Microsoft AZ-900: Monitoring, Automation & Management — Study Guide

By Laurynas Brazys · 22 July 2026 · #microsoft #az-900 #certification #exam-prep #study-guide

Part of the Microsoft Azure AZ-900 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Operational excellence in Azure depends on observable platforms, repeatable automation, and unified governance across cloud and hybrid estates. Azure Monitor provides the telemetry backbone for metrics, logs, traces, and end-to-end application insights. Management tools—ranging from the Azure portal to CLI and PowerShell—enable teams to act on those insights at scale. Automation services, together with Azure Arc and Azure Lighthouse, extend control to servers and clusters anywhere and streamline cross-tenant operations for service providers and central IT.

Azure Monitor: metrics, logs, alerts, and application insights

Azure Monitor collects two primary signal types: metrics and logs. Metrics are lightweight numerical time series optimized for near real-time scenarios such as dashboards and autoscale, typically retained for 93 days. Logs are rich, schema-flexible records stored in Log Analytics workspaces and queried with Kusto Query Language (KQL). With the Azure Monitor agent and Data Collection Rules (DCRs), data from VMs, Arc-enabled servers, and platform diagnostics can be routed to one or more workspaces across regions for centralized analysis and long-term retention. Retention for standard logs is configurable—commonly 30 to 730 days—with low-cost archive and rehydration available for historical investigations. Application Insights, built on Azure Monitor, instruments applications for distributed tracing, dependency tracking, availability tests, and automatic anomaly detection. It supports OpenTelemetry for vendor-neutral ingestion, letting developers correlate client, server, and database calls into a single transaction map. Live Metrics provide second-by-second server telemetry without sampling, while adaptive sampling reduces ingestion cost without losing end-to-end traceability for critical failures. Alerting spans resource, subscription, and tenant scopes. Metric alerts evaluate time-series thresholds with one-minute granularity and can auto-tune via dynamic thresholds. Log alerts run scheduled KQL queries to detect complex patterns across resources and regions, while activity log alerts fire on control-plane events such as create, update, or delete. Action groups decouple detection from response, triggering notifications (email, SMS, push, voice) and automations (webhook/secure webhook, Logic Apps, Functions, Automation runbooks, ITSM connectors). Suppression rules and alert processing rules help reduce noise by muting or routing alerts during planned maintenance windows. Dashboards and Workbooks present telemetry differently. Azure dashboards are tile-based, cross-service canvases ideal for quick operational views and pinning metric charts. Workbooks are analytic, parameterized, and collaborative, blending metrics, logs, and visualizations with query-driven interactivity. Workbooks excel for operational runbooks, post-incident analysis, and service reviews where operators pivot across dimensions and drill into raw data without leaving context.

Service Health and resource resiliency signals

Platform availability and maintenance need dedicated monitoring beyond resource metrics. Azure Service Health provides personalized visibility into service issues, planned maintenance, and health advisories affecting the specific regions and services in a subscription. It complements the public Azure Status page by delivering subscription-scoped impact, timelines, and root-cause analyses when available. Health alerts can be configured to notify operations teams via action groups the moment a regional service incident impacts deployed workloads. Resource Health focuses on the state of individual resources such as virtual machines, app services, or databases. It distinguishes between platform-caused disruptions and user-initiated events, providing current and historical health states. Integrating Service Health and Resource Health alerts with incident management ensures that teams are notified when the platform is the root cause, reducing time spent troubleshooting healthy application components. Combining these signals with Azure Monitor alerts yields full-stack visibility: application performance, infrastructure utilization, and platform availability in one operational picture.

