{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "slug": "dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view", "url": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/" }, "title": "Check the any-tag cohort behind a managed-application metrics view", "summary": "Does listing several tags require a managed-application metric resource to match all of them?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:06+00:00", "modified_at": "2026-09-10T01:40:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 235, "potentially_affected": "Azure Managed Applications using a viewDefinition.json Metrics view.", "dse_recommendation": "DSE recommends comparing the resource-type constraint and each tag alternative with the intended monitoring population.", "primary_source": { "name": "Overview of view definition - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/concepts-view-definition", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A managed-application Metrics view can chart data from its resources through Azure Monitor Metrics. