Skip to content

Learning Paths

Use this page to choose a reading path based on your role and goal. Each path is numbered, so read the pages in order for the best result. Every path ends with a checklist of concrete outcomes you should be able to demonstrate.

Pick one primary path first

If you fit multiple roles, pick the one that matches your current goal, complete that path, then read a second path opportunistically. Trying to follow every path in parallel dilutes progress.

Choose Your Path

Role Goal Time Budget Start With
Developer Instrument apps and read traces or metrics 2-3 hours Overview, Platform Hub
SRE / Operator Design alerts, workbooks, and workspace hygiene 3-4 hours Operations Hub, Best Practices Hub
Architect Design workspaces, DCR ingestion, governance, cost 4-6 hours Platform Hub, Best Practices Hub
Incident Responder Diagnose fast with KQL, playbooks, and service health 2-4 hours + on-call reference Troubleshooting Hub 
flowchart TD
    A[Start Here] --> B[Platform Concepts]
    B --> C{Choose your path}
    C --> D[Developer: Instrumentation]
    C --> E[SRE: Alerts and Workbooks]
    C --> F[Architect: Workspaces and Governance]
    C --> G[Incident Responder: KQL and Playbooks]
    D --> H[Production Readiness]
    E --> H
    F --> H
    G --> H

Developer Path

Instrument application code, emit useful traces and metrics, and read them from Application Insights or Log Analytics.

Time: 2-3 hours

flowchart TD
    A[Overview] --> B[Application Insights Basics]
    B --> C[OpenTelemetry SDK]
    C --> D[Per-Service Observability]
    D --> E[Query Your Traces]

Read in order:

  1. Overview
  2. Platform Hub — focus on Application Insights and the data platform
  3. Per-service observability: App Service, Functions, Container Apps, AKS, VM
  4. Reference Hub — KQL quick reference
  5. Troubleshooting Hub — missing telemetry playbook

Outcomes

  • You can wire Application Insights into an ASP.NET, Python, Node, or Java app using OpenTelemetry.
  • You can emit a custom trace or metric and query it in Log Analytics.
  • You can find your service's platform logs and the tables they land in.
  • You know when to use App Insights vs Log Analytics for a diagnostic question.

Microsoft Learn anchors

SRE / Operator Path

Run Azure Monitor in production: alert design, workbook curation, action-group hygiene, and workspace operations.

Time: 3-4 hours

flowchart TD
    A[Log Analytics Basics] --> B[Alert Strategy]
    B --> C[Workbooks]
    C --> D[Workspace Operations]
    D --> E[Cost Control]

Read in order:

  1. Platform Hub — Log Analytics workspace, metrics, alerts architecture
  2. Best Practices Hub — alert strategy, workspace design, cost, security
  3. Operations Hub — alert rule management, workbooks, workspace management
  4. Troubleshooting Hub — first 10 minutes and playbooks for common ops symptoms
  5. Reference Hub — CLI cheatsheet and diagnostic tables

Outcomes

  • You can design an alert set that catches top failure modes without page-storming.
  • You can build a workbook that unifies infra and app signals for one service.
  • You can rotate action groups and validate the alert-to-incident pipeline end-to-end.
  • You can identify the top-cost tables in a workspace and apply a retention or filtering change.

Microsoft Learn anchors

Architect Path

Design workspace topology, ingestion policy with Data Collection Rules, governance guardrails, and cost model for Azure Monitor across a portfolio.

Time: 4-6 hours

flowchart TD
    A[Workspace Topology] --> B[Data Collection Rules]
    B --> C[Governance and Access]
    C --> D[Multi-Cloud or Hybrid]
    D --> E[Cost and Retention]

Read in order:

  1. Platform Hub — data platform, DCR, workspace, networking and security
  2. Best Practices Hub — workspace design, data retention, tagging, multi-cloud, security and access
  3. Operations Hub — DCR ops, diagnostic settings, export and integration
  4. Reference Hub — platform limits, diagnostic tables
  5. Troubleshooting Hub — mental model and architecture overview

Outcomes

  • You can pick between a central and distributed workspace model for a portfolio.
  • You can design a Data Collection Rule set that filters noise before ingestion.
  • You can define an access model with Azure RBAC and table-level permissions.
  • You can estimate monthly ingestion cost and set alerts for cost drift.

Microsoft Learn anchors

Incident Responder Path

Diagnose fast during a live incident. Focuses on symptom-to-playbook mapping, KQL fluency, and service health signals.

Time: 2-4 hours + on-call reference

flowchart TD
    A[Decision Tree] --> B[First 10 Minutes]
    B --> C[KQL Query Packs]
    C --> D[Playbooks]
    D --> E[Service Health]

Read in order:

  1. Troubleshooting Hub
  2. Decision Tree and Mental Model
  3. First 10 Minutes runbooks: No Data, Alert Not Firing, Query Timeout, High Cost
  4. KQL Query Packs
  5. Playbooks Hub — no-data, alert-storm, agent-not-reporting, high-ingestion-cost, slow-query, and more

Outcomes

  • You can run the First 10 Minutes runbook for a monitoring symptom (no data, storm, cost, timeout).
  • You can write a KQL query that isolates a failure window and its top offenders.
  • You can select the right playbook from a symptom description.
  • You can correlate Azure Service Health with a workload alert to rule out platform events.

Microsoft Learn anchors

Track Selection Matrix

Situation Start with Then continue to
Onboarding a new service to Monitor Developer Path SRE Path
Designing a portfolio workspace strategy Architect Path SRE Path
Preparing for launch SRE Path Incident Responder Path
Active incidents Incident Responder Path SRE Path (hardening)

Live incident? Skip the path.

If you are actively responding to a page, jump straight to Troubleshooting Hub, the Decision Tree, and the First 10 Minutes runbooks.

See Also

Sources