Overview
Domain 5 is the smallest AZ-400 skill area at 5–10%, with two functional groups. Configuring monitoring covers integrating Azure Monitor and Azure Monitor Logs with DevOps tools, collecting telemetry through Application Insights, VM Insights, Container Insights and the storage and network monitoring experiences, turning on GitHub insights and charts, and alerting on events in GitHub Actions and Azure Pipelines.
Analyzing metrics covers inspecting CPU, memory, disk and network indicators, using telemetry to study usage and application performance, following distributed traces in Application Insights, and writing basic Kusto Query Language queries against logs. The July 2026 update made minor wording changes to both groups. Expect telemetry questions to connect back to deployment health and release gates rather than stand alone.
How it's tested
Instrumentation questions describe an application or platform, a symptom such as slow responses, failed deployments or rising error rates, and a goal like faster detection. You choose the telemetry source, Insights feature, alert type or KQL query that finds the cause or notifies the team quickly.
-
Choose the collector
A workload type is given and you pick Application Insights, VM Insights, Container Insights or platform metrics.
-
Find the bottleneck
A slow or failing request must be traced across services using Application Insights end-to-end transaction details.
-
Query the logs
A short KQL query is shown or needed, and you choose operators such as where, summarize, project and render.
After a release, users report slow checkout pages, but CPU and memory on the App Service plan look normal. Infrastructure metrics alone will not show the cause. Opening the Application Insights performance view and drilling into a slow operation shows the end-to-end transaction, where a dependency call to a payment API takes most of the duration. Distributed tracing points directly to the slow external dependency.
Functional groups 2
Official functional groups from the Microsoft outline, in outline order.
5.1 Configure monitoring for a DevOps environmentAzure Monitor integration, Insights telemetry, GitHub insights and pipeline alerts.
- What it means
- This group covers integrating Azure Monitor and Azure Monitor Logs with DevOps tools, collecting telemetry with Application Insights, VM Insights, Container Insights and the monitoring experiences for storage and networks, enabling and configuring insights and charts in GitHub, and configuring alerts for GitHub Actions and Azure Pipelines events.
- What to understand
- Application Insights collects requests, dependencies, exceptions and traces from instrumented apps, typically through the Azure Monitor OpenTelemetry Distro, and stores them in a workspace-based Log Analytics resource. VM Insights uses the Azure Monitor Agent with a data collection rule to gather performance and dependency data. Container Insights collects AKS node, pod and container logs and metrics. Azure Monitor alerts can create work items or call webhooks, and Azure Pipelines release gates can query them. GitHub provides Insights for repositories and projects with configurable charts. Pipeline failure alerts use notification subscriptions, the Teams apps or workflow steps that post on failure.
- How it shows up
- Expect a workload and a question about which monitoring feature collects the needed signal.
- Common confusion
- Expecting VM Insights to show application request timings; that needs Application Insights instrumentation in the code.
5.2 Analyze metrics from instrumentationInfrastructure indicators, usage and performance analysis, distributed tracing and basic KQL.
- What it means
- This group covers inspecting infrastructure performance indicators such as CPU, memory, disk and network, analyzing collected telemetry for usage and application performance, inspecting distributed tracing with Application Insights, and querying logs with basic KQL.
- What to understand
- Infrastructure metrics show resource pressure but not why a request is slow. Application Insights performance, failures and usage views show operation durations, failure rates, users, sessions and funnels. Distributed tracing uses correlated operation IDs so the end-to-end transaction view shows each dependency call and its duration across services, and the application map shows component health. Basic KQL starts with a table such as requests or Perf, filters with where, picks columns with project, aggregates with summarize count() or avg() by bin(timestamp, 5m), sorts with order by, and charts with render timechart.
- How it shows up
- Expect a symptom that requires reading a trace or completing a short KQL query.
- Common confusion
- Putting summarize before where, which aggregates rows that should have been filtered out first.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Application Insights
Application performance monitoring in Azure Monitor.
- Remember
- Use workspace-based resources.
- Tested as
- Telemetry questions.
- Trap
- Expecting data without instrumenting the app.
-
OpenTelemetry Distro
Azure Monitor's recommended way to instrument apps.
- Remember
- Sends traces, metrics and logs to Application Insights.
- Tested as
- Instrumentation questions.
- Trap
- Assuming only the classic SDK is supported.
-
VM Insights
Performance and dependency monitoring for virtual machines.
- Remember
- Uses the Azure Monitor Agent and data collection rules.
- Tested as
- Infrastructure questions.
- Trap
- Expecting app-level traces from it.
-
Container Insights
Monitoring for AKS and container workloads.
- Remember
- Collects node, pod and container data.
- Tested as
- Container questions.
- Trap
- Using VM Insights for pods.
-
Log Analytics workspace
Store queried with KQL for Azure Monitor Logs.
- Remember
- Central place for logs from many sources.
- Tested as
- Log questions.
- Trap
- Spreading data across many workspaces without reason.
-
Application map
Visual of components and their dependencies.
- Remember
- Shows failure and latency hotspots.
- Tested as
- Diagnosis questions.
- Trap
- Reading it as a network topology.
-
End-to-end transaction details
Timeline of one request across services.
- Remember
- Uses correlated operation IDs.
- Tested as
- Distributed tracing questions.
- Trap
- Looking only at server CPU.
-
KQL where and summarize
Filter rows, then aggregate by groups.
