Azure Monitoring Guide 2026: Azure Monitor, App Insights & Best Practices

Azure is the second-largest cloud provider, powering millions of production workloads. Microsoft gives you a rich monitoring stack — Azure Monitor, Application Insights, Log Analytics, Azure Security Center, and more — but knowing which tools to use for which problems, and how to avoid spending a fortune on telemetry ingestion, requires real production experience. This guide distills Azure monitoring into actionable best practices.

The Azure Monitoring Stack: What's Available

Azure provides several native monitoring services, each covering a different layer of observability:

Azure Monitor: Core Infrastructure Monitoring

Understanding Azure Monitor Metrics

Azure Monitor Metrics is the foundation of Azure infrastructure monitoring. Every Azure resource — VMs, AKS clusters, Functions, SQL databases, App Services, and hundreds more — automatically publishes metrics. Metrics are organized by resource type and metric namespace.

Key Azure Monitor Metrics concepts:

• Platform metrics: Free metrics published automatically by all Azure services (no configuration needed)
• Custom metrics: Publish application metrics via the Azure Monitor REST API, SDK, or OpenTelemetry
• Metric dimensions: Filter and split metrics by dimensions (e.g., HTTP status code, operation name)
• Metric retention: 93 days for most metrics; high-resolution (sub-minute) retained 3 days
• Diagnostic settings: Required to route metrics and logs to Log Analytics or a storage account

Critical Metrics by Azure Service

Azure Monitor Alerts: Getting Effective Alerts

Azure Monitor Alerts fire when a condition is met on a metric, log query, or activity log event. Azure supports three alert types — metric alerts (fastest, near real-time), log search alerts (flexible KQL queries on Log Analytics data), and activity log alerts (service health, resource changes).

Alert Best Practices

• Use dynamic thresholds: Azure Monitor can learn a metric's normal pattern and alert on deviations — better than static thresholds for seasonal workloads
• Set evaluation frequency thoughtfully: Default is every 1 minute; reduce to 5 minutes for non-critical alerts to cut noise
• Use Action Groups: Route alerts to email, SMS, webhook, Logic App, or ITSM integrations via Action Groups — define once, reuse across alerts
• Alert on symptom, not cause: Alert on HTTP 5xx rate (symptom) rather than CPU (cause) — high CPU doesn't always mean user impact
• Severity levels: Use Sev 0 (Critical) for production outages, Sev 1 for degraded performance, Sev 2-4 for warnings and informational
• Enable service health alerts: Free alerts when Azure itself has issues in your region — these should be Sev 1

Application Insights: APM for Azure Apps

Application Insights is Microsoft's application performance monitoring (APM) service. It instruments your code — web apps, APIs, Functions, and workers — to capture telemetry automatically. Unlike Azure Monitor Metrics (infrastructure layer), Application Insights operates at the application layer: requests, exceptions, dependencies, page views, custom events, and traces.

Auto-Instrumented vs SDK Instrumentation

Application Insights offers two instrumentation approaches:

Key Application Insights Features

• Application Map: Visual graph of your app's component dependencies — instantly see where failures propagate
• Live Metrics Stream: Real-time telemetry with sub-second latency — invaluable during incident response
• Smart Detection: AI-powered anomaly detection — alerts on unusual failure rates, response time degradation, and dependency failures automatically
• Availability Tests: Run URL ping tests or multi-step web tests from global locations every 1-5 minutes
• Distributed Tracing: End-to-end request correlation across microservices using correlation IDs
• Profiler: CPU profiling in production — capture call stacks to find hot paths
• Snapshot Debugger: Capture exception snapshots with local variables in production without stopping the app

Log Analytics: Querying Logs with KQL

Log Analytics Workspace is where Azure routes all diagnostic logs — VM syslog, AKS container logs, App Service application logs, Activity Logs, and Application Insights telemetry. You query it using Kusto Query Language (KQL).

Essential KQL Queries

requests
| where success == false
| summarize count() by name, resultCode
| order by count_ desc
| take 20

requests
| where timestamp > ago(1h)
| summarize percentile(duration, 95) by name
| order by percentile_duration_95 desc

KubePodInventory
| where TimeGenerated > ago(24h)
| where ContainerRestartCount > 0
| summarize sum(ContainerRestartCount) by PodName, Namespace
| order by sum_ContainerRestartCount desc

exceptions
| where timestamp > ago(6h)
| summarize count() by type, outerMessage
| order by count_ desc

Log Ingestion Cost Optimization

Log Analytics can become expensive quickly. Strategies to control costs:

• Use Commitment Tiers: If ingesting >100GB/day, Commitment Tiers offer 15-65% savings over pay-as-you-go
• Set daily cap: Configure a daily ingestion cap per workspace to prevent runaway costs from verbose log sources
• Filter at the source: Use diagnostic setting filters to exclude noisy log categories (e.g., Azure Firewall flow logs can be massive)
• Separate workspaces by tier: High-retention compliance data in one workspace, short-retention debug data in another
• Use Basic Logs: New tier at $0.65/GB (vs. $2.76/GB Analytics) for verbose logs you rarely query
• Application Insights sampling: Enable adaptive sampling in App Insights SDK to reduce telemetry volume by 50-90%

Azure Workbooks & Dashboards

Azure Monitor Workbooks are interactive reports that combine metrics, logs, parameters, and visualizations. They're the preferred way to build custom Azure dashboards beyond the basic Azure Portal charts.

• Azure Dashboard: Pin charts from any Azure service — quick at-a-glance operational view
• Workbooks: Full interactive reports with drill-downs, parameters (time range, subscription, resource), and mixed data sources
• Insights: Pre-built Workbooks for specific services (VM Insights, Container Insights, Network Insights, SQL Insights)
• Grafana with Azure Data Source: Use managed Grafana (Azure Managed Grafana) or self-hosted Grafana with the Azure Monitor plugin for Grafana-style dashboards

Third-Party Azure Monitoring Tools

Native Azure Monitor is powerful but has limitations: KQL has a steep learning curve, the alert UI is complex, and cross-cloud visibility is limited. Third-party tools are common in Azure production environments:

Azure Monitoring Best Practices

Azure vs AWS Monitoring: Key Differences

If you're coming from AWS, here's how Azure's monitoring stack maps:

Getting Started: Azure Monitoring Quickstart Checklist

Related Azure Monitoring Resources

• AWS Monitoring Guide — CloudWatch, X-Ray, and Best Practices
• Kubernetes Monitoring Guide — AKS and Self-Managed Clusters
• OpenTelemetry Guide — Instrument Once, Export Anywhere
• Distributed Tracing Guide — Correlate Requests Across Services
• Cloud Monitoring Guide — Multi-Cloud Observability
• SLA vs SLO vs SLI — Define and Track Service Reliability
• Is Azure Down? — Check Azure Status in Real Time