Question

Difficulty: MediumAzure Monitor Alerts and Action Groups

An administrator is configuring an Azure Monitor action group to send alert notifications to a third-party IT Service Management (ITSM) system via a Webhook action. The administrator must ensure that the JSON payload structure is identical, regardless of whether the alert is based on a metric threshold, an activity log event, or a log search query. Which configuration should the administrator enable in the action group?

  1. Enable the common alert schemaAnswer
  2. B
    Enable the secure webhook option
  3. C
    Configure an alert processing rule with a custom payload action
  4. D
    Add a custom header to the Webhook action defining the alert type

Answer

Enable the common alert schema
Enabling the common alert schema standardizes the JSON payload format sent by Azure Monitor for all types of alerts (such as metric alerts, activity log alerts, and log search alerts). This allows downstream systems like ticketing platforms or custom APIs to parse incoming alerts using a single, unified data model rather than requiring custom parsers for each alert source.

Step-by-Step Solution

1
Identify the administrative requirement to unify the alert schema across different signal types (metric, log, activity log) sent to a third-party Webhook endpoint.
Recognized that different alert types in Azure Monitor historically had distinct schema formats, making integration complex.
Understanding the need for schema standardization is critical to choosing the correct action group feature.
2
Evaluate the Azure Monitor Action Group configurations that modify the webhook payload properties.
Identified the 'Enable the common alert schema' toggle as the built-in feature that standardizes the JSON structure across all alert signals.
This configuration directly maps to the requirement of sending an identical payload structure.

Key Concept

Azure Monitor Common Alert Schema
Rate this question