Dt Obs Azure

Azure Cloud Infrastructure

Monitor and analyze Azure resources using Dynatrace Smartscape and DQL. Query Azure services, audit security, manage organizational hierarchy, and plan capacity across your Azure infrastructure.

When to Use This Skill

Use this skill when the user needs to work with Azure resources in Dynatrace. Load the reference file for the task type:

| Task | File to load | |---|---| | Inventory and topology queries | (no additional file — use core patterns below) | | Query Azure metric timeseries (CPU, latency, throughput) | Load references/metrics-performance.md | | VNet topology, subnets, NSGs, public IPs, VPN, peering | Load references/vnet-networking-security.md | | Azure SQL, Cosmos DB, PostgreSQL, Redis investigation | Load references/database-monitoring.md | | Functions, App Service, AKS infrastructure, Container Apps | Load references/serverless-containers.md | | Azure LB, Application Gateway, Front Door, API Management | Load references/load-balancing-api.md | | WAF rule analysis, false-positive investigation | Load references/load-balancing-api.md | | Event Hubs, Service Bus, Event Grid | Load references/messaging-integration.md | | Storage Accounts, Blob, File, Queue, Table | Load references/storage-monitoring.md | | Unattached resources, tag compliance, lifecycle | Load references/resource-management.md | | Cost savings, unused resources, SKU analysis | Load references/cost-optimization.md | | Capacity headroom, VMSS scaling, quotas | Load references/capacity-planning.md | | Security audit, encryption, public access, Key Vault | Load references/security-compliance.md | | NSG rule analysis (0.0.0.0/0, open ports) | Load references/security-compliance.md | | Storage account encryption/public access audit | Load references/security-compliance.md | | Cost allocation, chargeback, ownership | Load references/resource-ownership.md | | Determine orchestration context (AKS, VMSS, standalone) | Load references/workload-detection.md |

---

Core Concepts

Entity Types

Azure resources use the AZURE_* prefix and can be queried using the smartscapeNodes function. All Azure entities are automatically discovered and modeled in Dynatrace Smartscape. Entity type names are derived from the ARM resource provider path: /Microsoft.Compute/virtualMachines becomes AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES. Sub-resources append with underscores: /Microsoft.Sql/servers/databases becomes AZURE_MICROSOFT_SQL_SERVERS_DATABASES.

Compute: AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES, AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS, AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS_VIRTUALMACHINES, AZURE_MICROSOFT_COMPUTE_DISKS, AZURE_MICROSOFT_COMPUTE_SSHPUBLICKEYS, AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS Networking: AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS, AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS, AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS, AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES, AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES, AZURE_MICROSOFT_NETWORK_LOADBALANCERS, AZURE_MICROSOFT_NETWORK_APPLICATIONGATEWAYS, AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKGATEWAYS, AZURE_MICROSOFT_NETWORK_CONNECTIONS, AZURE_MICROSOFT_NETWORK_EXPRESSROUTECIRCUITS Database: AZURE_MICROSOFT_SQL_SERVERS, AZURE_MICROSOFT_SQL_SERVERS_DATABASES, AZURE_MICROSOFT_CACHE_REDIS, AZURE_MICROSOFT_CACHE_REDISENTERPRISE, AZURE_MICROSOFT_DOCUMENTDB_DATABASEACCOUNTS Storage: AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS, AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_BLOBSERVICES_CONTAINERS, AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_FILESERVICES_SHARES, AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_QUEUESERVICES_QUEUES, AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_TABLESERVICES_TABLES Kubernetes/Containers: AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS, AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS_AGENTPOOLS, AZURE_MICROSOFT_CONTAINERREGISTRY_REGISTRIES, AZURE_MICROSOFT_APP_CONTAINERAPPS, AZURE_MICROSOFT_APP_MANAGEDENVIRONMENTS, AZURE_MICROSOFT_APP_JOBS App Service: AZURE_MICROSOFT_WEB_SITES, AZURE_MICROSOFT_WEB_SERVERFARMS, AZURE_MICROSOFT_WEB_SITES_FUNCTIONS Messaging: AZURE_MICROSOFT_EVENTHUB_NAMESPACES, AZURE_MICROSOFT_EVENTHUB_NAMESPACES_EVENTHUBS, AZURE_MICROSOFT_SERVICEBUS_NAMESPACES, AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_QUEUES, AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS, AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS_SUBSCRIPTIONS Security/Identity: AZURE_MICROSOFT_KEYVAULT_VAULTS, AZURE_MICROSOFT_MANAGEDIDENTITY_USERASSIGNEDIDENTITIES Monitoring: AZURE_MICROSOFT_OPERATIONALINSIGHTS_WORKSPACES, AZURE_MICROSOFT_INSIGHTS_COMPONENTS API Management: AZURE_MICROSOFT_APIMANAGEMENT_SERVICE

Azure Organizational Hierarchy

Azure organizes resources in a three-level hierarchy: Tenant > Subscription > Resource Group. Every resource belongs to exactly one resource group within one subscription. Use these fields to scope queries:

```dql-snippet filter azure.subscription == "08b9810e-..."

```dql-snippet
filter azure.resource.group == "my-rg"

```dql-snippet filter azure.location == "eastus"

Combine these filters for precise scoping:

```dql-template
smartscapeNodes "AZURE_*"
| filter azure.subscription == ""
    and azure.resource.group == ""
    and azure.location == ""
| summarize count = count(), by: {type}
| sort count desc

To see the organizational breakdown across your environment:

smartscapeNodes "AZURE_*"
| summarize resource_count = count(), by: {azure.subscription, azure.resource.group}
| sort resource_count desc

Common Azure Fields

All Azure entities include:

• azure.subscription — Azure subscription GUID
• azure.resource.group — Resource group name
• azure.location — Azure region (e.g., eastus, polandcentral)
• azure.resourceType — ARM resource type (e.g., microsoft.compute/virtualmachines)
• azure.provisioning_state — Provisioning state (e.g., Succeeded)
• azure.object — Full ARM resource JSON (see [Configuration Parsing](#configuration-parsing-with-azureobject))
• cloud.provider — Always azure
• tags — Resource tags (use ` tags[key] `)

Some entity types also have:

• azure.resourceId — Full ARM resource ID (VMs and some others)
• azure.resourceName — Resource name (VMs and some others)
• azure.availabilityZones — Availability zone list (VMs)

Relationship Types

Azure entity relationships can be traversed using traverse. The dt.traverse.relationship field is not populated for Azure entities, so you must use "*" as the relationship name in all traversal commands.

Key traversal pairs:

