This chapter covers Azure Monitor Workbooks, a powerful interactive reporting tool that combines data from multiple Azure Monitor sources into customizable, shareable dashboards. For the AZ-104 exam, understanding workbooks is part of Objective 5.1: Configure and manage monitoring, and typically appears in 5-10% of questions, often in scenario-based questions comparing workbooks to other monitoring tools like dashboards or views. You will need to know when to use workbooks, how to create and share them, and how they integrate with Log Analytics queries and Azure Resource Graph.
Jump to a section
Think of Azure Monitor Workbooks as a set of whiteboards in a command center, but these whiteboards are magical: they can pull live data from multiple sources and update in real-time. Each workbook is like a binder with multiple tabs (sections), and each tab contains a collection of charts, tables, and text boxes that you can arrange freely. Unlike static dashboards that only show pre-configured metrics, workbooks allow you to add interactive controls—like drop-down menus for time range or resource selection—that act as filters for the entire page. For example, you can have a drop-down that lets an operator choose a specific virtual machine, and all the charts on that page automatically update to show data for that VM. This is similar to having a whiteboard where you can erase and redraw graphs on the fly based on a single parameter. Workbooks also support rich Markdown text, so you can include instructions, annotations, or even live Kusto queries that run against Log Analytics workspaces. The underlying engine is Azure Resource Graph and Log Analytics, which execute queries in real-time when the workbook is viewed. Each query result can be visualized as a chart, grid, or even a map. Workbooks are Azure resources themselves, so they can be shared, version-controlled, and deployed via ARM templates. This makes them far more powerful than simple pin-to-dashboard charts, as they combine interactivity, multiple data sources, and custom layout into a single, portable artifact.
What Are Azure Monitor Workbooks?
Azure Monitor Workbooks provide a flexible canvas for analyzing data and creating rich visual reports within the Azure portal. They are part of Azure Monitor and allow you to combine text, parameter controls, and multiple types of visualizations (charts, grids, maps) from various data sources like Log Analytics workspaces, Azure Resource Graph, Application Insights, and Azure Metrics. Workbooks are designed for interactive data exploration, ad-hoc troubleshooting, and building reusable monitoring dashboards.
Why Workbooks Exist
Traditional Azure dashboards are static—they show a fixed set of charts that update periodically. Workbooks address the need for interactive, query-driven reporting. They allow users to:
Create parameters (e.g., time range, subscription, resource type) that control all visualizations on the page.
Combine data from multiple sources in a single view.
Use Kusto Query Language (KQL) to query Log Analytics data directly.
Share workbooks with other users in the same tenant.
Export to PDF or share via direct links.
How Workbooks Work Internally
When you open a workbook, the Azure portal renders a JSON-based definition that describes the structure: sections, controls, and queries. Each query is executed against its data source (e.g., Log Analytics) when the workbook is loaded or when a parameter changes. The results are then rendered using the specified visualization type (e.g., time chart, bar chart, table). Parameters are defined at the top of the workbook and can be of types: drop-down, text, time range, resource picker, etc. When a user changes a parameter, all dependent queries re-run automatically.
Key Components
Sections: Logical groupings of controls and visualizations. Each section can be collapsed/expanded.
Parameters: Interactive controls that allow users to filter data. Common parameters include:
- Time range (default: last 24 hours) - Subscription picker - Resource group picker - Text input (for custom filtering) - Visualizations:
- Charts: line, bar, area, scatter, time - Grids: tables with sorting and grouping - Maps: geo-spatial data - Text: Markdown for annotations - Data Sources:
- Log Analytics workspace (KQL queries) - Azure Resource Graph (for resource inventory) - Azure Monitor Metrics (pre-defined metrics) - Application Insights (for application monitoring) - Azure Data Explorer (for advanced analytics)
Defaults and Timers
Time Range Default: Last 24 hours (can be overridden by parameter)
Query Timeout: 30 seconds (queries exceeding this may fail)
Refresh Interval: Manual refresh by user; no auto-refresh by default (can be enabled via parameter)
Sharing: Workbooks are stored as Azure resources in a resource group. They can be shared via RBAC (Reader role required to view).
Configuration and Verification Commands
Workbooks are created and managed primarily through the Azure portal. However, you can use Azure CLI and PowerShell to deploy workbook ARM templates.
