Azure Monitor Alerts – Stateful vs Stateless Alerts

1. What is an Alert in Azure?

An Alert in Azure is a monitoring feature that automatically notifies you or triggers an action when a specific condition is met in your Azure resources.

Alerts are part of Azure Monitor.

Simple Example:

Suppose you have an Azure Virtual Machine running your application.

• Normal CPU usage: 30–50%

• CPU usage increases to 90%.

• You configured an alert when CPU usage exceeds 80%.

• Azure Monitor detects the condition.

• Azure sends an email, SMS, or triggers an automated action.

You do not need to monitor your virtual machine manually.

2. How Azure Alerts Work

Azure Resource
(VM / App Service / SQL Database)
          |
          v
     Azure Monitor
          |
          v
      Alert Rule
          |
          v
  Evaluate Condition
    CPU Usage > 80%
          |
     +----+----+
     |         |
    Yes        No
     |         |
     v         v
Alert Fired  No Alert
     |
     v
  Action Group
     |
     +----> Email
     |
     +----> SMS
     |
     +----> Webhook
     |
     +----> Azure Function

Important Components

3. Types of Alerts in Azure

Azure Monitor supports several alert types.

4. What is a Stateful Alert?

A Stateful Alert remembers whether the alert condition is already active.

Once an alert fires, Azure does not repeatedly fire a new alert for every evaluation while the same condition remains active. The alert is resolved when Azure determines that the condition has recovered.

Example: CPU Usage

Alert condition: CPU usage greater than 80%.

Illustrative timeline. Actual firing and resolution depend on evaluation frequency, aggregation, and alert-type-specific recovery rules.

Stateful Alert Flow

CPU > 80%
    |
    v
Alert Fired
    |
    v
Notification Sent
    |
    v
CPU Still > 80%
    |
    v
No New Alert
    |
    v
CPU Returns to Normal
    |
    v
Alert Resolved
    |
    v
CPU > 80% Again
    |
    v
New Alert Fired

Key Points:

• Remembers the active alert state.

• Avoids repeated notifications for the same ongoing incident.

• Supports automatic resolution.

• Useful for CPU, memory, response time, and resource health monitoring.

5. What is a Stateless Alert?

A Stateless Alert does not maintain an ongoing fired/resolved state for the condition.

Whenever the alert condition is satisfied during an evaluation, Azure can fire a new alert, even if the same problem was detected previously.

Example: CPU Usage

Alert condition: CPU usage greater than 80%.

Evaluation frequency: Every 5 minutes.

Conceptual example. Actual notification frequency can be affected by alert processing and action-group behavior.

Stateless Alert Flow

Every 5 Minutes
      |
      v
Check CPU Usage
      |
      v
Is CPU > 80%?
      |
  +---+---+
  |       |
 Yes      No
  |       |
  v       v
Fire     Wait
Alert    |
  |      |
  v      |
Notify   |
  |      |
  +---+--+
      |
      v
Next Evaluation

Key Points:

• Does not retain the active incident state.

• Can generate multiple alerts for the same persistent condition.

• Useful when each matching evaluation needs attention.

• Can produce more notifications than stateful monitoring.

6. Stateful vs Stateless Alerts – Comparison

Important: Stateful and stateless behavior is not a universal setting across every Azure alert type. Metric alerts and log search alerts have different configuration options and resolution rules.

7. How to Configure Stateful or Stateless Alerts in Azure Portal

You can configure this behavior when creating a metric alert.

1. Open Azure Portal.

2. Search for Monitor.

3. Select Alerts → Create → Alert rule.

4. Select the resource, such as an Azure VM or App Service.

5. Under Condition, select a metric such as Percentage CPU.

6. Set the threshold to Greater than 80%.

7. Configure the evaluation frequency.

8. Under Actions, select or create an Action Group.

9. Open the Details tab and expand Advanced options.

Find the option:

10. Select Review + create, then Create.

Microsoft confirms that metric alerts are stateful by default and that clearing this option makes them stateless.

Microsoft Learn

+1

8. Important Interview Questions

Q1. What is an Azure Alert?

An Azure Alert automatically detects specified conditions in Azure resources and can notify administrators or execute actions through Action Groups.

Q2. What is the difference between stateful and stateless alerts?

Stateful alerts remember the active condition and avoid firing repeatedly until recovery. Stateless alerts can fire repeatedly whenever the condition is met.

Q3. Are Azure Metric Alerts stateful by default?

Yes. Azure Monitor metric alerts are stateful by default.

Q4. When does a stateful metric alert resolve?

When the alert condition is not met for three consecutive evaluations.

Microsoft Learn

Q5. Are Azure Activity Log Alerts stateful or stateless?

Activity Log Alerts are stateless because they represent individual events, such as a resource deletion or role assignment.

Microsoft Learn

Q6. Can Log Search Alerts be stateful?

Yes. Log Search Alerts support both stateful and stateless behavior, with specific recovery rules.

Q7. Which alert type should be used for production monitoring?

For persistent problems such as high CPU utilization or application response time, stateful alerts are generally preferable because they reduce duplicate notifications.

Quick Revision:

• Stateful: Alert once → Remain active → Recover → Resolve.

• Stateless: Condition met → Fire → Condition met again → Fire again.

For additional reference, see Microsoft Learn – Azure Monitor Alerts.