• VM → Disks: traverse "*", "AZURE_MICROSOFT_COMPUTE_DISKS"
• VM → NICs: traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES"
• VM → VMSS: traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS"
• VM → Availability Zones: traverse "*", "AZURE_MICROSOFT_RESOURCES_LOCATIONS_AVAILABILITYZONES"
• VM ← Extensions: traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINES_EXTENSIONS", direction:backward
• VMSS → AKS Clusters: traverse "*", "AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS"
• VMSS → Subnets: traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS"
• VMSS → NSGs: traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"
• VMSS → LB Backend Pools: traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_BACKENDADDRESSPOOLS"
• Subnet → VNet: traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS"
• Subnet → NSG: traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS"
• Subnet ← VMSS: traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS", direction:backward
• NSG ← NICs: traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKINTERFACES", direction:backward
• NSG ← Subnets: traverse "*", "AZURE_MICROSOFT_NETWORK_VIRTUALNETWORKS_SUBNETS", direction:backward
• LB → Backend Pools: traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_BACKENDADDRESSPOOLS"
• LB → Frontend IPs: traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_FRONTENDIPCONFIGURATIONS"
• LB → LB Rules: traverse "*", "AZURE_MICROSOFT_NETWORK_LOADBALANCERS_LOADBALANCINGRULES"
• SQL Server ← SQL Databases: traverse "*", "AZURE_MICROSOFT_SQL_SERVERS_DATABASES", direction:backward
• Storage Account ← Blob Containers: traverse "*", "AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_BLOBSERVICES_CONTAINERS", direction:backward
• Storage Account ← File Shares: traverse "*", "AZURE_MICROSOFT_STORAGE_STORAGEACCOUNTS_FILESERVICES_SHARES", direction:backward
• AKS ← VMSS: traverse "*", "AZURE_MICROSOFT_COMPUTE_VIRTUALMACHINESCALESETS", direction:backward
• AKS ← Agent Pools: traverse "*", "AZURE_MICROSOFT_CONTAINERSERVICE_MANAGEDCLUSTERS_AGENTPOOLS", direction:backward
• AKS ← NSGs: traverse "*", "AZURE_MICROSOFT_NETWORK_NETWORKSECURITYGROUPS", direction:backward
• AKS ← Public IPs: traverse "*", "AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES", direction:backward
• AKS → Public IPs: traverse "*", "AZURE_MICROSOFT_NETWORK_PUBLICIPADDRESSES"
• Web Site → App Service Plan: traverse "*", "AZURE_MICROSOFT_WEB_SERVERFARMS"
• Web Site ← Functions: traverse "*", "AZURE_MICROSOFT_WEB_SITES_FUNCTIONS", direction:backward
• Container App → Managed Environment: traverse "*", "AZURE_MICROSOFT_APP_MANAGEDENVIRONMENTS"
• EventHub Namespace ← Event Hubs: traverse "*", "AZURE_MICROSOFT_EVENTHUB_NAMESPACES_EVENTHUBS", direction:backward
• ServiceBus Namespace ← Queues: traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_QUEUES", direction:backward
• ServiceBus Namespace ← Topics: traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS", direction:backward
• ServiceBus Topic ← Subscriptions: traverse "*", "AZURE_MICROSOFT_SERVICEBUS_NAMESPACES_TOPICS_SUBSCRIPTIONS", direction:backward
• Use fieldsKeep:{field1, field2} to carry fields through multi-hop traversals
• After a single-hop traverse, use dt.traverse.history[0][id] to get the source entity ID, then lookup to resolve the source entity name:

``dql-snippet | fieldsAdd sourceId = dt.traverse.history[0][id] | lookup [smartscapeNodes "SOURCE_TYPE" | fields name, id], sourceField: sourceId, lookupField: id, prefix: "src." ``

• After multi-hop traversals, dt.traverse.history[-N] works for fields carried via fieldsKeep

Azure Metric Naming Convention

Dynatrace ingests Azure Monitor metrics and exposes them using this naming pattern:

cloud.azure...

The ` uses underscores within the namespace (e.g., microsoftcompute) and is lowercase (e.g., virtualmachines). Hierarchy levels are dot-separated: microsoftsql.servers.databases. ` is the Azure Monitor metric name.

Examples:

| Azure Monitor metric | Dynatrace metric key | |---|---| | VM Percentage CPU | cloud.azure.microsoft_compute.virtualmachines.PercentageCPU | | SQL DB cpu_percent | cloud.azure.microsoft_sql.servers.databases.cpu_percent | | Storage Ingress | cloud.azure.microsoft_storage.storageaccounts.Ingress | | Event Hub IncomingMessages | cloud.azure.microsoft_eventhub.namespaces.IncomingMessages | | Service Bus IncomingMessages | cloud.azure.microsoft_servicebus.namespaces.IncomingMessages | | App Service HttpResponseTime | cloud.azure.microsoft_web.sites.HttpResponseTime | | Load Balancer ByteCount | cloud.azure.microsoft_network.loadbalancers.ByteCount | | AKS node_cpu_usage_percentage | cloud.azure.microsoft_containerservice.managedclusters.node_cpu_usage_percentage | | Cosmos DB TotalRequestUnits | cloud.azure.microsoft_documentdb.databaseaccounts.TotalRequestUnits | | Redis serverLoad | cloud.azure.microsoft_cache.redis.serverLoad | | App Gateway TotalRequests | cloud.azure.microsoft_network.applicationgateways.TotalRequests |

