Microsoft AZ-104: Azure Monitor, Backup and Site Recovery — Study Guide

By Laurynas Brazys · 6 August 2026 · #microsoft #az-104 #certification #exam-prep #study-guide

Part of the Microsoft Azure Administrator Associate AZ-104 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Operational excellence on Azure requires three pillars working together: observable telemetry, recoverable data, and resilient continuity plans. Azure Monitor and its Log Analytics foundation collect high-fidelity metrics and logs, drive intelligent alerts, and surface application performance. Azure Backup protects platform and IaaS data with policy-driven, vault-based recovery, including instant-restore capabilities for minimal downtime. Azure Site Recovery (ASR) replicates workloads to alternate sites and orchestrates failover and failback to meet business RPO/RTO. Complementary services—Network Watcher for network diagnostics and Azure Service Health for platform awareness—round out a complete administrator toolkit.

Azure Monitor and Log Analytics

Azure Monitor unifies platform metrics and logs. Metrics are numeric time series optimized for near real-time analysis (high cardinality, multi-dimensional, one-minute granularity for most resources). Use Metrics Explorer for visualization and near-real-time metric alerts with static or dynamic thresholds. Logs are schema-rich records stored in a Log Analytics workspace, queried with Kusto Query Language (KQL) for investigation, dashboards, and scheduled (log) alerts.

Diagnostic settings are the bridge from resources to telemetry sinks. On each Azure resource, configure diagnostic settings to choose categories (platform metrics, platform logs, and resource logs) and route them to one or more destinations:

Log Analytics workspace for analytics and log-based alerting
Storage accounts for long-term, low-cost retention and compliance
Event Hubs for streaming to SIEMs or third-party tools

Design Log Analytics workspaces deliberately:

Workspace scope and access: Use RBAC at the workspace and table level to align with least privilege and operational boundaries (for example, per environment and region). Resource-context queries allow teams to query logs scoped to resources they have access to, even if logs are centralized.
Data collection: Prefer the Azure Monitor agent (AMA) with Data Collection Rules (DCRs) over legacy agents. DCRs define what to collect (performance counters, Windows/Linux event logs, syslog, custom text logs), from which machines, and into which tables, enabling granular, per-scope pipelines.
Cost and retention: Control cost with per-table retention, archive, and basic logs where appropriate. Use sampling and filtering at collection time when possible.
Data sources: Azure Activity Log, resource logs via diagnostic settings, VM insights and Container insights, Azure AD sign-in and audit logs (via diagnostic settings), Azure Firewall/NSG flow logs, custom application logs, and on-prem via Azure Monitor agent.

KQL mastery is essential. Examples:

Quick audit: AzureActivity | where OperationName startswith “Create” and ActivityStatus == “Succeeded” | summarize count() by Caller
Performance triage: Perf | where ObjectName == “LogicalDisk” and CounterName == “% Free Space” | summarize min(CounterValue) by Computer, InstanceName
Error rate: AppTraces | where SeverityLevel >= 3 | summarize Errors=count() by bin(TimeGenerated, 5m)

Action groups define who and what responds to alerts: email/SMS/push/voice, secure webhooks, ITSM connectors, Functions, Logic Apps, and Automation runbooks. Reuse action groups across alert rules and enforce consistent incident routing.

Azure Monitor supports multiple alert types:

Metric alerts: Evaluate platform or custom metrics at near real-time cadence with static thresholds or dynamic thresholds that learn normal baselines.
Log (scheduled query) alerts: Run KQL on workspace data at configured frequency; trigger on result count or numeric aggregate. Useful for complex patterns across resources.
Activity log alerts: Trigger on control-plane events (for example, when a VM is deleted or a role assignment changes). These do not require a workspace.
Smart detection: Anomaly detection and failure rate spikes primarily for Application Insights resources; automatically notifies owners and can integrate with action groups.

Application Insights and Alerting

Application Insights instruments code and platform to provide end-to-end application telemetry. Use connection strings and first-class SDKs (.NET, Java, Node.js, Python) or OpenTelemetry for vendor-neutral tracing. For PaaS services (App Service, Functions, AKS), enable auto-instrumentation where available to capture requests, dependencies, exceptions, and traces without code changes. Maintain distributed tracing context to correlate client, API, and backend hops.

