Azure Monitor

Discover Azure's global backbone, linking data centers with fiber and subsea cables across 60 regions, enabling region pairs, availability zones, and low-latency, compliant deployments near users.

Explore Azure regions and data centers, learn to read region legends, availability zones, geography, and compliance such as GDPR and HIPAA, and understand the Azure backbone and disaster recovery.

Explore the Azure resource hierarchy and governance, from management group to subscriptions, resource groups, and resources, and learn how inheritance, Azure policy, and RBAC enforce security, cost control, and compliance.

Explore the four azure subscription types, including free, student, pay-as-you-go, and enterprise agreement, and identify which options fit learning and practical deployment.

Clarifies the distinction between Entra ID tenants and Azure environments. Entra ID provides identity services for humans, managed identities, and app registrations, while Azure hosts resources, subscriptions, and resource groups.

Sign up for Azure free or pay-as-you-go, authenticate with your Microsoft account, and complete the form to access 12 months of popular services, 55 always free, and 200 usd credit.

Explore the Azure resource hierarchy by setting up your environment, creating and organizing management groups, subscriptions, and a resource group, and learning how to move and rename items.

Create a subscription budget in azure cost management by setting scope, name, billing period, threshold, and alerts for actual or forecasted consumption, noting budgets do not stop resources.

Explore Azure management tools to interact with Azure resources: the portal, PowerShell, CLI, Cloud Shell, and Copilot for GUI configuration, automation, cross-platform access, and AI-assisted scripting.

Access the Azure portal at portal.azure.com and use the left hamburger menu to create resources, view dashboards, and explore compute services like virtual machines.

Explore how Azure PowerShell works across Windows and Mac OS, using Azure PowerShell module to create, read, update, or delete resources, starting with a resource group and a virtual machine.

Install PowerShell on Windows using Win Get if not present, then install the Azure PowerShell module for Windows, running commands as administrator and following the linked guides.

Install PowerShell on macOS using homebrew, then install the Azure PowerShell module by following the commands from the Microsoft article and the terminal demonstrations.

Learn to use Azure PowerShell to authenticate and manage Azure resources. Create resource groups and virtual machines, configure locations, and safely delete groups with force delete.

Install azure cli and run it on Windows or Mac OS to create, read, update, and delete resources; shows building resource group, vnet, subnet, ip, nic, and vm via cli.

Install the Azure CLI on Windows using winget, copy the install command, run it in a terminal, then close and reopen terminals to use the CLI, and verify version 2.77.0.

Install the Azure CLI on macOS using Homebrew, install or update it via terminal commands, and verify the installation by running az version.

Learn to manage Azure resources with the Azure CLI, including login, selecting a subscription, listing locations, and creating resources like resource groups, VNets, subnets, public IPs, NICs, and VMs.

Access Azure Cloud Shell in the portal to run Azure CLI or PowerShell in your browser, create a resource group and a VM, then delete it with az group delete.

Explore how Azure Copilot guides resource management in the portal with prompts, Azure Resource Graph, and guided non autonomous actions to create and delete resource groups and virtual machines.

Describe Azure Log Analytics as the backbone that ingests logs and metrics, enabling Azure Monitor and other services like Sentinel and Defender for Cloud and Logic Apps to consume data.

Explore how log analytics uses a workspace and tables to organize logs, such as the event and syslog tables. Write queries in Kql to filter events by id or severity.

Control data retention in log analytics with Azure Monitor by configuring workspace settings and table tiers, analytic tier's 30-day default to 12 years in basic and auxiliary tiers.

Explore how Azure Monitor provides comprehensive observability by gathering app insights, VM insights, and network insights, enabling automated monitoring and rapid remediation across apps, VMs, and networks.

Explore Azure Monitor architecture from data sources and the data platform to metrics, logs, traces, and changes, then visualize, analyze, and automate responses with insights, dashboards, and integrations.

Explore data sources for Azure Monitor, including apps, infrastructure, Azure platform, and custom sources, with Opentelemetry, agents, and Rest APIs feeding the data platform.

Explore how data sources ingest logs and metrics into the data platform of Azure Monitor, where metrics are numerical values like cpu consumption, and logs, traces, and changes capture events.

Ingest data sources into the data platform and visualize them in azure monitor using azure workbooks, dashboards, power bi, or grafana dashboards.

Analyse the Azure Monitor step by examining data sources, ingest and consumption, using Metrics Explorer, querying logs in the Log Analytics workspace with KCL, and change analysis to track modifications.

Explore the respond step in Azure Monitor, from ingesting data sources to automated and manual responses using AIOps, alerts, and actions that drive auto scaling.

Explore the Azure Monitor overview, including insights, metrics, alerts, logs, change analysis, service health, diagnostic settings, and dashboards to visualize telemetry and configure managed services.

Learn data sources and collection methods in Azure Monitor, including onboarding Windows VMs to Log Analytics, and compare application instrumentation options like auto instrumentation and OpenTelemetry.