- Remember
- Filter early for speed and accuracy.
- Tested as
- Query questions.
- Trap
- Reversing the order.
-
bin() and render timechart
Group values into time buckets and chart them.
- Remember
- Common for trend queries.
- Tested as
- Visualization questions.
- Trap
- Charting raw rows without binning.
-
Azure Monitor alerts with action groups
Rules that notify or act when conditions are met.
- Remember
- Action groups can call webhooks or create items.
- Tested as
- Alerting questions.
- Trap
- Polling dashboards instead.
-
GitHub Insights
Charts and statistics for repositories and projects.
- Remember
- Project insights charts are configurable.
- Tested as
- GitHub monitoring questions.
- Trap
- Expecting runtime application metrics there.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Which Insights feature
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Application Insights | Requests, dependencies, exceptions and traces from code | Application level | Skipping instrumentation |
| VM Insights | Guest performance and process dependencies | Virtual machine level | Expecting request timings |
| Container Insights | Node, pod and container logs and metrics | Kubernetes level | Using it for App Service |
Metrics vs logs vs traces
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Platform metrics | Numeric values sampled over time | Fast, light, short retention | Expecting detailed events |
| Logs | Records queried with KQL in Log Analytics | Rich detail and joins | Expecting real-time charts at no cost |
| Distributed traces | Correlated spans for one request | Shows where time is spent across services | Reading one service's logs in isolation |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Scale up for slow requests
- What candidates pick
- Scale up the App Service plan because pages are slow.
- Why it looks right
- More resources often help.
- Why it's wrong
- If CPU and memory are normal, the trace usually shows a slow dependency that scaling will not fix.
Clue to watch for Resource metrics look healthy.
-
VM Insights for app timings
- What candidates pick
- Enable VM Insights to measure API response times.
- Why it looks right
- It monitors the servers that host the API.
- Why it's wrong
- VM Insights covers guest performance; request timings need Application Insights.
Clue to watch for Operation or request duration is the goal.
-
Container Insights for App Service
- What candidates pick
- Turn on Container Insights for a containerized App Service app.
- Why it looks right
- The app runs in a container.
- Why it's wrong
- Container Insights targets Kubernetes clusters; App Service apps use Application Insights and platform logs.
Clue to watch for The platform is App Service, not AKS.
-
Dashboard watching
- What candidates pick
- Ask the team to check a dashboard after each deployment.
- Why it looks right
- Dashboards are easy to share.
- Why it's wrong
- Alerts with action groups notify automatically and can feed release gates.
Clue to watch for Detect failures quickly without manual effort.
-
Unfiltered summarize
- What candidates pick
- Run summarize count() by resultCode on all requests, then filter.
- Why it looks right
- It returns every code at once.
- Why it's wrong
- Filtering with where first reduces data and gives correct scoped counts.
Clue to watch for Only failed requests in the last hour are needed.
Answer framework
Use these steps to solve a Domain 5 monitoring or analysis scenario.
- Identify the layer where the problem sits: application code, virtual machine, container cluster, storage account, network path or the pipeline itself.
- Pick the matching collector: Application Insights for apps, VM Insights for machines, Container Insights for clusters, platform metrics for services.
- Decide how people learn about issues: Azure Monitor alerts with action groups, pipeline notifications, Teams messages or release gates.
- For diagnosis, move from metrics to traces: use the application map and end-to-end transaction view to locate slow or failing dependencies.
- For log questions, build KQL in order: table, where filters, project columns, summarize by bin, then order or render.
Practice question
Want more like this? The AZ-400 practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
This domain rewards short, practical sessions. Deploy a sample web app with Application Insights enabled through the OpenTelemetry Distro, generate traffic including a slow dependency, and explore the performance, failures, application map and transaction views. Then enable VM Insights on a small VM and Container Insights on a test AKS cluster if you can, and note which data each one adds.
Spend at least two hours in Log Analytics writing KQL. Count failed requests per five minutes, average response time per operation, and top exceptions, and add render timechart to each. Practice reading queries others wrote and spotting the step that is out of order.
Finally, wire monitoring back into delivery. Create an Azure Monitor alert with an action group, use it as a release gate check in Azure Pipelines, and set up failure notifications for a GitHub Actions workflow. Plan six to eight hours in total, then return to pipelines for review.
FAQ
How much of AZ-400 is Domain 5, Implement an instrumentation strategy?
Microsoft weights it at 5–10%, the smallest skill area, with two functional groups: configuring monitoring and analyzing metrics.
How deep does the exam go into KQL?
The objective says basic KQL, so know tables, where, project, summarize, bin, order by and render rather than advanced joins or functions.
Which tool shows where time is spent in a slow request?
Application Insights end-to-end transaction details, which use correlated operation IDs to show each dependency call and its duration.
What is the difference between VM Insights and Application Insights?
VM Insights monitors machine performance and process dependencies. Application Insights monitors requests, dependencies and exceptions inside the application.
Can monitoring stop a bad deployment?
Yes. Azure Pipelines checks and gates can query Azure Monitor alerts and hold promotion while alerts are active.
What GitHub monitoring features are in scope?
Repository and project insights, configurable charts, and alerts or notifications for GitHub Actions workflow events.
Other DevOps & Containers certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered monitoring configuration, telemetry, distributed tracing and KQL basics. Check whether you can choose the right signal and query in exam scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AZ-400 AI tutor Get any concept explained your way