Alerts and action groups in Azure - Mini Project: Build & Apply

Create Azure Alerts with Action Groups

📖 Scenario: You are managing a cloud environment on Azure. You want to monitor your virtual machines and get notified when CPU usage is high. To do this, you will create an alert rule and connect it to an action group that sends an email notification.

🎯 Goal: Build an Azure alert rule that triggers when CPU usage exceeds 80%, and link it to an action group that sends an email notification to the administrator.

📋 What You'll Learn

Create an action group named HighCpuActionGroup with an email receiver [e-mail]

Create an alert rule named HighCpuAlert for a virtual machine resource

Set the alert condition to trigger when CPU percentage is greater than 80

Link the alert rule to the HighCpuActionGroup

💡 Why This Matters

🌍 Real World

Monitoring cloud resources is essential to maintain performance and availability. Alerts notify administrators about issues early.

💼 Career

Cloud engineers and administrators often configure alerts and action groups to automate monitoring and incident response.

1

Create the action group resource

Create an Azure action group resource named HighCpuActionGroup with an email receiver set to [e-mail]. Use the resource type Microsoft.Insights/actionGroups and include the email receiver configuration.

Azure

# Define the action group resource with email receiver
# Your code here

Hint

Use the emailReceivers property inside properties to add the email address.

2

Create the alert rule resource

Create an Azure alert rule resource named HighCpuAlert for a virtual machine resource. Use the resource type Microsoft.Insights/metricAlerts and set the target resource ID to /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM.

Azure

{
  "type": "Microsoft.Insights/actionGroups",
  "apiVersion": "2019-06-01",
  "name": "HighCpuActionGroup",
  "location": "global",
  "properties": {
    "groupShortName": "HighCpuAG",
    "enabled": true,
    "emailReceivers": [
      {
        "name": "AdminEmail",
        "emailAddress": "[e-mail]",
        "status": "Enabled"
      }
    ]
  }
}

# Define the alert rule resource for the VM
# Your code here

Hint

Use the scopes property to specify the VM resource ID.

3

Add the alert condition for CPU usage

Inside the alert rule HighCpuAlert, add a criteria that triggers when the metric Percentage CPU is greater than 80. Use the operator GreaterThan and time aggregation Average.

Azure

{
  "type": "Microsoft.Insights/actionGroups",
  "apiVersion": "2019-06-01",
  "name": "HighCpuActionGroup",
  "location": "global",
  "properties": {
    "groupShortName": "HighCpuAG",
    "enabled": true,
    "emailReceivers": [
      {
        "name": "AdminEmail",
        "emailAddress": "[e-mail]",
        "status": "Enabled"
      }
    ]
  }
},
{
  "type": "Microsoft.Insights/metricAlerts",
  "apiVersion": "2018-03-01",
  "name": "HighCpuAlert",
  "location": "global",
  "properties": {
    "description": "Alert when CPU usage is high",
    "severity": 3,
    "enabled": true,
    "scopes": [
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM"
    ],
    "evaluationFrequency": "PT1M",
    "windowSize": "PT5M",
    "criteria": {
      "odata.type": "Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria",
      "allOf": [
        {
          "name": "HighCpuCriteria",
          "metricName": "Percentage CPU",
          "metricNamespace": "Microsoft.Compute/virtualMachines",
          "operator": "GreaterThan",
          "threshold": 80,
          "timeAggregation": "Average"
        }
      ]
    },
    "autoMitigate": true,
    "actions": []
  }
}

# Confirm the criteria is set correctly
# Your code here

Hint

Check the criteria section inside the alert rule properties.

4

Link the alert rule to the action group

In the alert rule HighCpuAlert, add the HighCpuActionGroup to the actions array using its resource ID /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Insights/actionGroups/HighCpuActionGroup.

Azure

{
  "type": "Microsoft.Insights/actionGroups",
  "apiVersion": "2019-06-01",
  "name": "HighCpuActionGroup",
  "location": "global",
  "properties": {
    "groupShortName": "HighCpuAG",
    "enabled": true,
    "emailReceivers": [
      {
        "name": "AdminEmail",
        "emailAddress": "[e-mail]",
        "status": "Enabled"
      }
    ]
  }
},
{
  "type": "Microsoft.Insights/metricAlerts",
  "apiVersion": "2018-03-01",
  "name": "HighCpuAlert",
  "location": "global",
  "properties": {
    "description": "Alert when CPU usage is high",
    "severity": 3,
    "enabled": true,
    "scopes": [
      "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup/providers/Microsoft.Compute/virtualMachines/MyVM"
    ],
    "evaluationFrequency": "PT1M",
    "windowSize": "PT5M",
    "criteria": {
      "odata.type": "Microsoft.Azure.Monitor.MultipleResourceMultipleMetricCriteria",
      "allOf": [
        {
          "name": "HighCpuCriteria",
          "metricName": "Percentage CPU",
          "metricNamespace": "Microsoft.Compute/virtualMachines",
          "operator": "GreaterThan",
          "threshold": 80,
          "timeAggregation": "Average"
        }
      ]
    },
    "autoMitigate": true,
    "actions": []
  }
}

# Add the action group resource ID to the actions array
# Your code here

Hint

Add the action group resource ID inside the actions array in the alert rule properties.

