CH20-08: Observability, Operations, and Cost Services
Goal
Operational services make workloads visible, recoverable, repeatable, automatable, and financially accountable. They are not decorations added after the application works. They are part of the architecture because they decide how teams detect problems, restore service, change safely, and control cost.
The durable idea is:
Operational services make architecture visible, recoverable, automatable, and financially accountable.
The Short Version
Start with the operating responsibility:
| Operational Need | Common Azure Direction |
|---|---|
| Metrics, logs, alerts, and dashboards | Azure Monitor. |
| Application performance and tracing | Application Insights. |
| Queryable log storage | Log Analytics workspace. |
| Backup and restore | Azure Backup. |
| Disaster recovery orchestration | Azure Site Recovery. |
| Automation and runbooks | Azure Automation. |
| Infrastructure deployment | ARM, Bicep, Terraform, Azure DevOps, or GitHub Actions. |
| Cost visibility and budgets | Microsoft Cost Management. |
| Optimization recommendations | Azure Advisor. |
Service Reference
| Service or Capability | Purpose | Use When | Avoid When | Common Prompt |
|---|---|---|---|---|
| Azure Monitor | Platform for metrics, logs, alerts, dashboards, and observability signals. | You need visibility into resources, dependencies, alerts, and workload health. | You only collect data without ownership, alert paths, or action. | How will we know it is healthy? |
| Application Insights | Application performance monitoring and distributed tracing. | You need request telemetry, dependency calls, failures, traces, and application behavior insight. | You only need raw infrastructure metrics without app context. | What is happening inside the application? |
| Log Analytics workspace | Queryable log data store for Azure Monitor logs. | Teams need KQL queries, retained logs, investigations, and workspace-based log analysis. | You send all logs everywhere without retention, access, or cost design. | Where will logs be queried? |
| Azure Backup | Backup and restore for supported workloads. | You need point-in-time protection and restore capability. | You need full disaster recovery orchestration and failover planning; consider Site Recovery. | How do we restore lost or corrupted data? |
| Azure Site Recovery | Disaster recovery replication and failover orchestration for supported workloads. | You need workload recovery to another location with planned failover behavior. | Backups alone meet the recovery requirement, or the workload uses native multi-region design. | How do we fail over? |
| Azure Automation | Automation, runbooks, configuration, and operational tasks. | You need repeatable operational scripts, scheduled tasks, or automation workflows. | CI/CD, deployment pipelines, or app-native workflow tools are the better owner. | What should be automated operationally? |
| ARM and Bicep | Azure-native infrastructure as code and deployment model. | You need repeatable Azure resource deployments with reviewable templates. | The organization has standardized on another infrastructure-as-code tool. | How is infrastructure declared? |
| Azure DevOps / GitHub Actions | Build, test, and deployment automation platforms. | You need CI/CD pipelines, environment promotion, approvals, and release automation. | Manual portal changes are acceptable only for learning or emergency exceptions. | How do changes reach environments? |
| Microsoft Cost Management | Cost analysis, budgets, alerts, and chargeback/showback visibility. | Teams need cost visibility, budgets, and ownership signals. | You expect tooling to replace workload-level cost design. | Who owns the spend? |
| Azure Advisor | Recommendations for reliability, security, performance, operational excellence, and cost. | You need platform recommendations and optimization prompts. | You treat recommendations as automatic architecture decisions without review. | What optimization opportunities are visible? |
Commonly Confused Services
| Comparison | Short Answer |
|---|---|
| Azure Monitor vs Application Insights | Azure Monitor is the broader observability platform; Application Insights focuses on application performance and tracing. |
| Application Insights vs Log Analytics | Application Insights collects app telemetry; Log Analytics is where logs can be queried and analyzed. |
| Backup vs Site Recovery | Backup restores data or workloads from recovery points; Site Recovery orchestrates disaster recovery and failover. |
| Cost Management vs Advisor | Cost Management shows spend and budgets; Advisor suggests optimizations across cost and other pillars. |
| Infrastructure as code vs CI/CD | Infrastructure as code declares resources; CI/CD pipelines test, approve, and deploy changes. |
Architecture Patterns
Operational services often appear in patterns such as:
Health endpoint monitoring with Azure Monitor alerts and dashboards.
Distributed tracing with Application Insights.
Centralized log investigation with Log Analytics workspaces.
Backup and restore plans with Azure Backup.
Disaster recovery runbooks and failover with Site Recovery.
Repeatable deployment with Bicep, ARM, Terraform, Azure DevOps, or GitHub Actions.
Cost ownership with budgets, tags, alerts, and workload-level reporting.
Optimization review using Advisor and Well-Architected guidance.
Cost Is an Architecture Signal
Cost is not only a finance report. It reveals architecture behavior: overprovisioned compute, chatty systems, unbounded logging, inefficient queries, forgotten environments, expensive data movement, or missing lifecycle policies.
Cost Management can show the spend, but teams still need ownership. Tags, subscriptions, resource groups, budgets, and alerts only help when someone is responsible for acting on them.
Cloud Comparison
Every major cloud has monitoring, logging, backup, infrastructure as code, deployment, advisory, and cost-management tools. The Azure-specific design question is how these services are scoped and owned across management groups, subscriptions, resource groups, workspaces, application teams, and platform teams.
Common Mistakes
Adding monitoring after production instead of designing it into the architecture.
Logging without correlation IDs, ownership, or alert paths.
Treating backup as the same thing as disaster recovery.
Reviewing cost only after a bill surprise.
Keeping manual portal changes as the normal deployment method.
Sending high-volume logs to a workspace without retention, access, and cost controls.
Treating Advisor recommendations as automatic fixes without workload context.
If Someone Asks You
Which Azure services help operate and control workloads?
A good answer is:
Azure Monitor, Application Insights, and Log Analytics make workloads observable. Azure Backup and Site Recovery support restore and disaster recovery responsibilities. Azure Automation, ARM, Bicep, Azure DevOps, and GitHub Actions make operations and deployment repeatable. Microsoft Cost Management and Azure Advisor make spend and optimization visible. The architecture still needs owners, alerts, runbooks, and cost accountability.
What You Should Remember
Operable architecture is observable, recoverable, repeatable, and cost-owned.
Questions to Check Understanding
How do Azure Monitor and Application Insights relate?
Why is backup not the same as disaster recovery?
Why should cost ownership be part of architecture design?