Lesson 1: The Azure Ops Toolkit on One Page

Why start with a map

Azure has about a dozen management and monitoring services, and several have been renamed more than once. A runbook from 2019 may tell you to "check OMS". A 2022 blog post talks about "Automanage machine configuration". A colleague still calls Cost Management "Cloudyn". If you can't turn those names into today's services, you lose time in an incident and you misjudge what is still supported.

Think of this lesson as the floor plan of a workshop: which tool hangs on which wall. Later levels take each tool down and use it. For now you need three things: the job group each service belongs to, its old names, and the first place to look for a common operations question.

The map: seven job groups

Gotcha: "Log Analytics" is used for three things: the old product, the workspace that stores the data, and the query page in the portal. When a doc says "send it to Log Analytics", read it as "send it to a Log Analytics workspace, through Azure Monitor".

Walkthrough: one question, one first stop

The skill here is routing a question to the right first stop. Here are three common questions, each answered from the CLI. Run them in Cloud Shell, which is already signed in.

"Which VMs are missing patches?" Start with Update Manager, read through Resource Graph

Update Manager writes its assessment results into Resource Graph. That means one query can cover every subscription you have access to.

# The az graph commands come from the resource-graph extension.
# The first call installs it automatically; this line just makes it explicit.
az extension add --name resource-graph

# Count pending updates per machine from Update Manager's latest assessment
az graph query -q "
patchassessmentresources
| where type =~ 'microsoft.compute/virtualmachines/patchassessmentresults'
| extend vm = tostring(split(id, '/')[8])
| project vm, status = properties.status,
          critical = properties.availablePatchCountByClassification.critical,
          security = properties.availablePatchCountByClassification.security
| order by toint(critical) desc" -o table

The output looks something like this:

Vm           Status     Critical  Security
-----------  ---------  --------  --------
web-prod-01  Succeeded  3         5
sql-prod-02  Succeeded  1         2

Pitfall: If a VM is missing, no assessment has run on it yet. That isn't the same as "fully patched". You'll see how to fix that in the Update Manager lesson.

"What do we actually run?" Start with Resource Graph

# Inventory of resources by type across all subscriptions you can read, top 5
az graph query -q "resources | summarize count() by type | top 5 by count_" -o table

Resource Graph is read-only and fast, and it reads the Resource Manager control plane. It doesn't see inside a VM; for that you need Azure Monitor or Machine Configuration.

"Why did the bill jump?" Start with Cost Management, then Advisor

Cost Analysis in the portal (Cost Management → Cost analysis, grouped by service or resource) shows what changed. Anomaly alerts flag unexpected daily spikes. Advisor then tells you what to do about it:

# Advisor's cost recommendations, for example idle or oversized resources
az advisor recommendation list --category Cost \
  --query "[].{impact:impact, problem:shortDescription.problem}" -o table

Trade-off: Cost Management tells you where the money went. Advisor tells you what to change. You usually need both, and in that order.

Quick routing table

Best practice: Keep a "rename crib sheet" in your team wiki next to the runbooks. Most confusion in old Azure scripts comes from names, not from the technology.

Key takeaways

• Azure ops tooling falls into seven job groups: monitoring and logging, tracing, infrastructure as code, configuration and patching, inventory and governance, cost, and advice and health.
• OMS became Azure Monitor (with Log Analytics workspaces), Update Management became Update Manager, Guest Configuration became Machine Configuration, and Cloudyn became Cost Management.
• Several services are retiring: Blueprints (fully retired 31 Jan 2027), Automation State Configuration and Automanage Best Practices (both 30 Sep 2027). Don't build anything new on them.
• Resource Graph is the cross-subscription inventory tool, and it also holds Update Manager's patch assessment results.
• For bill questions, go to Cost Management to see where the money went, then Advisor to see what to change.