems healthy.

  3. Final Answer:

    To notify you when a specific condition occurs in your cloud resources -> Option B

  4. Quick Check:

    Alerts = Notifications on conditions [OK]
Hint: Alerts notify on issues; think 'watch and warn' [OK]
Common Mistakes:
  • Confusing alerts with resource creation
  • Thinking alerts manage backups
  • Assuming alerts control user access
2. Which of the following is the correct way to associate an action group with an alert rule in Azure?
easy
A. Create a new virtual network with the action group name
B. Add the action group as a tag to the resource
C. Specify the action group ID in the alert rule's actions section
D. Assign the action group to the resource's access control list

Solution

  1. Step 1: Review alert rule configuration

    Alert rules include an actions section where you specify which action groups to notify or trigger.

  2. Step 2: Confirm correct association method

    You link an action group by referencing its ID in the alert rule's actions, not by tags or network settings.

  3. Final Answer:

    Specify the action group ID in the alert rule's actions section -> Option C

  4. Quick Check:

    Action group linked via alert actions [OK]
Hint: Action groups go in alert actions, not tags or ACLs [OK]
Common Mistakes:
  • Trying to add action groups as resource tags
  • Confusing network setup with alert actions
  • Assigning action groups to access control lists
3. Given this alert rule JSON snippet, what action group will be triggered when the alert fires?
{
  "name": "HighCPUAlert",
  "criteria": {"metricName": "Percentage CPU", "threshold": 80},
  "actions": [{"actionGroupId": "/subscriptions/123/resourceGroups/rg1/providers/microsoft.insights/actionGroups/NotifyTeam"}]
}
medium
A. NotifyTeam
B. BackupGroup
C. ScaleUpGroup
D. SecurityAlertGroup

Solution

  1. Step 1: Locate action group ID in alert JSON

    The actions array contains an actionGroupId ending with 'NotifyTeam'.

  2. Step 2: Match action group name

    The ID clearly points to the 'NotifyTeam' action group, so this group triggers on alert.

  3. Final Answer:

    NotifyTeam -> Option A

  4. Quick Check:

    ActionGroupId ends with NotifyTeam [OK]
Hint: Look for actionGroupId value in alert JSON [OK]
Common Mistakes:
  • Picking wrong action group from unrelated names
  • Ignoring the actionGroupId field
  • Assuming default action group triggers
4. You created an alert rule but no notifications are sent when the condition is met. What is the most likely cause?
medium
A. The alert rule does not have any action groups assigned
B. The resource is offline
C. The alert rule threshold is set too low
D. The action group is disabled in Azure Security Center

Solution

  1. Step 1: Check alert rule configuration

    If no notifications are sent, first verify if the alert rule has action groups assigned to send alerts.

  2. Step 2: Understand action group role

    Action groups define who and how notifications are sent; without them, alerts trigger but no actions occur.

  3. Final Answer:

    The alert rule does not have any action groups assigned -> Option A

  4. Quick Check:

    No action groups = no notifications [OK]
Hint: Alerts need action groups to send notifications [OK]
Common Mistakes:
  • Assuming resource offline stops alerts
  • Thinking threshold affects notification sending
  • Confusing action group status with Security Center
5. You want to create an alert that sends an email and triggers an Azure Function when CPU usage exceeds 90%. Which setup correctly achieves this?
hard
A. Create an alert rule with a metric condition for CPU > 90%, and assign an action group with only Azure Function action
B. Create an alert rule with a log query for CPU > 90%, and assign an action group with only email action
C. Create an alert rule with a metric condition for CPU > 90%, but no action group is needed if you have an Azure Function
D. Create an alert rule with a metric condition for CPU > 90%, and assign an action group with email and Azure Function actions

Solution

  1. Step 1: Define alert condition and actions

    The alert must watch CPU metric > 90%, so use a metric condition. To notify and trigger automation, use an action group with both email and Azure Function actions.

  2. Step 2: Confirm action group capabilities

    Action groups can include multiple actions like email and Azure Functions, enabling combined notifications and automation.

  3. Final Answer:

    Create an alert rule with a metric condition for CPU > 90%, and assign an action group with email and Azure Function actions -> Option D

  4. Quick Check:

    Metric alert + action group with email & function [OK]
Hint: Use action group with all needed actions for alert [OK]
Common Mistakes:
  • Omitting action group when automation is needed
  • Using log query instead of metric for CPU
  • Assigning incomplete actions in action group