Azure CLI Example:
# Create a workbook from a template
az monitor workbook create --resource-group myResourceGroup \
--name myWorkbook \
--location eastus \
--serialized-data '{"version":"1.0","items":[{"type":1,"content":{"json":"Hello World"}}]}'PowerShell Example:
New-AzApplicationInsightsWorkbook -ResourceGroupName myResourceGroup `
-Name myWorkbook `
-Location eastus `
-SerializedData '{"version":"1.0","items":[{"type":1,"content":{"json":"Hello World"}}]}'Verification:
az monitor workbook show --resource-group myResourceGroup --name myWorkbookInteraction with Related Technologies
Log Analytics: Workbooks can query Log Analytics workspaces using KQL. This is the most common use case.
Azure Resource Graph: Workbooks can run Resource Graph queries to get resource inventory and configuration data.
Azure Monitor Metrics: Workbooks can pull metrics for time-series data.
Application Insights: Workbooks can query Application Insights for application performance data.
Azure Dashboards: Workbooks can be pinned to Azure dashboards as a tile, but they lose interactivity.
ARM Templates: Workbooks can be deployed as part of infrastructure-as-code using ARM templates, enabling version control and repeatability.
Important Exam Considerations
Workbooks are NOT the same as Azure Dashboard. Dashboards are static, workbooks are interactive.
Workbooks support parameters, dashboards do not.
Workbooks can be shared with users who have Reader access to the workbook resource.
Workbooks can be exported to PDF, but interactive features are lost.
Workbooks can be created from templates in the gallery (e.g., Azure Monitor > Workbooks > Gallery).
Each workbook is an Azure resource with its own RBAC.
The serialized data is a JSON representation of the workbook content.
Common Traps on the Exam
Trap: Confusing workbooks with dashboards. Remember: workbooks are interactive, dashboards are static.
Trap: Thinking workbooks auto-refresh. They do not by default; you need to implement a parameter or refresh manually.
Trap: Assuming workbooks can be shared publicly. They can only be shared within the same tenant via RBAC.
Trap: Believing workbooks can only use Log Analytics. They support multiple data sources.
Trap: Forgetting that workbooks are Azure resources and thus subject to resource locks and policies.
Identify Monitoring Requirements
Before creating a workbook, determine what data you need to visualize and who the audience is. For example, you might need a single pane of glass for VM performance across subscriptions. Identify the data sources: Log Analytics workspace for performance counters, Azure Resource Graph for inventory, and Metrics for CPU usage. Decide on interactivity: time range selector, subscription picker, or resource picker. This step ensures you design the workbook structure correctly.
Create a New Workbook
In the Azure portal, navigate to Azure Monitor > Workbooks, then click 'New'. This opens a blank workbook canvas. Alternatively, you can start from a template in the gallery. The workbook is created as a resource in the selected resource group. You'll see an empty section with an 'Add' button to add text, parameters, or queries. The workbook is saved as a JSON definition.
Add Parameters for Interactivity
Click 'Add' > 'Add Parameters'. Define a parameter, e.g., a time range picker (default: last 24 hours) or a resource picker. Parameters are defined using KQL or Resource Graph queries to populate drop-downs. For example, a subscription picker uses `ResourceContainers | where type == 'microsoft.resources/subscriptions' | project id, name`. Parameters appear at the top of the workbook and can be referenced in queries using `{parameterName}` syntax.
Add Queries and Visualizations
Click 'Add' > 'Add Query'. Select the data source (e.g., Log Analytics workspace) and write a KQL query. Use the parameter references like `{TimeRange}` and `{Subscription}`. For example: `Perf | where TimeGenerated {TimeRange} | where ObjectName == 'Processor' | project TimeGenerated, CounterValue`. Then choose a visualization type: Time Chart, Grid, or Map. You can add multiple queries in different sections.
Add Text and Markdown
To provide context, add text sections using Markdown. Click 'Add' > 'Add Text'. You can include headings, descriptions, links, and even images. This helps users understand the data. For example, add a title like 'VM Performance Overview' and instructions on how to use the filters. Markdown supports code blocks, tables, and lists.
Save and Share the Workbook
Click 'Save' to save the workbook. You'll need to provide a name, resource group, and location. Once saved, you can share it by granting Reader access to the workbook resource via RBAC. Users with Reader access can view the workbook but cannot edit it. You can also share a direct link to the workbook. The workbook can be pinned to an Azure dashboard, but interactivity is lost when pinned.