Management tools for operational control

Operational tasks span interactive troubleshooting, scripted automation, and mobile triage. The Azure portal offers a comprehensive, role-based experience for configuring services, visualizing metrics, and launching Cloud Shell directly in context. The Azure mobile app supports on-the-go health checks, alert acknowledgment, and quick actions like restarting a VM. For repeatability and integration with CI/CD, Azure CLI and Azure PowerShell provide cross-platform automation with consistent authentication through Microsoft Entra ID and support for both interactive and non-interactive flows. Cloud Shell supplies a secure, browser-based terminal with Bash and PowerShell, preloaded with the Azure CLI, Az PowerShell modules, and common tools like Git and Terraform. Sessions run in a Microsoft-maintained container; an Azure Files share persists user profiles and scripts. This eliminates local tooling drift and simplifies just-in-time operations executed from the portal, without managing runtime environments. For long-lived or high-throughput automation, host CLI/PowerShell in pipelines or containerized runners and authenticate with managed identities or federated credentials to avoid secret sprawl.

• Azure portal
  • Interface: Web UI
  • Best for: Configuration, visualization, ad-hoc tasks
  • Key strengths: Rich UX, deep service coverage, integrated Cloud Shell
  • Limitations: Manual, less suited for large-scale scripting
• Azure mobile app
  • Interface: iOS/Android
  • Best for: Triage and quick actions
  • Key strengths: Alert acknowledgment, basic resource actions, on-the-go access
  • Limitations: Limited configuration depth
• Cloud Shell
  • Interface: Browser shell
  • Best for: Ad-hoc commands without local setup
  • Key strengths: Preinstalled tools, persistent home via Azure Files, secured context
  • Limitations: Ephemeral container; not for long-running batch jobs
• Azure CLI (az)
  • Interface: Command-line
  • Best for: Cross-platform scripting and pipelines
  • Key strengths: Consistent syntax, JSON output, extensibility
  • Limitations: Learning curve for complex resource graphs
• Azure PowerShell (Az)
  • Interface: PowerShell modules
  • Best for: Windows/Linux/macOS automation; object-centric ops
  • Key strengths: Rich cmdlet coverage, pipelineable objects
  • Limitations: Heavier footprint; requires module lifecycle management

Automation: runbooks, update management, and cost-aware VM scheduling

Azure Automation provides a managed runbook service for orchestrating operational tasks. Runbooks can be authored in PowerShell, Python, or as graphical workflows, triggered on schedules, via webhooks, or by alerts through action groups. Run-as accounts have evolved toward managed identities, which remove certificate and secret handling while supporting granular, least-privilege access. Hybrid Runbook Workers extend automation into private networks or edge locations, executing runbooks against on-premises or isolated resources while still being managed from Azure. Patch governance is handled through Azure Update Manager, which unifies operating system updates for Windows and Linux across Azure VMs and Arc-enabled servers. Maintenance configurations define schedules, reboot behavior, pre/post scripts, and dynamic scopes using tags or saved queries. Compliance reporting highlights missing updates and deployment success, while integrations with Azure Policy enforce baseline configurations. Update Manager supersedes the legacy Update Management solution in Azure Automation, providing improved scale, granularity, and Arc-native support. To minimize compute spend for non-24x7 workloads, Azure offers multiple options to stop and start virtual machines on a schedule. The Start/Stop VMs v2 solution orchestrates tag-based targeting, business-hour schedules per time zone, idle detection, and optional notifications, using Azure Automation and Azure Monitor under the hood. Individual VMs also support auto-shutdown policies, and Virtual Machine Scale Sets can use autoscale rules driven by metrics. Combining metric-based scaling with scheduled stop/start yields predictable savings without sacrificing service levels during demand windows.

Hybrid and cross-tenant operations: Azure Arc, Azure Lighthouse, and cross-workspace Kusto