Key telemetry types:

Requests: Incoming operations with response codes and duration
Dependencies: Outbound calls (HTTP, SQL, queues) with duration and success
Exceptions and Traces: Errors and diagnostic logs with severity
Metrics: Custom or standard counters
Page views and browser timings: Front-end performance
Custom events and measurements: Domain-specific signals

Apply adaptive sampling to control ingestion volume without losing signal fidelity, and use Live Metrics Stream for low-latency insight during incidents.

Availability tests validate external reachability and SLA:

Standard (URL ping) tests: Probe endpoints from multiple Azure regions, validate status codes, SSL expiration windows, content match, and response-time thresholds.
Custom tests: Use TrackAvailability in code for synthetic workflows or protected endpoints. Failures can automatically produce alerts wired to action groups.

Augment alerting with smart detection in Application Insights for:

Failure anomalies and performance degradation
Memory leaks and dependency anomalies These features learn typical patterns and reduce false positives, complementing threshold-based alerts.

Azure Backup

A Recovery Services vault anchors backup management, policy, and recovery. Place vaults in the same region as protected resources (or in the paired region for cross-region restore scenarios supported by the service). Harden vaults with soft delete, purge protection, and multi-user authorization for critical operations.

Backup policies define schedules and retention:

Azure VM backup: Daily snapshots with short-term retention, optional weekly/monthly/yearly long-term retention; app-consistent recovery points via VSS (Windows) or pre/post scripts (Linux) when enabled.
Azure Files backup: Daily backups backed by share snapshots; retention per business needs; supports restore to original or alternate share with item-level recovery.
SQL Server in Azure VMs: Full (daily/weekly), differential (daily), and log backups (as low as every 15 minutes) enable point-in-time restore. Auto-protect discovers new databases.

Instant Restore accelerates VM recoveries by using locally stored snapshots retained for a short window before deep storage in the vault. Administrators can:

Restore an entire VM (new compute) to minimize time-to-recover
Restore disks and reattach to an existing VM for targeted repair
Perform file and folder recovery by mounting a recovery point as a temporary iSCSI device to any VM in the subscription (role-permitted), enabling surgical restores after events like ransomware

VM backup considerations include disk exclusion for non-critical data, encryption handling (Azure Backup supports encrypted disks), and consistency models (crash-consistent vs app-consistent). Azure Files backup leverages storage snapshots, benefiting from incremental, space-efficient retention and soft delete protection. SQL in Azure VMs backup uses a workload-aware extension coordinated by the vault to produce compliant, restorable chains across Always On availability groups and standalone instances.

Azure Site Recovery, Network Watcher, and Service Health

ASR provides workload replication and orchestrated recovery:

Replication sources: On-premises VMware/Hyper-V/physical to Azure; Azure region-to-region. The Mobility service on protected machines captures changes and replicates them to cache/target storage. Enable multi-disk consistency for tiered apps sharing write order.
Target configuration: Pre-create or map resource groups, VNets/subnets, availability options (zones/sets), managed disk types, and naming conventions. Use network mapping and DNS updates to ensure reachability after failover.
Failover options: Test failover (isolated validation with no production impact), Planned failover (zero data loss with source shutdown), and Unplanned failover (best-effort during outages). After failover, Reprotect to reverse replication; Failback when the primary is ready via process servers or direct replication, depending on source.
Recovery plans: Orchestrate multi-VM tiers with groups, manual approval steps, and Azure Automation runbooks or scripts (for app warm-up, load balancer reconfiguration, and DNS changes). Embed sequencing and timeouts to achieve predictable RTO.

RPO/RTO targets guide policy:

RPO (acceptable data loss) is driven by change rate, network throughput, and replication frequency. Set RPO thresholds to raise health alerts when exceeded.
RTO (time to service restoration) depends on boot time, orchestration steps, DNS/connection updates, and data plane operations (disk attach). Tune recovery plans, pre-provision capacity, and use test failovers to validate that targets are met.
Replication policy defines app-consistent snapshot cadence and recovery point retention windows to balance storage cost, recovery flexibility, and performance.

