metrics

One Azure Monitor metric

Returns the newest value of one metric of one Azure resource over the last thirty minutes, in the aggregation chosen, and how old that value is, read from Azure Monitor with a service principal that may only read. The generic form: any resource and any of its platform metrics, both set on the probe (the CPU of a virtual machine, the DTU of a SQL database, the requests of an App Service). Three watches are offered, each one set on the probe.

Versions

Generic: Azure Monitor is one service, the same for every resource. The collector asks for the API version 2023-10-01 of Microsoft.Insights metrics.

How it works

1. POST https://login.microsoftonline.com/<azure:tenant>/oauth2/v2.0/token, the form grant_type=client_credentials&client_id=…&client_secret=…&scope=https://management.azure.com/.default: an access token, kept thirty minutes in the probe's cache, encrypted on the poller. A token Azure no longer takes answers 401, and the collector logs in again, once.
2. GET https://management.azure.com<azure:resource>/providers/Microsoft.Insights/metrics?api-version=2023-10-01&metricnames=<azure:metric>&aggregation=<azure:aggregation>&timespan=<now − 30 min>/<now>&interval=PT1M&AutoAdjustTimegrain=true, with metricnamespace=<azure:metric-namespace> when it is set, the token as Authorization: Bearer.

{"value": [{"name": {"value": "Percentage CPU"}, "unit": "Percent", "errorCode": "Success", "timeseries": [{"data": [{"timeStamp": "2026-10-27T08:04:00Z", "average": 12.5}, {"timeStamp": "2026-10-27T08:05:00Z"}]}]}]}

• value is the aggregation of the newest minute that carries it: the last minute is often not yet computed, and comes without it. AutoAdjustTimegrain=true lets a metric whose finest grain is above a minute answer in its own grain instead of refusing.
• age is the time from the start of that minute to now, in minutes, against the poller's clock: a value that stops coming in shows by its age.
• The timespan is written in UTC from the poller's clock, 2026-10-27T07:35:00Z/2026-10-27T08:05:00Z.
• A metric that the answer marks with an errorCode other than Success (an aggregation the metric does not support) stops the collector misconfigured, with Azure's message; no value of the metric in the thirty minutes stops it unreachable.
• A resource ID that does not start with /subscriptions/ stops the collector misconfigured before anything leaves. A code 400 or 401 on the login stops it misconfigured (the tenant, the client or its secret refused); a code 403 on the metric (the role missing), 400 or 404 (the resource, the metric or its namespace unknown) too; any other code but 200 stops it unreachable.

The client secret comes from protocol:http:password, a secret variable: it goes in the body of the login only, to https:// only. The token is a secret too, kept in the cache and sent in a header. The metric is not secret.

Prerequisites

• A service principal: an app registration in Microsoft Entra ID with a client secret. Its application (client) ID goes in protocol:http:user, its secret in protocol:http:password, its tenant in the variable azure:tenant.
• The role Reader given to it on the resource, its resource group or its subscription: */read and nothing else, which reads the metrics (Microsoft.Insights/metrics/read). Monitoring Reader reads them too, but also creates support tickets; Reader is the narrower. With Azure CLI: az role assignment create --assignee <client id> --role Reader --scope <resource ID>.
• The poller reaches login.microsoftonline.com and management.azure.com in HTTPS. Their certificates are issued by public authorities: the profile "Standard" trusts them.
• The name of the metric and the aggregations it supports are in Microsoft's list "Supported metrics with Azure Monitor", by type of resource.

Variables

Outputs

Watches

Limits

• One metric of one resource per probe, without dimensions: a metric split by dimension (the requests of each instance) is read as its total.
• The unit of the value is the metric's own (Percent, Bytes, CountPerSecond); the screen shows none.
• Not checked against an Azure subscription: the route, parameters and fields are those of the Azure REST API reference (learn.microsoft.com: "Metrics - List" in 2023-10-01, and the definitions of Response, Metric, TimeSeriesElement, MetricValue) and of the Microsoft identity platform ("OAuth 2.0 client credentials flow"); the reference does not say whether a minute not yet computed comes without its aggregation or with null, and the collector takes both. The roles are those of "Azure built-in roles" (General, Monitor).