Explanation
Why the waste happens and who it affects.
Projects with multiple environments (e.g., dev, QA, staging, prod) often duplicate alert rules without adjusting for business impact, which can lead to alert sprawl and inflated monitoring costs.
In large-scale environments, reducing the frequency of non-critical alerts - especially in lower environments-can yield significant savings. Teams often overlook this lever because alert configuration is considered part of operational hygiene rather than cost control. Tuning alert frequencies based on SLA requirements and actual urgency is a low-friction optimization opportunity that does not compromise observability when implemented thoughtfully.
Billing model
The pricing dimensions that drive this cost.
Azure Monitor alert rules are billed differently by type. Log search alert rules are billed per rule per month at a rate set by the evaluation frequency, plus a charge for each time series when the query is split by dimensions, so rules with a 1-minute frequency are significantly more expensive than those set to 5, 10, or 15-minute intervals. Metric alerts are billed per monitored time series per month rather than per evaluation, so frequency tuning mainly reduces log search alert costs; for metric alerts, the lever is the number of monitored time series.
These costs scale linearly with the number of rules and environments. Because log search alert pricing steps down as the evaluation interval lengthens, frequency configuration is a key cost lever for log search alerts, especially in environments with hundreds or thousands of alerts.
How to detect
5 checks to find it in your estate.
- Identify Azure Monitor log search alerts with a 1-minute or 5-minute evaluation frequency, and review whether the alert is tied to a production SLA or high-severity operational impact
- Query Azure Resource Graph across various subscriptions
- Evaluate the business criticality of each alert and its current frequency
- Assess whether alerts were duplicated across environments with the same configuration
- Confirm with application owners whether high-frequency evaluation is still justified
How to fix
2 ways to remove the waste.
- Lengthen the evaluation frequency of non-critical log search alerts (for example, from 1 minute to 5, 10, or 15 minutes), consolidate rules duplicated across environments, and limit dimension splitting, since each evaluated time series is billed; for metric alerts, reduce the number of monitored time series instead
- Test changes gradually. Start with non-production environments and non-critical alerts
Documentation
Vendor references for pricing and configuration.