Azure Monitor

Overview

Azure Monitor is Microsoft's built-in observability service, bringing metrics, logs, traces and events from Azure resources, virtual machines, Kubernetes, applications and now AI agents into one place.

The thing to understand first is that it has two workspace types with two query languages, which Microsoft itself flags as confusing. Log Analytics workspaces hold logs and traces, queried with KQL; Azure Monitor workspaces hold Prometheus and OpenTelemetry metrics, queried with PromQL.

Application Insights is its application monitoring feature, and Microsoft now describes it as an OpenTelemetry feature of Azure Monitor, making vendor-neutral instrumentation the documented path.

Managed Prometheus is a genuine strength: a fully managed service with an availability commitment, automatic upgrades, full PromQL, and eighteen months of retention at no storage cost.

Retention deserves attention because it drives the bill. Thirty-one days are included in the ingestion price, so cutting below that saves nothing, and three table plans trade query cost against storage cost quite differently.

Those plans matter: analytics for interactive work, basic for cheaper ingestion with a fixed window, and auxiliary at a tenth the price but billed on uncompressed size with queries charged per gigabyte scanned.

Hybrid and multicloud work through Azure Arc plus a collection pipeline designed for large volumes and intermittent connectivity, so it is not strictly Azure-only, though that is where it needs no work at all.

It also does something none of the others do: autoscale is part of the service, adding and removing resources based on metrics or a schedule rather than only telling you about them.

The current direction is agentic, with an observability agent that answers questions in natural language, correlates related alerts into issues, and can investigate autonomously while stating that humans stay in control.

Key features and capabilities

The same headings are used for every pipeline & infrastructure monitoring entry, so two tools can be read side by side.

What it collects

• Metrics, covering platform, Prometheus, OpenTelemetry and custom metrics
• Logs, covering resource logs, activity logs, identity audit logs and custom logs
• Traces through Application Insights, stored in a Log Analytics workspace
• Events, changes and availability results from ping and multi-step web tests
• AI agent telemetry including token consumption, latency, error rates and quality scores

How data gets in

• Diagnostic settings route logs and metrics from any Azure resource with no agent at all
• The Azure Monitor Agent on machines, driven by data collection rules defining what goes where
• OpenTelemetry and Application Insights SDKs for applications, plus an ingestion API for custom data
• Prometheus scraping on Kubernetes, and remote write from a self-managed Prometheus
• A collection pipeline for edge and other-cloud sources, with Azure Arc bringing them in scope

Storage and retention

• Hosted only, with no self-managed option
• Retention defaults to thirty days, configurable from four days to two years, with total retention to twelve years
• Thirty-one days of analytics retention is included in the ingestion price, so cutting below it saves nothing
• Three table plans, analytics, basic and cheaper auxiliary, mixable in one workspace
• Managed Prometheus retains eighteen months at no storage cost; cardinality limits are not published

Querying and dashboards

• Two query languages split by workspace type, KQL for logs and traces, PromQL for metrics
• Log Analytics for ad-hoc analysis, and a metrics explorer supporting PromQL
• Workbooks, prebuilt and custom Grafana dashboards, and portal dashboards
• A Prometheus query API exposing PromQL over REST
• An observability agent for natural-language exploration, plus search jobs and restore for cold data

Alerting and incident response

• Metric, log and activity log alert rules, priced by evaluation frequency
• Dynamic thresholds that adapt to a metric's pattern, and smart detection for application anomalies
• Issues correlate related alerts likely to be one incident, with automated investigation
• Action groups route to email, SMS, voice, push, webhooks and IT service management connectors
• Prometheus recording and alert rules, with a predefined set auto-deployed for Kubernetes

Ecosystem and standards

• Managed Prometheus with PromQL, remote write ingestion and community recording rules
• OpenTelemetry as the documented instrumentation path, with Application Insights described as an OTel feature
• Native Grafana integration, in-portal dashboards at no cost, and a managed Grafana service
• Curated per-service insights for containers, virtual machines and networking
• Shares its platform with Defender for Cloud and Sentinel; no Datadog relationship is published

Where it runs and what it costs

• Managed cloud only, with no self-hosted edition
• Prices are set regionally, so every figure needs checking for your own region
• Kubernetes through AKS and Arc-enabled clusters, onboarded by portal, CLI or infrastructure as code
• Dedicated clusters group workspaces and enable customer-managed keys, at a 100 GB a day minimum
• Autoscale is part of the service, adding and removing resources rather than only reporting on them

Pricing

Usage-based$2.30 a GB ingested

In US East, analytics log ingestion is $2.30 a gigabyte with retention at $0.10 a gigabyte a month, against $0.50 for basic and $0.05 for auxiliary ingestion. Metrics cost $0.16 per ten million samples. Commitment tiers start at 100 GB a day for $196 and save up to 30%, though only on analytics logs. Alerts run $0.05 to $3.00 a month depending on type and frequency. Several tables including activity and usage are free, and managed Prometheus retains eighteen months at no storage cost. No product trial is published.

Vendor pricing page →

Demos and videos

• Get started with Azure Monitor Log Analytics Tutorial · YouTube
• Microsoft Azure channel Channel or playlist · YouTube

About Microsoft

Azure Monitor is a first-party Microsoft service rather than a separate company, so founding details and funding do not apply; it is proprietary under Azure's commercial terms with no open-source or self-hosted edition. Governance is closed and Microsoft-internal, the sharpest contrast in this category with Prometheus and OpenTelemetry, though its documentation is developed publicly on GitHub with commit history and modification dates on each page. The same data platform also backs Microsoft Defender for Cloud and Microsoft Sentinel, sharing query languages and analysis tools. No product-specific customer or revenue figures are published.

azure.microsoft.com