6.1.2.2. Configure Action Groups

💡 First Principle: Action groups are the fundamental mechanism for orchestrating automated responses to alerts, ensuring that operational issues are communicated to the right people and systems for rapid and efficient resolution.

Scenario: You need to configure an Azure Monitor alert for high CPU utilization on your production Virtual Machines. When this alert triggers, you want to receive an email notification, send an SMS message to the on-call engineer, and automatically trigger an Azure Automation runbook to restart the affected VM.

What It Is: An action group is a collection of notification and action preferences that are triggered by an Azure alert.

Purpose:

• When an alert fires, an action group determines the set of responses.

Common Action Types:

• Notification types:
  • Email, SMS, Push, Voice: Instantly notify individuals or teams.
  • ITSM Connector: Create tickets in tools like ServiceNow.
• Action types:
  • Webhook: Send alert data to external systems.
  • Automation Runbook: Launch scripts for automated remediation.
  • Logic App: Trigger complex workflows.
  • Azure Function: Execute custom code.
  • Event Hubs: Stream alert data to SIEMs.

Practical Implementation: Creating an Action Group with Azure CLI

# Create an action group
az monitor action-group create \
  --name "High-CPU-Actions" \
  --resource-group MyResourceGroup

# Add an email receiver to the action group
az monitor action-group update \
  --name "High-CPU-Actions" \
  --resource-group MyResourceGroup \
  --add-action email my-email-action myadmin@contoso.com

⚠️ Common Pitfall: Relying solely on email notifications. Emails can be easily missed. For critical alerts, use more intrusive methods like SMS or push notifications, and integrate with on-call management systems.

Key Trade-Offs:

• Notification vs. Automation: Notifications require human intervention. Automated actions (like restarting a VM) can resolve issues faster but carry a risk if the automation is not well-tested.

Reflection Question: How do Azure Monitor action groups, by orchestrating automated responses with various notification types and action types, fundamentally ensure that operational issues are addressed quickly and efficiently, minimizing downtime and manual effort?