How to Suppress Alert Notifications Outside Business Hours Using Alert Processing Rules
A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?
Quick Answer
The correct answer is to create an alert processing rule that suppresses notifications outside business hours. This works because alert processing rules, formerly known as action rules, allow you to apply a suppression action on a schedule without modifying the underlying metric alert rule itself—the alert continues evaluating 24/7, but email notifications are blocked during defined off-hours like evenings and weekends. On the AZ-104 exam, this scenario tests your understanding of how to decouple alert evaluation from notification delivery, a common trap being that candidates mistakenly try to disable the alert or adjust its condition, which would stop monitoring entirely. Remember, the alert must keep firing; only the action group’s notification should be silenced. A useful memory tip is “suppress the action, not the alert”—think of it as muting the ringer on a phone that still receives calls.
⚠ Common exam trap
Watch out — candidates often confuse alert processing rules (which modify actions after an alert fires) with alert rules themselves, or incorrectly assume that changing thresholds or using diagnostic settings can control notification timing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an alert processing rule that suppresses notifications outside business hours.
An alert processing rule (formerly action rule) can suppress notifications for a metric alert based on a schedule. By creating a rule with a suppression action that applies outside business hours (e.g., 18:00 to 08:00 and weekends), the alert continues to evaluate and fire, but email notifications are blocked during those times. This meets the requirement without altering the alert rule itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the metric alert with a diagnostic setting and store the data in Log Analytics.
Why it's wrong here
Diagnostic settings collect data; they do not suppress notifications during a time window.
When this WOULD be correct
If the question required storing VM performance data for long-term analysis and querying, and the alert was not needed, replacing the metric alert with a diagnostic setting sending data to Log Analytics would be correct.
- ✓
Create an alert processing rule that suppresses notifications outside business hours.
Why this is correct
An alert processing rule lets you control how alerts are handled without disabling the alert condition itself. That means the metric alert can keep evaluating continuously for history and state changes, while notifications are suppressed outside the approved business hours. This cleanly separates detection from delivery, which is exactly what the requirement describes.
- ✗
Lower the alert threshold so fewer alerts occur during the week.
Why it's wrong here
Changing thresholds alters detection logic, not the notification schedule, and can hide legitimate issues.
When this WOULD be correct
An administrator wants to reduce alert fatigue by ensuring only significant performance issues trigger alerts, and the current threshold causes too many false positives during normal operations.
- ✗
Use an autoscale profile instead of an alert rule.
Why it's wrong here
Autoscale can respond to demand, but it does not provide a business-hours notification filter for an existing alert.
When this WOULD be correct
An administrator needs to automatically scale out a VM scale set during business hours (08:00-18:00 weekdays) and scale in during off-hours to reduce costs. An autoscale profile with a recurring schedule would be the correct solution.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create an alert processing rule that suppresses notifications outside business hours.Correct answer▾
Why this is correct
An alert processing rule lets you control how alerts are handled without disabling the alert condition itself. That means the metric alert can keep evaluating continuously for history and state changes, while notifications are suppressed outside the approved business hours. This cleanly separates detection from delivery, which is exactly what the requirement describes.
✗Replace the metric alert with a diagnostic setting and store the data in Log Analytics.Wrong answer — click to see why▾
Why this is wrong here
A diagnostic setting sends metrics to Log Analytics but does not suppress notifications; the alert would still fire 24/7, and email notifications would continue outside business hours.
★ When this WOULD be the correct answer
If the question required storing VM performance data for long-term analysis and querying, and the alert was not needed, replacing the metric alert with a diagnostic setting sending data to Log Analytics would be correct.
Why candidates choose this
Candidates may confuse diagnostic settings with alert processing rules, thinking that routing data to Log Analytics somehow controls notification timing.
✗Lower the alert threshold so fewer alerts occur during the week.Wrong answer — click to see why▾
Why this is wrong here
Lowering the alert threshold reduces the number of alerts but does not restrict notifications to business hours; the alert would still fire and notify outside those hours if the threshold is crossed.
★ When this WOULD be the correct answer
An administrator wants to reduce alert fatigue by ensuring only significant performance issues trigger alerts, and the current threshold causes too many false positives during normal operations.
Why candidates choose this
Candidates may think that reducing alert frequency by lowering the threshold will automatically reduce notifications, but they overlook that the requirement is about notification timing, not alert frequency.
✗Use an autoscale profile instead of an alert rule.Wrong answer — click to see why▾
Why this is wrong here
Autoscale profiles adjust VM capacity based on load, not send email notifications or suppress them. The requirement is to control notification timing, not scaling behavior.
★ When this WOULD be the correct answer
An administrator needs to automatically scale out a VM scale set during business hours (08:00-18:00 weekdays) and scale in during off-hours to reduce costs. An autoscale profile with a recurring schedule would be the correct solution.
Why candidates choose this
Candidates may confuse autoscale scheduling with notification scheduling, thinking a time-based profile can also control alert notifications.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Alerts and Action Groups
Key term
Alert rule
An alert rule is a set of conditions and actions that trigger a notification when a monitored metric or log reaches a predefined threshold.
Key term
Metric
A metric is a quantifiable measurement used to assess the performance, health, or status of IT systems, networks, or applications.
About these practice questions
One of 1,049 original AZ-104 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-104
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?
hard- A.A log query alert only, with the query scheduled to run during business hours
- ✓ B.A metric alert rule with an action group and an alert processing rule that suppresses actions outside business hours
- C.A diagnostic setting that sends CPU logs to a storage account and a Logic App for email delivery
- D.An action group with an email receiver and a virtual machine extension to pause the workload outside business hours
Why B: It combines a metric alert rule (which continuously evaluates the CPU threshold) with an alert processing rule that suppresses notifications outside business hours. The metric alert rule evaluates every minute by default, meeting the 'continuously evaluated' requirement, while the alert processing rule (formerly action rule) allows you to suppress actions based on a schedule without altering the alert rule itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.