Azure Monitor Metric Alert for CPU >80% on Multiple VMs
The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?
Quick Answer
The correct answer is to create an Azure Monitor metric alert rule at the resource-group scope and attach an action group. This works because a metric alert at the resource-group level can monitor the 'Percentage CPU' metric across all VMs in that group simultaneously, using a fixed aggregation window of 10 minutes to evaluate when the average CPU exceeds 80%. The attached action group then handles the email and SMS notifications to the on-call team, fulfilling every requirement with a single, efficient rule. On the AZ-104 exam, this scenario tests your understanding of scoping alerts to resource groups rather than individual VMs, which is a common trap—many candidates mistakenly create separate alerts per VM, wasting time and resources. The key memory tip is "scope saves time": always check if the alert condition applies to all resources in a group, and if so, set the scope at the resource-group level to avoid redundant configurations.
⚠ Common exam trap
Many candidates think a metric alert must be created per individual VM, but Azure Monitor supports resource-group scoped metric alerts that apply to all resources of the same type within that scope, simplifying management while still meeting the requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.
Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a Log Analytics query alert on the Activity log and manually notify the on-call team.
Why it's wrong here
Log Analytics query alerts are useful for custom log patterns, but CPU percentage is a native metric and the Activity log does not track VM performance.
When this WOULD be correct
A Log Analytics query alert on the Activity log would be correct if the question asked to alert on administrative operations, such as when a VM is created, deleted, or restarted, and the alert should trigger based on specific log entries.
- ✓
Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.
Why this is correct
A metric alert is the right tool for CPU thresholds, and an action group provides the email and SMS notifications. Scoping the alert to the resource group ensures all current VMs are covered without configuring each VM separately.
- ✗
Export VM diagnostics to a storage account and have operators review the files after each incident.
Why it's wrong here
Storage exports help with troubleshooting after the fact, but they do not create an automated alert or notification path for a threshold breach.
When this WOULD be correct
An organization needs to retain detailed performance logs for long-term compliance or forensic analysis, and the requirement is to periodically analyze historical data rather than receive real-time alerts. For example, a question might ask for a solution to archive CPU metrics for 5 years with minimal cost.
- ✗
Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.
Why it's wrong here
Locks prevent changes and Azure Policy enforces compliance; neither one is designed to detect runtime CPU conditions or send incident alerts.
When this WOULD be correct
An administrator needs to prevent accidental deletion of critical VMs and ensure that only authorized changes are made. In this scenario, a resource lock (e.g., CanNotDelete) would be correct, and Azure Policy could be used to audit or enforce tagging, not to notify about CPU spikes.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.Correct answer▾
Why this is correct
A metric alert is the right tool for CPU thresholds, and an action group provides the email and SMS notifications. Scoping the alert to the resource group ensures all current VMs are covered without configuring each VM separately.
✗Create a Log Analytics query alert on the Activity log and manually notify the on-call team.Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the question requires a metric-based alert on CPU percentage, which is a platform metric, not an Activity log event. Log Analytics query alerts on the Activity log cannot monitor performance metrics like CPU usage.
★ When this WOULD be the correct answer
A Log Analytics query alert on the Activity log would be correct if the question asked to alert on administrative operations, such as when a VM is created, deleted, or restarted, and the alert should trigger based on specific log entries.
Why candidates choose this
Candidates may confuse Activity log alerts with metric alerts, or think that Log Analytics can handle all monitoring scenarios, including performance metrics, due to its broad query capabilities.
✗Export VM diagnostics to a storage account and have operators review the files after each incident.Wrong answer — click to see why▾
Why this is wrong here
Exporting VM diagnostics to a storage account and having operators review files after incidents does not provide real-time alerting or automated notifications; it requires manual review and cannot trigger immediate email/SMS alerts.
★ When this WOULD be the correct answer
An organization needs to retain detailed performance logs for long-term compliance or forensic analysis, and the requirement is to periodically analyze historical data rather than receive real-time alerts. For example, a question might ask for a solution to archive CPU metrics for 5 years with minimal cost.
Why candidates choose this
Candidates may think that exporting diagnostics to storage is a standard monitoring practice and assume operators can manually check the files, overlooking the need for automated, real-time alerting specified in the question.
✗Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.Wrong answer — click to see why▾
Why this is wrong here
Resource locks prevent accidental deletion or modification of resources but do not monitor CPU usage or trigger alerts. Azure Policy enforces compliance rules but cannot send notifications about performance metrics like CPU spikes.
★ When this WOULD be the correct answer
An administrator needs to prevent accidental deletion of critical VMs and ensure that only authorized changes are made. In this scenario, a resource lock (e.g., CanNotDelete) would be correct, and Azure Policy could be used to audit or enforce tagging, not to notify about CPU spikes.
Why candidates choose this
Candidates may confuse resource locks and Azure Policy with monitoring and alerting capabilities, thinking they can be used to enforce or notify about performance conditions, when they are actually governance and protection tools.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?
easy- A.A diagnostic setting on the VM
- ✓ B.A metric alert rule linked to an action group
- C.A Log Analytics workspace only
- D.An Azure Policy assignment
Why B: A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.
Variation 2. An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?
hard- A.Create a diagnostic setting on the scale set and build a log query alert for CPU samples.
- ✓ B.Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.
- C.Configure an autoscale rule and rely on its notification settings for alerting.
- D.Install a monitoring extension that writes CPU readings to storage for later review.
Why B: Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.