# Overly frequent querying in Azure Monitor alerts Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/overly-frequent-querying-in-azure-monitor-alerts While high-frequency alerting is sometimes justified for production SLAs, it's often overused across non-critical alerts or replicated blindly across... By: Jurian van Hoorn Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Overly Frequent Querying in Azure Monitor Alerts The short version While high-frequency alerting is sometimes justified for production SLAs, it's often overused across non-critical alerts or replicated blindly across environments. [Jurian van Hoorn](https://www.linkedin.com/in/j-hoorn/) Operations Senior (Azure Cloud) @ Netcompany Azure service [Azure Monitor](https://www.pointfive.co/efficiency-hub/cloud-services/azure-monitor) Category [Other](https://www.pointfive.co/efficiency-hub/service-category/other) Reference CER-0221 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. Projects with multiple environments (e.g., dev, QA, staging, prod) often duplicate alert rules without adjusting for business impact, which can lead to alert sprawl and inflated monitoring costs. In large-scale environments, reducing the frequency of non-critical alerts - especially in lower environments-can yield significant savings. Teams often overlook this lever because alert configuration is considered part of operational hygiene rather than cost control. Tuning alert frequencies based on SLA requirements and actual urgency is a low-friction optimization opportunity that does not compromise observability when implemented thoughtfully. ## Billing model The pricing dimensions that drive this cost. Azure Monitor alert rules are billed differently by type. Log search alert rules are billed per rule per month at a rate set by the evaluation frequency, plus a charge for each time series when the query is split by dimensions, so rules with a 1-minute frequency are significantly more expensive than those set to 5, 10, or 15-minute intervals. Metric alerts are billed per monitored time series per month rather than per evaluation, so frequency tuning mainly reduces log search alert costs; for metric alerts, the lever is the number of monitored time series. These costs scale linearly with the number of rules and environments. Because log search alert pricing steps down as the evaluation interval lengthens, frequency configuration is a key cost lever for log search alerts, especially in environments with hundreds or thousands of alerts. ## How to detect 5 checks to find it in your estate. - Identify Azure Monitor log search alerts with a 1-minute or 5-minute evaluation frequency, and review whether the alert is tied to a production SLA or high-severity operational impact - Query Azure Resource Graph across various subscriptions - Evaluate the business criticality of each alert and its current frequency - Assess whether alerts were duplicated across environments with the same configuration - Confirm with application owners whether high-frequency evaluation is still justified ## How to fix 2 ways to remove the waste. - Lengthen the evaluation frequency of non-critical log search alerts (for example, from 1 minute to 5, 10, or 15 minutes), consolidate rules duplicated across environments, and limit dimension splitting, since each evaluated time series is billed; for metric alerts, reduce the number of monitored time series instead - Test changes gradually. Start with non-production environments and non-critical alerts ## Documentation Vendor references for pricing and configuration. - [Types of Azure Monitor alerts learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-types) - [Overview of Azure Monitor alerts learn.microsoft.com](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview) - [Pricing - Azure Monitor azure.microsoft.com](https://azure.microsoft.com/en-us/pricing/details/monitor/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - Azure Monitor CER-0425 ### [Unfiltered Diagnostic Settings and Agent Data Collection Inflating Log Ingestion](https://www.pointfive.co/efficiency-hub/inefficiencies/unfiltered-diagnostic-settings-and-agent-data-collection-inflating-log-ingestion) Most Azure Monitor Logs cost comes from the volume of data ingested into Log Analytics workspaces, and much of that volume is collected by default rather than by design. Diagnostic settings are commonly created with the allLogs category... Other - Azure Monitor CER-0569 ### [Duplicate Container Metrics Collection in Container Insights](https://www.pointfive.co/efficiency-hub/inefficiencies/duplicate-container-metrics-collection-in-container-insights) AKS clusters can send container metrics to two places: Azure Monitor managed service for Prometheus, which stores metrics in an Azure Monitor workspace, and Container insights, which can write performance and inventory data such as Perf... Other - Azure Pipelines CER-0113 ### [Inefficient Use of Azure Pipelines](https://www.pointfive.co/efficiency-hub/inefficiencies/inefficient-use-of-azure-pipelines) Teams often overuse Microsoft-hosted agents by running redundant or low-value jobs, failing to configure pipelines efficiently, or neglecting to use self-hosted agents for steady workloads. These inefficiencies result in unnecessary cost... Other --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.