Scenario Router
Use this page when you have a specific situation and want to jump straight to the page that answers it. This is a breadth-first index across four lifecycle phases — Plan, Deploy, Operate, Troubleshoot — that complements the depth-first Learning Paths and the symptom-first Decision Tree.
Start with Learning Paths if you're new to Azure Monitor
This page assumes you already know what you're trying to do. If you're still deciding what to learn first, start with Learning Paths — it sequences a role-based tour of the guide. Use this Scenario Router when you have a specific question and want to jump to the exact page that answers it.
How to Use This Router
- Pick the table for the lifecycle phase you're in — Plan, Deploy, Operate, or Troubleshoot.
- Scan the left column for the situation that matches yours; open the destination on the right.
- If two rows fit, prefer the row from the phase you're actually in — the same platform concept often appears in more than one phase.
- If your situation spans two phases (a design choice today that will become an incident later), check Cross-Phase Scenarios first.
- Every destination is a real page in this guide, not an external link and not an aspirational page.
- Rows are intentionally short. Follow the link for the depth; this table is a switchboard, not a summary.
- If your situation is missing, open an issue — the router is meant to grow.
Lifecycle Overview
flowchart LR
A[Plan] --> B[Deploy]
B --> C[Operate]
C --> D[Troubleshoot]
D -.-> A
I'm Planning
| Situation | Where to go |
| I'm choosing which learning path to follow | Learning Paths — role-based reading paths |
| I want to understand how Azure Monitor works end-to-end | How Azure Monitor Works — sources, pipeline, and destinations |
| I'm deciding between Log Analytics, Application Insights, and Metrics for a signal | Data Platform — Metrics, Logs, Traces, Changes pillars |
| I'm designing Log Analytics workspace topology for a portfolio | Workspace Design — central vs distributed models |
| I'm designing ingestion policy with Data Collection Rules | Data Collection Rules — filter noise before ingestion |
| I'm planning retention, archive, and cost model | Data Retention — analytics tier, basic logs, archive |
| I'm planning access model (RBAC, table-level permissions) | Security and Access — workspace and table RBAC |
| I'm planning networking posture (Private Link, IP restrictions) | Networking and Security — AMPLS and private access |
| I'm planning multi-cloud or hybrid coverage | Multi-Cloud Hybrid — non-Azure signal ingestion |
I'm Deploying
| Situation | Where to go |
| I want the quickest possible first-hands-on | Lab Guides — 5 end-to-end labs (workspace, KQL, alerts, App Insights, workbooks) |
| I'm setting up my first Log Analytics workspace | Workspace Management — create, link, and configure |
| I'm setting up Application Insights for a new app | Application Insights — connection string, sampling, and SDK model |
| I'm configuring Data Collection Rules for ingestion | Data Collection Rules Ops — create, associate, and update DCRs |
| I need to enable diagnostic settings on Azure resources | Diagnostic Settings — route platform logs to a workspace |
| I'm instrumenting a specific Azure service | Service Guides Hub — App Service, Container Apps, Functions, AKS, VMs |
| I'm tagging resources so cost and ownership are visible | Tagging and Organization — cost-center and workspace tagging |
I'm Operating in Production
| Situation | Where to go |
| I need day-2 operational procedures | Operations Hub — production runbooks |
| I want to follow production best practices | Best Practices Hub — hardening and design guidance |
| I'm designing alerts that catch real incidents without page-storming | Alert Strategy — signal-to-noise design |
| I'm managing alert rules (create, tune, silence) | Alert Rule Management — lifecycle for alert rules |
| I'm building or curating workbooks and dashboards | Workbooks and Dashboards — visualization ops |
| I need to control monthly ingestion cost | Cost Control — daily cap, table tier, retention levers |
| I need to update a DCR to filter a noisy table | Data Collection Rules Ops — filter and transform ingested data |
| I'm exporting data to a SIEM or long-term storage | Export and Integration — Event Hubs, Storage, and Sentinel |
| I'm hardening workspace access and audit | Security and Access — RBAC, table permissions, audit |
I'm Troubleshooting
| Situation | Where to go |
| I need to systematically diagnose an issue | Decision Tree — hypothesis-driven triage flow |
| I need to know what evidence to collect | Evidence Map — question → KQL + CLI artifact index |
| I want quick pattern-match cards for common symptoms | Quick Diagnosis Cards — one-page symptom cards |
| An incident just started and I have 10 minutes | First 10 Minutes — ordered triage checklist |
| No data is landing in my workspace | No Data in Workspace — DCR, agent, and permission gaps |
| Application Insights telemetry is missing or incomplete | Missing Application Telemetry — SDK, sampling, and connection issues |
| An alert rule isn't firing when it should | Alert Not Firing — evaluation, threshold, and scope checks |
| An alert storm is paging on-call repeatedly | Alert Storm — dampening, dedupe, and threshold tuning |
| Monthly ingestion cost jumped unexpectedly | High Ingestion Cost — top tables, DCR audit, and cap review |
| An agent (AMA, Log Analytics agent) isn't reporting | Agent Not Reporting — identity, network, and DCR-association issues |
Cross-Phase Scenarios
Some situations straddle two phases — the design choice you make while planning determines the failure mode you eventually debug. These rows link the two together so you can see the pattern and the drill in one place. If you're only in one phase today, still skim this table: it's the cheapest way to preview which decisions will hurt later.
When This Router Isn't the Right Entry Point
- You're brand new to Azure Monitor → start with Learning Paths instead.
- You already have a symptom (no data, alert storm, high cost) and don't know which lifecycle phase you're in → jump to Decision Tree or Quick Diagnosis Cards.
- You're deciding which Azure signal type to emit (Metrics vs Logs vs Traces) → use Data Platform.
See Also
Sources