banshee/cloud-collection/cloud/azure/https/metrics

One Azure Monitor metric

Returns the newest value of one metric of one Azure resource over the last thirty minutes, in the aggregation chosen, and how old that value is, read from Azure Monitor with a service principal that may only read. The generic form: any resource and any of its platform metrics, both set on the probe (the CPU of a virtual machine, the DTU of a SQL database, the requests of an App Service). Three watches are offered, each one set on the probe.

Versions

Generic: Azure Monitor is one service, the same for every resource. The collector asks for the API version 2023-10-01 of Microsoft.Insights metrics.

How it works

POST https://login.microsoftonline.com/<azure:tenant>/oauth2/v2.0/token, the form grant_type=client_credentials&client_id=…&client_secret=…&scope=https://management.azure.com/.default: an access token, kept thirty minutes in the probe's cache, encrypted on the poller. A token Azure no longer takes answers 401, and the collector logs in again, once.
GET https://management.azure.com<azure:resource>/providers/Microsoft.Insights/metrics?api-version=2023-10-01&metricnames=<azure:metric>&aggregation=<azure:aggregation>&timespan=<now − 30 min>/<now>&interval=PT1M&AutoAdjustTimegrain=true, with metricnamespace=<azure:metric-namespace> when it is set, the token as Authorization: Bearer.

{"value": [{"name": {"value": "Percentage CPU"}, "unit": "Percent", "errorCode": "Success", "timeseries": [{"data": [{"timeStamp": "2026-10-27T08:04:00Z", "average": 12.5}, {"timeStamp": "2026-10-27T08:05:00Z"}]}]}]}

value is the aggregation of the newest minute that carries it: the last minute is often not yet computed, and comes without it. AutoAdjustTimegrain=true lets a metric whose finest grain is above a minute answer in its own grain instead of refusing.
age is the time from the start of that minute to now, in minutes, against the poller's clock: a value that stops coming in shows by its age.
The timespan is written in UTC from the poller's clock, 2026-10-27T07:35:00Z/2026-10-27T08:05:00Z.
A metric that the answer marks with an errorCode other than Success (an aggregation the metric does not support) stops the collector misconfigured, with Azure's message; no value of the metric in the thirty minutes stops it unreachable.
A resource ID that does not start with /subscriptions/ stops the collector misconfigured before anything leaves. A code 400 or 401 on the login stops it misconfigured (the tenant, the client or its secret refused); a code 403 on the metric (the role missing), 400 or 404 (the resource, the metric or its namespace unknown) too; any other code but 200 stops it unreachable.

The client secret comes from protocol:http:password, a secret variable: it goes in the body of the login only, to https:// only. The token is a secret too, kept in the cache and sent in a header. The metric is not secret.

Prerequisites

A service principal: an app registration in Microsoft Entra ID with a client secret. Its application (client) ID goes in protocol:http:user, its secret in protocol:http:password, its tenant in the variable azure:tenant.
The role Reader given to it on the resource, its resource group or its subscription: */read and nothing else, which reads the metrics (Microsoft.Insights/metrics/read). Monitoring Reader reads them too, but also creates support tickets; Reader is the narrower. With Azure CLI: az role assignment create --assignee <client id> --role Reader --scope <resource ID>.
The poller reaches login.microsoftonline.com and management.azure.com in HTTPS. Their certificates are issued by public authorities: the profile "Standard" trusts them.
The name of the metric and the aggregations it supports are in Microsoft's list "Supported metrics with Azure Monitor", by type of resource.

Variables

Name	Label	Says	Default
`azure:tenant`	Tenant	the directory (tenant) ID of the service principal, or one of its domains	—
`azure:resource`	Resource ID	the full ID of the resource, `/subscriptions/…/resourceGroups/…/providers/…`	—
`azure:metric`	Metric	the name of the metric, `Percentage CPU`	—
`azure:aggregation`	Aggregation	`average`, `minimum`, `maximum`, `total` or `count`	`average`
`azure:metric-namespace`	Metric namespace	the namespace, only when it is not the resource's own; optional	—

Outputs

Name	Label	Unit	Per instance
`value`	Value	that of the metric, which Azure gives with the answer and the collector does not declare	no
`age`	Age of the value	min	no

Watches

Name	Title	Kind	Defaults	Checked by default
`high`	Value too high	above a threshold, on `value`	no threshold: it raises nothing until thresholds are set on the probe	yes
`low`	Value too low	below a threshold, on `value`	no threshold	no
`stale`	Value not fresh	above a threshold, on `age`	warning above 15 min	yes

Limits

One metric of one resource per probe, without dimensions: a metric split by dimension (the requests of each instance) is read as its total.
The unit of the value is the metric's own (Percent, Bytes, CountPerSecond); the screen shows none.
Not checked against an Azure subscription: the route, parameters and fields are those of the Azure REST API reference (learn.microsoft.com: "Metrics - List" in 2023-10-01, and the definitions of Response, Metric, TimeSeriesElement, MetricValue) and of the Microsoft identity platform ("OAuth 2.0 client credentials flow"); the reference does not say whether a minute not yet computed comes without its aggregation or with null, and the collector takes both. The roles are those of "Azure built-in roles" (General, Monitor).