Create and deploy a Log Analytics workspace in Azure Monitor to ingest and inspect logs. Configure the workspace by selecting a subscription, resource group, and a region like North Europe.

Configure the Azure Monitor agent on a Windows VM, create a data collection rule to ingest Windows event logs into a Log Analytics workspace, and verify logs in Log Analytics.

Enable diagnostic settings to route platform metrics and logs from Azure resources to destinations like Log Analytics or Event Hub, scalable via policy across subscriptions and management groups.

Configure diagnostic settings for an Azure Key Vault by selecting logs and metrics and sending them to a Log Analytics workspace, then view telemetry in Log Analytics.

Understand application instrumentation in Azure Monitor, comparing auto instrumentation—enabled by flipping a switch in app service—with OpenTelemetry, which requires a client library, code access, and connection string for Application Insights.

Configure application instrumentation to enable Application Insights for an App Service by creating a web app, enabling insights during creation, and using auto instrumentation in Azure Monitor.

Review the data platform and how data sources are ingested, focusing on metrics, logs, traces, and changes.

Configure an Azure Monitor environment by creating a resource group and a Log Analytics workspace, set diagnostic settings to route activity log categories to Log Analytics, and generate sample logs.

Explore Azure Monitor metrics as a set of features collecting numeric data from resources, including platform, custom, and Kubernetes metrics, visualized in dashboards and used for alerts and autoscaling.

Explore azure monitor logs and azure log analytics to collect, transform, and optimize data in log analytics workspace using data collection rules and the monitor agent, with kql for analysis.

Discover how the Kusto query language (KQL) enables fast, modular queries over large data in Azure Log Analytics, supporting log analysis, security monitoring, and operational insights.

Develop a kql query by testing a hypothesis, selecting the right tables, applying filters, and visualizing results to confirm an ip address belongs to your logs and identify its device.

Explore how to combine where with contains and has in KQL, comparing case-insensitive contains to word-based has, using has any and has all for matching multiple terms.

Explore the search operator in KQL for finding a string across log tables, learn its performance limits with large data, and apply where filters and wildcards to optimize queries.

Explore the project operator in Azure Monitor to select and rename columns from heartbeat and event tables. Create calculated columns such as duration in minutes and time since last beat.

Extend creates new columns by computing values from existing data, enabling dynamic calculations, multiple columns, conditional logic, and string operations, and can be combined with project for temporary columns.

Learn to use the sort by operator in KQL to order data by time generated or other columns, with asc/desc and multi-column sorts.

Explore the count operator in kql by counting heartbeat data and filtering events with where level >= 3, then count azure activity from the last 24 hours in four lines.

Learn to use the summarize operator in KQL to count events by source, compute total events, and apply max, min, and dcount aggregations across event and heartbeat tables.

Explore the render operator in KQL to visualize heartbeats with a time chart for the last 24 hours, and render various chart types: column, bar, pie, and area.

Explore how insights are produced after ingesting data sources into the data platform, and configure application insights, container insights, VM insights, and network insights.

Configure insights in Azure Monitor for applications and virtual machines, enabling metrics via data collection rules and onboarding resources; note Network Watcher as an alternative for networks.

Explore Azure Network Watcher for monitoring, diagnosing, and viewing metrics across virtual machines, VNets, and other networking resources, with features like connection monitor, topology overview, and on-demand connection troubleshooting.

Explore how to deploy Network Watcher, view VNet topology, monitor connections, diagnose NSGs, run IP flow verify and next hop tests, capture packets, and review metrics and logs.

Configure Azure Network Watcher’s connection monitor for continuous production-level connectivity. Define sources, endpoints, and test settings (TCP, 30s, 5% threshold) and monitor to Bing.com on port 80.

Configure NSG flow logs in Azure Monitor by selecting an NSG and a storage account. Retire NSG flow logs by 2027; use VNet flow logs to monitor all VNet traffic.

Learn to create VNet flow logs in Network Watcher by selecting a virtual network and storage account, with traffic analytics to a Log Analytics workspace; NSG flow logs are deprecated.

Explore how Azure Monitor visualizes ingested data using dashboards and workbooks, and learn how to integrate with Power BI or Grafana for broader visualization across Defender for Cloud and Sentinel.

Explore Azure Monitor dashboards to visualize log analytics data with KCL queries, enabling correlation and sharing of visualized data outside Azure Monitor using area, column, pie, scatter, and time charts.

Visualize data with azure workbooks by combining text, log queries with kcl, metrics, and parameters into interactive reports for vm usage, performance, and outage impact.

Configure visualization in Azure Monitor using metrics dashboards and workbooks, selecting CPU percentage metrics, namespace, and aggregations, and choosing line, area, or bar charts.

Review the analyze step in the Azure Monitor workflow, comparing Metric Explorer, Log Analytics, and Change Analysis to monitor metrics, run KQL queries, and track environment changes.

Azure Monitor's analysis step uses change analysis, logs, and metrics to reveal who changed what, when, and where, with filters by subscription, resource group, change type, and client for alerts.