Skip to content

Scenario Router

Use this page when you have a specific situation and want to jump straight to the page that answers it. This is a breadth-first index across four lifecycle phases — Plan, Deploy, Operate, Troubleshoot — that complements the depth-first Learning Paths and the symptom-first Decision Tree.

Start with Learning Paths if you're new to Azure Monitor

This page assumes you already know what you're trying to do. If you're still deciding what to learn first, start with Learning Paths — it sequences a role-based tour of the guide. Use this Scenario Router when you have a specific question and want to jump to the exact page that answers it.

How to Use This Router

  • Pick the table for the lifecycle phase you're in — Plan, Deploy, Operate, or Troubleshoot.
  • Scan the left column for the situation that matches yours; open the destination on the right.
  • If two rows fit, prefer the row from the phase you're actually in — the same platform concept often appears in more than one phase.
  • If your situation spans two phases (a design choice today that will become an incident later), check Cross-Phase Scenarios first.
  • Every destination is a real page in this guide, not an external link and not an aspirational page.
  • Rows are intentionally short. Follow the link for the depth; this table is a switchboard, not a summary.
  • If your situation is missing, open an issue — the router is meant to grow.

Lifecycle Overview

flowchart LR
    A[Plan] --> B[Deploy]
    B --> C[Operate]
    C --> D[Troubleshoot]
    D -.-> A

I'm Planning

Situation Where to go
I'm choosing which learning path to follow Learning Paths — role-based reading paths
I want to understand how Azure Monitor works end-to-end How Azure Monitor Works — sources, pipeline, and destinations
I'm deciding between Log Analytics, Application Insights, and Metrics for a signal Data Platform — Metrics, Logs, Traces, Changes pillars
I'm designing Log Analytics workspace topology for a portfolio Workspace Design — central vs distributed models
I'm designing ingestion policy with Data Collection Rules Data Collection Rules — filter noise before ingestion
I'm planning retention, archive, and cost model Data Retention — analytics tier, basic logs, archive
I'm planning access model (RBAC, table-level permissions) Security and Access — workspace and table RBAC
I'm planning networking posture (Private Link, IP restrictions) Networking and Security — AMPLS and private access
I'm planning multi-cloud or hybrid coverage Multi-Cloud Hybrid — non-Azure signal ingestion

I'm Deploying

Situation Where to go
I want the quickest possible first-hands-on Lab Guides — 5 end-to-end labs (workspace, KQL, alerts, App Insights, workbooks)
I'm setting up my first Log Analytics workspace Workspace Management — create, link, and configure
I'm setting up Application Insights for a new app Application Insights — connection string, sampling, and SDK model
I'm configuring Data Collection Rules for ingestion Data Collection Rules Ops — create, associate, and update DCRs
I need to enable diagnostic settings on Azure resources Diagnostic Settings — route platform logs to a workspace
I'm instrumenting a specific Azure service Service Guides Hub — App Service, Container Apps, Functions, AKS, VMs
I'm tagging resources so cost and ownership are visible Tagging and Organization — cost-center and workspace tagging

I'm Operating in Production

Situation Where to go
I need day-2 operational procedures Operations Hub — production runbooks
I want to follow production best practices Best Practices Hub — hardening and design guidance
I'm designing alerts that catch real incidents without page-storming Alert Strategy — signal-to-noise design
I'm managing alert rules (create, tune, silence) Alert Rule Management — lifecycle for alert rules
I'm building or curating workbooks and dashboards Workbooks and Dashboards — visualization ops
I need to control monthly ingestion cost Cost Control — daily cap, table tier, retention levers
I need to update a DCR to filter a noisy table Data Collection Rules Ops — filter and transform ingested data
I'm exporting data to a SIEM or long-term storage Export and Integration — Event Hubs, Storage, and Sentinel
I'm hardening workspace access and audit Security and Access — RBAC, table permissions, audit

I'm Troubleshooting

Situation Where to go
I need to systematically diagnose an issue Decision Tree — hypothesis-driven triage flow
I need to know what evidence to collect Evidence Map — question → KQL + CLI artifact index
I want quick pattern-match cards for common symptoms Quick Diagnosis Cards — one-page symptom cards
An incident just started and I have 10 minutes First 10 Minutes — ordered triage checklist
No data is landing in my workspace No Data in Workspace — DCR, agent, and permission gaps
Application Insights telemetry is missing or incomplete Missing Application Telemetry — SDK, sampling, and connection issues
An alert rule isn't firing when it should Alert Not Firing — evaluation, threshold, and scope checks
An alert storm is paging on-call repeatedly Alert Storm — dampening, dedupe, and threshold tuning
Monthly ingestion cost jumped unexpectedly High Ingestion Cost — top tables, DCR audit, and cap review
An agent (AMA, Log Analytics agent) isn't reporting Agent Not Reporting — identity, network, and DCR-association issues

Cross-Phase Scenarios

Some situations straddle two phases — the design choice you make while planning determines the failure mode you eventually debug. These rows link the two together so you can see the pattern and the drill in one place. If you're only in one phase today, still skim this table: it's the cheapest way to preview which decisions will hurt later.

Situation Where to go
I'm designing DCR policy and want to see later ops implications first Data Collection Rules then Data Collection Rules Ops — design + day-2 filter management
I'm designing alert strategy and want to see the failure mode it prevents Alert Strategy then Alert Storm — plan + incident
I'm planning cost model and want to see the surprise it prevents Cost Optimization then High Ingestion Cost — plan + incident
I'm setting up Application Insights and want to preview instrumentation gaps Application Insights then Missing Application Telemetry — deploy + drill

When This Router Isn't the Right Entry Point

  • You're brand new to Azure Monitor → start with Learning Paths instead.
  • You already have a symptom (no data, alert storm, high cost) and don't know which lifecycle phase you're in → jump to Decision Tree or Quick Diagnosis Cards.
  • You're deciding which Azure signal type to emit (Metrics vs Logs vs Traces) → use Data Platform.

See Also

Sources