Enterprise Scenario 1: Multi-Subscription VM Performance Dashboard
A large enterprise manages hundreds of VMs across multiple subscriptions and regions. They need a single dashboard that allows the operations team to quickly identify VMs with high CPU usage. Using Azure Monitor Workbooks, they create a workbook with a subscription picker parameter and a time range selector. The main query uses KQL to join Perf data from a centralized Log Analytics workspace with Azure Resource Graph to get VM metadata (name, region, size). The visualization is a heatmap grid showing CPU usage by VM. The operations team can filter by subscription and time range interactively. The workbook is saved in a central resource group and shared with the team via RBAC. Misconfiguration: If the Log Analytics workspace is not in the same region as the workbook, there may be latency. Also, if the query is too complex, it may time out (30-second limit).
Enterprise Scenario 2: Application Performance Monitoring
A SaaS company uses Application Insights to monitor their web application. They want a workbook that shows end-to-end transaction details, including request rate, failure rate, and server response time. They create a workbook with a time range parameter and a text input for filtering by operation name. The workbook queries Application Insights using KQL (e.g., requests | where timestamp {TimeRange} | summarize count() by bin(timestamp, 1h)). They add multiple sections: one for overall trends, one for top failing operations, and one for server-side dependencies. The workbook is shared with the development team. Common issue: If the Application Insights resource is in a different subscription, the workbook must have appropriate permissions to query it. Also, if the workbook is saved in a resource group that gets deleted, the workbook is lost.
Scenario 3: Compliance and Inventory Reporting
A financial institution needs weekly reports on resource inventory and compliance status. They use Azure Policy and want a workbook that shows non-compliant resources. They create a workbook with a subscription picker and a resource group picker. The query uses Azure Resource Graph: policyResources | where type == 'microsoft.policyinsights/policystates' | .... The visualization is a table with color-coded compliance status. They export the workbook to PDF weekly for compliance meetings. Pitfall: Resource Graph queries have a limit of 1000 results per page; for large environments, they need to paginate or use aggregations. Also, the workbook's PDF export may not render all interactive elements.
What AZ-104 Tests on Workbooks (Objective 5.1)
The exam focuses on: - Differentiating between workbooks and dashboards: Workbooks are interactive and support parameters; dashboards are static. - Understanding data sources: Know that workbooks can use Log Analytics, Azure Resource Graph, Metrics, and Application Insights. - Sharing and permissions: Workbooks are Azure resources; share via RBAC (Reader role). - Creating parameters: How to define and use parameters in queries. - Deploying workbooks via ARM templates: The serialized data JSON structure.
Common Wrong Answers and Why
"Workbooks can be shared publicly via a link" – Wrong. Workbooks require Azure AD authentication and RBAC. They cannot be shared anonymously.
"Workbooks auto-refresh every 5 minutes" – Wrong. Workbooks do not auto-refresh by default; they refresh on user action or parameter change.
"Workbooks can only use Log Analytics data" – Wrong. They support multiple data sources including Resource Graph and Metrics.
"Workbooks are the same as Azure Dashboards" – Wrong. Dashboards are static; workbooks are interactive with parameters.
Specific Numbers and Terms
Query timeout: 30 seconds.
Default time range: Last 24 hours.
Parameter types: Time range, drop-down, text, resource picker.
RBAC role to view: Reader.
Serialized data: JSON format.
Gallery templates: Pre-built workbooks for common scenarios.
Edge Cases and Exceptions
If a workbook is saved in a resource group that is locked (ReadOnly lock), it cannot be edited.
If the data source (Log Analytics workspace) is deleted, the workbook queries will fail.
Workbooks can be pinned to dashboards, but interactivity is lost; they become static tiles.
Workbooks can be exported to PDF, but the export captures only the current state.
How to Eliminate Wrong Answers
If the question mentions "interactive filtering" or "parameters", the answer is likely workbooks, not dashboards.
If the question asks about "sharing with external users", it's not workbooks (they require Azure AD).
If the question mentions "auto-refresh", look for a different tool (like Metrics Explorer or dashboards with auto-refresh).
Workbooks are interactive, parameter-driven reports that combine data from Log Analytics, Resource Graph, Metrics, and Application Insights.
Workbooks are Azure resources and can be deployed via ARM templates using serialized JSON data.
Workbooks do not auto-refresh; they refresh on user interaction or parameter change.
