Configuring Reusable Notification Targets with Action Groups
A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?
Quick Answer
The answer is an action group. This is the correct first configuration because in Azure Monitor, action groups serve as the reusable container for notification targets like email and SMS, allowing you to define them once and then reference them across multiple alert rules. By decoupling the notification method from the alert logic, Azure ensures that when you create a metric alert rule for the CPU threshold, you simply attach the pre-configured action group, meeting the requirement for reusability. On the AZ-104 exam, this concept tests your understanding of Azure Monitor’s architecture, where a common trap is to mistakenly configure the alert rule first or try to set notifications directly within the rule—both of which break reusability. Remember the memory tip: “Action groups are the reusable address book; alerts just send the mail.”
⚠ Common exam trap
Many candidates think a metric alert rule inherently includes notification settings, but Azure separates the condition (alert rule) from the notification method (action group) to enforce reusability and centralized management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An action group
An action group (B) is the correct first configuration because it defines the notification targets (email, SMS) that can be reused across multiple alert rules. In Azure Monitor, alert rules are decoupled from notification actions; you create an action group once and then reference it in any metric alert rule, including the CPU percentage threshold rule needed here. This ensures the administrator can meet the requirement for reusable notification targets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A metric alert rule only
Why it's wrong here
A metric alert can detect the CPU condition, but it does not by itself define reusable notification recipients.
When this WOULD be correct
If the question asked for the first step to monitor CPU usage without requiring reusable notifications, or if the alert rule itself could directly define email/SMS without needing a separate action group (which is not the case in Azure), then a metric alert rule alone would suffice.
- ✓
An action group
Why this is correct
An action group stores the notification targets, such as email and SMS recipients, so multiple alerts can reuse the same response action.
- ✗
A service health alert
Why it's wrong here
Service health alerts report Azure platform issues, not a virtual machine's CPU usage.
When this WOULD be correct
A service health alert would be correct if the question asked to notify administrators when Azure experiences a service incident affecting their subscription, such as a regional outage or planned maintenance for a specific service like Virtual Machines.
- ✗
A diagnostic setting
Why it's wrong here
Diagnostic settings send logs and metrics to destinations, but they do not define alert recipients.
When this WOULD be correct
If the question asked for collecting CPU metrics into Log Analytics for historical analysis or custom log queries, then configuring a diagnostic setting would be the first step.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓An action groupCorrect answer▾
Why this is correct
An action group stores the notification targets, such as email and SMS recipients, so multiple alerts can reuse the same response action.
✗A metric alert rule onlyWrong answer — click to see why▾
Why this is wrong here
A metric alert rule defines the condition (CPU > 80%) but does not include notification targets. The question requires reusable notification targets, which are configured separately as an action group.
★ When this WOULD be the correct answer
If the question asked for the first step to monitor CPU usage without requiring reusable notifications, or if the alert rule itself could directly define email/SMS without needing a separate action group (which is not the case in Azure), then a metric alert rule alone would suffice.
Why candidates choose this
Candidates may think the alert rule includes notification settings, or they focus on the monitoring condition first and overlook the requirement for reusable notification targets.
✗A service health alertWrong answer — click to see why▾
Why this is wrong here
A service health alert monitors Azure service outages and planned maintenance, not VM CPU performance. The question requires alerting on a specific VM metric (CPU percentage), which is not covered by service health alerts.
★ When this WOULD be the correct answer
A service health alert would be correct if the question asked to notify administrators when Azure experiences a service incident affecting their subscription, such as a regional outage or planned maintenance for a specific service like Virtual Machines.
Why candidates choose this
Candidates may confuse 'service health' with 'health of the VM service' or think that any alert related to Azure services should use service health alerts, not realizing it's for Azure platform health, not resource metrics.
✗A diagnostic settingWrong answer — click to see why▾
Why this is wrong here
A diagnostic setting is used to stream platform logs and metrics to destinations like Log Analytics, Storage, or Event Hubs, not to trigger alerts via email or SMS. It does not define notification actions.
★ When this WOULD be the correct answer
If the question asked for collecting CPU metrics into Log Analytics for historical analysis or custom log queries, then configuring a diagnostic setting would be the first step.
Why candidates choose this
Candidates may confuse diagnostic settings with alert rules, thinking they are required to enable metric collection before alerting, but Azure Monitor automatically collects metrics for alerting without diagnostic settings.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.
easy- ✓ A.A metric alert rule on the VM CPU metric
- ✓ B.An action group with an email receiver
- C.A Recovery Services vault
- D.A private endpoint for the virtual machine
- E.A blob lifecycle management policy
Why A: A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.