To query a metric:

```dql-template timeseries cpu = avg(cloud.azure.microsoftcompute.virtualmachines.PercentageCPU), by: {dt.smartscapesource.id}, from: now()-1h | limit 10

**Important:** Never refer to these as "Azure Monitor alerts" or "Azure Monitor metrics" in output. Dynatrace monitors Azure resources natively through its Azure integration — these are **Dynatrace metrics** ingested from Azure.

### Configuration Parsing with azure.object

The `azure.object` field contains the full ARM resource JSON. Parse it with the `azjson` alias:

```dql-snippet
parse azure.object, "JSON:azjson"

The JSON is wrapped in a configuration key:

{
  "configuration": {
    "id": "",
    "name": "",
    "type": "",
    "location": "",
    "sku": { ... },
    "properties": { ... },
    "zones": [...]
  },
  "tags": { ... }
}

Access patterns:

• Properties: azjson[configuration][properties][field]
• SKU: azjson[configuration][sku][name]
• Kind: azjson[configuration][kind]
• Zones: azjson[configuration][zones]

Common configuration fields by service:

• VM: properties.hardwareProfile.vmSize, properties.storageProfile.imageReference.offer, properties.storageProfile.osDisk.osType, properties.extended.instanceView.powerState.displayStatus
• VMSS: sku.name (VM size), sku.capacity (instance count), tags.aks-managed-poolName
• NSG: properties.securityRules[] (custom rules array), properties.securityRules[].properties.direction, properties.securityRules[].properties.access, properties.securityRules[].properties.sourceAddressPrefix
• Storage Account: kind (e.g., StorageV2), sku.name, properties.accessTier, properties.supportsHttpsTrafficOnly, properties.allowBlobPublicAccess, properties.encryption.keySource
• SQL Server: properties.fullyQualifiedDomainName, properties.publicNetworkAccess, properties.minimalTlsVersion
• SQL Database: sku.name (tier), sku.capacity (DTU/vCore), properties.status, properties.zoneRedundant
• AKS: properties.kubernetesVersion, properties.powerState.code, properties.networkProfile.networkPlugin, properties.enableRBAC
• Web Site: kind (e.g., functionapp,linux), properties.state, properties.defaultHostName, properties.siteConfig.linuxFxVersion
• Container App: properties.runningStatus, properties.template.containers[].image, properties.template.scale.minReplicas, properties.template.scale.maxReplicas
• Event Hub Namespace: sku.name, properties.kafkaEnabled, properties.zoneRedundant
• Service Bus Namespace: sku.name (Basic/Standard/Premium), properties.zoneRedundant, properties.minimumTlsVersion, properties.publicNetworkAccess, properties.disableLocalAuth, properties.status
• Service Bus Queue: properties.maxSizeInMegabytes, properties.enablePartitioning, properties.deadLetteringOnMessageExpiration, properties.maxDeliveryCount, properties.lockDuration, properties.requiresDuplicateDetection, properties.status
• Key Vault: properties.enableRbacAuthorization, properties.enableSoftDelete, properties.publicNetworkAccess
• Redis: properties.sku.name, properties.hostName, properties.redisVersion, properties.enableNonSslPort
• Cosmos DB: kind (e.g., GlobalDocumentDB), properties.EnabledApiTypes, properties.consistencyPolicy.defaultConsistencyLevel
• Load Balancer: sku.name, tags.aks-managed-cluster-name
• App Gateway: properties.sku.name, properties.sku.tier, properties.operationalState, properties.webApplicationFirewallConfiguration.enabled, properties.webApplicationFirewallConfiguration.firewallMode (Detection/Prevention), properties.webApplicationFirewallConfiguration.ruleSetType, properties.webApplicationFirewallConfiguration.ruleSetVersion, properties.webApplicationFirewallConfiguration.disabledRuleGroups[], `properties.webApplicationFirewallConfigu

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Dynatrace
• Source: Dynatrace/dynatrace-for-ai
• License: Apache-2.0
• Homepage: https://www.dynatrace.com

Install and usage instructions live in the source repository linked above.