Azure Arc projects non-Azure resources—servers, Kubernetes clusters, SQL Server instances—into Azure Resource Manager so they can be tagged, assigned policy, monitored, and updated like native resources. The Azure Monitor agent and Data Collection Rules push telemetry from Arc-enabled machines to one or more Log Analytics workspaces, enabling centralized observability regardless of location. For Kubernetes, Arc integrates GitOps with Flux for declarative cluster management and supports extensions to deploy agents for Defender for Cloud, Prometheus scraping, and policy enforcement. Azure Lighthouse enables secure, at-scale management of resources across Microsoft Entra ID tenants, ideal for service providers or centralized platform teams supporting multiple business units. Delegations grant just-enough-access through Azure RBAC at subscription, resource group, or resource scope, while all actions are audited in the customer tenant. Operators can query logs, deploy policy, and run automation across tenants from a single context, reducing sign-in friction and eliminating cross-tenant credential sprawl. Kusto Query Language supports cross-resource and cross-region analytics by querying multiple workspaces and Application Insights resources in a single statement. Common patterns include union across workspaces and joins to correlate application traces with infrastructure logs. Example: union workspace(‘ops-westus’), workspace(‘ops-eastus’).InsightsMetrics | where Name == ‘ProcessorUtilization’ | summarize avgCPU = avg(Val) by bin(TimeGenerated, 5m), Computer. Another example correlates requests and exceptions across two apps: union app(‘storefront-’).requests, app(‘checkout-api’).exceptions | summarize count() by bin(timestamp, 5m), type. With DCR-based multi-destination routing, logs from Arc and Azure resources can land in regional workspaces while remaining queryable in aggregate, delivering both data residency and global analytics.

Practical Problem: GlobalRetail Co. builds an operations nerve center for a hybrid estate

Scenario: GlobalRetail Co. runs point-of-sale services in 1,200 stores, with regional data centers in Dublin and Singapore and a growing Azure footprint for web and analytics workloads. Leadership wants a single operational view, automated patching, and cost controls for development VMs, while an external managed service provider (MSP) handles overnight support across all environments.

Challenge: Unify monitoring and alerting across Azure and on-premises servers, implement automated OS updates with maintenance windows, reduce after-hours VM costs in dev/test, and enable secure cross-tenant operations for the MSP without sharing permanent credentials.

Recommended Approach:

1. Deploy Azure Arc on all on-premises Windows and Linux servers; enable the Azure Monitor agent via Data Collection Rules to send platform, syslog/Event, and performance data to regional Log Analytics workspaces.
2. Instrument web and API workloads with Application Insights using OpenTelemetry; configure availability tests from multiple regions and enable adaptive sampling and smart detection.
3. Create Azure Monitor metric, log, and activity log alerts for critical signals; centralize notifications with action groups that trigger email, Teams via webhook, and an ITSM connector to open incidents automatically.
4. Publish operations Workbooks combining App Insights failures/latency, VM performance (InsightsMetrics), and platform Activity Logs; pin key charts to an organization-wide Azure dashboard.
5. Implement Azure Update Manager with maintenance configurations per region and store type; use pre-scripts to drain traffic and post-scripts to validate service health; enforce compliance via Azure Policy assignments.
6. Roll out Start/Stop VMs v2 targeting dev/test subscriptions using tags environment=dev and environment=test; define business-hour schedules per local time zone and enable idle-stop for low-usage windows.
7. Onboard the MSP via Azure Lighthouse delegation at the management group level with a custom least-privilege role; require just-in-time elevation with PIM and restrict to break-glass runbooks instrumented with activity logging.
8. Author KQL queries that union the Dublin and Singapore workspaces for fleet CPU, memory, and error rates; schedule log alerts to detect spikes and route to the MSP’s action group after-hours.
9. Configure Service Health and Resource Health alerts for impacted regions/services; create an incident automation that posts advisory and RCA links into the incident record.

Azure Rationale: Azure Arc standardizes governance and telemetry for non-Azure servers, letting Azure Monitor consolidate metrics and logs across regions. Application Insights provides end-to-end transaction visibility so operations can pinpoint application faults versus infrastructure issues. Action groups and ITSM integration ensure timely, automated incident creation, while Workbooks and dashboards deliver a shared operational picture. Update Manager enforces consistent patch hygiene within maintenance windows, and Start/Stop VMs v2 cuts dev/test spend without affecting productivity. Azure Lighthouse grants the MSP secure, auditable, least-privilege access across tenants, and cross-workspace KQL ties global telemetry together for proactive detection and rapid diagnosis.

← Governance · All domains · Support →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Microsoft →