Azure alerts

Latest Dynatrace
How-to guide
Published Jun 19, 2026

Azure Monitor alerts captures metric threshold breaches, log query matches, activity log events, and resource health conditions across your Azure resources.

Enable Azure Monitor alert forwarding

To forward these alerts to Dynatrace, create an action group with an Event Hubs action that routes alerts to the dt-events-evh event hub deployed by the ARM template.

Create an action group

When configuring the Event Hubs action, enable the Common alert schema. The default native schema is not supported and alerts will not be ingested.

In the Azure portal, go to Monitor > Alerts > Action groups.
Select + Create.
Enter the Subscription, Resource group, a name and display name for the action group.
Select the Actions tab.
For Action type, select Event Hub.
Enter the name for the action.
Select Subscription and Event Hub namespace deployed by the ARM template.
For Event Hub name, select dt-events-evh.
Set Enable the common alert schema to Yes.
Select OK, then Review + create, then Create.

After creating the action group, attach it to alert rules by editing each rule and selecting the action group under Actions. For more information, see Azure action groups.

Use an alert processing rule to apply the action group at scale Recommended

Instead of attaching the action group to each alert rule individually, an Azure Monitor Alert processing rule can automatically apply the action group to all matching alerts across a subscription or resource group—including alert rules you add later.

In the Azure portal, go to Monitor > Alerts > Alert processing rules.
Select + Create.
Under Scope, select the subscriptions or resource groups to which the rule should apply.
Optional Under Filters, narrow the scope by severity, resource type, alert rule name, or other criteria.
Select Next: Rule setting > or go to the Rule settings tab, and select Apply action group.
Select the action group you created in the previous step.
Go to the Details tab, and add a name and description for the rule.
Select Review + create, then Create.

The rule applies to all existing alerts within the selected scope and automatically covers new alert rules as they are created. For more information, see Alert processing rules in Azure documentation.

Query Azure Monitor alerts in Notebooks

You can query Azure Monitor alerts ingested via Dynatrace using Notebooks and DQL.

Use the dt.da.source attribute to filter for alerts ingested through the Azure alerts ingest pipeline.

fetch events
| filter dt.da.source == "azure-event-ingest"
| sort timestamp desc