Azure Network Watcher equips administrators with precise network diagnostics:

IP flow verify: Validates whether a flow is allowed or denied by effective NSG rules on a NIC, identifying the specific rule that influences the decision.
Next hop: Computes the routing decision for a given destination (Internet, Virtual network, Virtual appliance), revealing effective user-defined routes and system routes.
Connection troubleshoot: Executes end-to-end probes between source and destination across VNets and hybrid links, reporting reachability, latency, and the hop where failure occurs.
Packet capture: Captures packets on a VM NIC with filters (protocol/port/IP), stored to a storage account or locally, useful for deep inspection of intermittent issues. Requires the Network Watcher extension on the VM.

Azure Service Health complements monitoring with platform awareness:

Service issues: Real-time outage and degradation events impacting selected services and regions, with root cause and mitigation updates.
Planned maintenance: Notifications for upcoming platform maintenance windows that may affect workloads, with schedules and required actions.
Health advisories: Best-practice and security advisories that may require configuration changes. Create Service Health alerts scoped to services/regions/subscriptions and route them via action groups so operations teams are informed ahead of impact. Use Resource Health for per-resource availability state (Available, Degraded, Unavailable, Unknown) to distinguish platform issues from workload problems.

Practical Problem Scenario

Adobe must harden and operationalize a new two-region e-commerce platform on Azure, meeting strict observability, backup, and disaster recovery objectives while ensuring fast network troubleshooting and platform awareness.

Deploy a central Log Analytics workspace per region and attach Data Collection Rules to all VMs and AKS nodes to collect performance, syslog/EventLog, and resource-specific logs via diagnostic settings. Why: Regional workspaces preserve data residency and performance; AMA+DCR provides granular, scalable collection and cost control.
Configure diagnostic settings on App Service, Key Vault, Azure Firewall, Application Gateway, and Storage to route logs and metrics to the regional workspace and to a storage account for long-term retention. Why: Centralized analytics enables cross-resource correlation; storage retention satisfies compliance and forensic needs.
Instrument the web and API tiers with Application Insights using OpenTelemetry and enable auto-instrumentation on App Service. Create availability tests from at least five Azure regions with content match and TLS expiry checks. Why: Deep distributed tracing and synthetic testing detect user-impacting regressions before customers do.
Create Azure Monitor alerts:

Dynamic metric alerts for CPU, memory, HTTP 5xx rates, and App Gateway backend health
Scheduled query alerts for anomalous firewall denies and failed logins using KQL
Activity log alerts for delete/role-assignment events on critical resources
Wire all alerts to shared action groups (email/SMS for on-call, webhook to ITSM, Logic App to open incidents) Why: Multi-signal alerting reduces mean time to detect with actionable routing to people and systems.

Protect data with Azure Backup:

Enable VM backup with policies aligning to nightly backups and long-term retention; enable app-consistent snapshots where applicable
Protect Azure Files shares hosting media assets with daily backups and soft delete
Protect SQL Server in Azure VMs with full/diff/log schedules to support point-in-time restore
Validate Instant Restore by performing a file-level restore in staging Why: Vault-based backups and instant restores minimize downtime and data loss across IaaS and file workloads.

Implement Azure Site Recovery for region-to-region DR of the web, API, and SQL tiers with a replication policy targeting low RPO and hourly app-consistent points. Build a recovery plan with tiers (data first, then API, then web), automation to update DNS and purge CDN caches, and test failover on an isolated VNet quarterly. Why: ASR replication and recovery plans provide predictable RTO with orchestrated, auditable runbooks and non-disruptive testing.
Enable Network Watcher and use Connection troubleshoot to validate frontend-to-backend flows, Next hop to verify UDRs through the NVA tier, and IP flow verify to confirm NSG hardening. Configure on-demand packet capture on the API VMs for intermittent timeout analysis. Why: Purpose-built diagnostics rapidly isolate routing/NSG issues and provide packet-level evidence when needed.
Create Azure Service Health alerts for the two regions and services in scope (App Service, SQL, Storage, Key Vault, Front Door). Route to the same action groups and include leadership distribution lists for planned maintenance advisories. Why: Proactive awareness of platform incidents and maintenance prevents surprise outages and allows coordinated communication.

This integrated approach ensures Adobe meets its RPO/RTO targets, restores quickly from ransomware or operator error, detects and remediates anomalies in minutes, and can conclusively troubleshoot network paths while staying informed of Azure platform events.

← Azure Databases and Data Services · All domains · Azure Security and Compliance →

Practice these questions → · Timed practice on ExamRoll.io →