To share a workbook, grant the Reader role on the workbook resource to users or groups.
The default time range for a workbook query is last 24 hours if not overridden by a parameter.
Workbooks can be pinned to Azure dashboards, but interactivity is lost when pinned.
Query timeout is 30 seconds; complex queries may fail if they exceed this limit.
These come up on the exam all the time. Here's how to tell them apart.
Azure Monitor Workbooks
Interactive with parameters (time range, resource picker, etc.)
Supports multiple data sources in one view (Log Analytics, Resource Graph, Metrics, App Insights)
Queries execute in real-time when parameters change
Can include rich Markdown text for annotations
Shared via RBAC on the workbook resource; Reader role needed
Azure Dashboards
Static; no interactive parameters
Each tile typically shows data from a single source
Tiles refresh on a fixed schedule (e.g., every 5 minutes) or manually
Limited text support; no Markdown
Shared via RBAC on the dashboard resource; can be published to a shared dashboard
Mistake
Workbooks are the same as Azure Dashboards.
Correct
Workbooks are interactive, support parameters, and can combine multiple data sources. Dashboards are static tiles pinned from various sources and do not support interactivity like parameter-driven filtering.
Mistake
Workbooks auto-refresh automatically.
Correct
Workbooks do not auto-refresh by default. They refresh when the user interacts with parameters or manually clicks the refresh button. You can add a timer parameter to simulate auto-refresh, but it's not native.
Mistake
Workbooks can only query Log Analytics workspaces.
Correct
Workbooks support multiple data sources: Log Analytics, Azure Resource Graph, Azure Monitor Metrics, Application Insights, and Azure Data Explorer.
Mistake
Workbooks can be shared with anyone via a public link.
Correct
Workbooks are Azure resources. They can only be shared with users who have been granted Azure RBAC Reader access on the workbook resource. Anonymous access is not supported.
Mistake
Workbooks are not Azure resources and cannot be managed via ARM templates.
Correct
Workbooks are Azure resources of type 'Microsoft.Insights/workbooks'. They can be deployed and managed using ARM templates, Azure CLI, and PowerShell. The workbook content is stored as serialized JSON in the resource.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Azure Workbooks are interactive, parameter-driven reports that allow you to filter data using drop-downs, time ranges, and other controls. They can combine multiple data sources (Log Analytics, Resource Graph, Metrics) in a single view. Azure Dashboards are static collections of tiles that show pre-configured data and update on a schedule. Workbooks are better for ad-hoc analysis and troubleshooting; dashboards are for at-a-glance monitoring.
Workbooks are Azure resources. To share, navigate to the workbook in the Azure portal, go to 'Access control (IAM)', and add users/groups with the Reader role. Users with Reader access can view the workbook but not edit it. You can also share a direct link to the workbook. Note that the workbook must be in a resource group that the users have at least Reader access to.
By default, workbooks do not auto-refresh. They refresh when you change a parameter, click the refresh button, or reload the page. To simulate auto-refresh, you can add a time range parameter set to a sliding window (e.g., 'Last 1 hour') and instruct users to refresh manually. There is no built-in timer for automatic refresh.
Workbooks support several data sources: Log Analytics workspaces (KQL queries), Azure Resource Graph (for resource inventory and configuration), Azure Monitor Metrics (pre-defined platform metrics), Application Insights (application telemetry), and Azure Data Explorer (for advanced analytics). You can also use parameters to make data source selection dynamic.
In the workbook editor, click 'Add' > 'Add Parameters'. Choose a parameter type (e.g., Time Range, Drop-down, Text). For a drop-down, you can provide a static list or a KQL/Resource Graph query to populate the options. Give the parameter a name (e.g., 'Subscription') and reference it in queries using `{Subscription}`. Parameters appear at the top of the workbook.
Yes, you can export a workbook to PDF by clicking the '...' menu (ellipsis) on the workbook toolbar and selecting 'Export to PDF'. The export captures the current state of the workbook, including all visualizations as they appear. Interactive elements like parameters are not functional in the PDF.
The default query timeout is 30 seconds. If a query takes longer than 30 seconds, it will fail. To avoid timeouts, optimize your KQL queries by using filters, aggregations, and limiting the result set. For large datasets, consider using time range parameters to narrow the data.
You've just covered Azure Monitor Workbooks — now see how well it sticks with free AZ-104 practice questions. Full explanations included, no account needed.
Done with this chapter?