Practice

1. What is the main purpose of an alert in Azure Monitor?

easy

A. To create virtual machines automatically

B. To notify you when a specific condition occurs in your cloud resources

C. To store data backups securely

D. To manage user permissions in Azure

Solution

1. Step 1: Understand what alerts monitor

   Alerts watch cloud resources and trigger when certain conditions happen, like high CPU or errors.

2. Step 2: Identify alert purpose

   The main goal is to notify you so you can act quickly and keep systems healthy.

3. Final Answer:

   To notify you when a specific condition occurs in your cloud resources -> Option B

4. Quick Check:

   Alerts = Notifications on conditions [OK]

Hint: Alerts notify on issues; think 'watch and warn' [OK]

Common Mistakes:

• Confusing alerts with resource creation
• Thinking alerts manage backups
• Assuming alerts control user access

2. Which of the following is the correct way to associate an action group with an alert rule in Azure?

easy

A. Create a new virtual network with the action group name

B. Add the action group as a tag to the resource

C. Specify the action group ID in the alert rule's actions section

D. Assign the action group to the resource's access control list

Solution

1. Step 1: Review alert rule configuration

   Alert rules include an actions section where you specify which action groups to notify or trigger.

2. Step 2: Confirm correct association method

   You link an action group by referencing its ID in the alert rule's actions, not by tags or network settings.

3. Final Answer:

   Specify the action group ID in the alert rule's actions section -> Option C

4. Quick Check:

   Action group linked via alert actions [OK]

Hint: Action groups go in alert actions, not tags or ACLs [OK]

Common Mistakes:

• Trying to add action groups as resource tags
• Confusing network setup with alert actions
• Assigning action groups to access control lists

3. Given this alert rule JSON snippet, what action group will be triggered when the alert fires?

{
  "name": "HighCPUAlert",
  "criteria": {"metricName": "Percentage CPU", "threshold": 80},
  "actions": [{"actionGroupId": "/subscriptions/123/resourceGroups/rg1/providers/microsoft.insights/actionGroups/NotifyTeam"}]
}

medium

A. NotifyTeam

B. BackupGroup

C. ScaleUpGroup

D. SecurityAlertGroup

Solution

1. Step 1: Locate action group ID in alert JSON

   The actions array contains an actionGroupId ending with 'NotifyTeam'.

2. Step 2: Match action group name

   The ID clearly points to the 'NotifyTeam' action group, so this group triggers on alert.

3. Final Answer:

   NotifyTeam -> Option A

4. Quick Check:

   ActionGroupId ends with NotifyTeam [OK]

Hint: Look for actionGroupId value in alert JSON [OK]

Common Mistakes:

• Picking wrong action group from unrelated names
• Ignoring the actionGroupId field
• Assuming default action group triggers

4. You created an alert rule but no notifications are sent when the condition is met. What is the most likely cause?

medium

A. The alert rule does not have any action groups assigned

B. The resource is offline

C. The alert rule threshold is set too low

D. The action group is disabled in Azure Security Center

Solution

1. Step 1: Check alert rule configuration

   If no notifications are sent, first verify if the alert rule has action groups assigned to send alerts.

2. Step 2: Understand action group role

   Action groups define who and how notifications are sent; without them, alerts trigger but no actions occur.

3. Final Answer:

   The alert rule does not have any action groups assigned -> Option A

4. Quick Check:

   No action groups = no notifications [OK]

Hint: Alerts need action groups to send notifications [OK]

Common Mistakes:

• Assuming resource offline stops alerts
• Thinking threshold affects notification sending
• Confusing action group status with Security Center

5. You want to create an alert that sends an email and triggers an Azure Function when CPU usage exceeds 90%. Which setup correctly achieves this?

hard

A. Create an alert rule with a metric condition for CPU > 90%, and assign an action group with only Azure Function action

B. Create an alert rule with a log query for CPU > 90%, and assign an action group with only email action

C. Create an alert rule with a metric condition for CPU > 90%, but no action group is needed if you have an Azure Function

D. Create an alert rule with a metric condition for CPU > 90%, and assign an action group with email and Azure Function actions

Solution

1. Step 1: Define alert condition and actions

   The alert must watch CPU metric > 90%, so use a metric condition. To notify and trigger automation, use an action group with both email and Azure Function actions.

2. Step 2: Confirm action group capabilities

   Action groups can include multiple actions like email and Azure Functions, enabling combined notifications and automation.

3. Final Answer:

   Create an alert rule with a metric condition for CPU > 90%, and assign an action group with email and Azure Function actions -> Option D

4. Quick Check:

   Metric alert + action group with email & function [OK]

Hint: Use action group with all needed actions for alert [OK]

Common Mistakes:

• Omitting action group when automation is needed
• Using log query instead of metric for CPU
• Assigning incomplete actions in action group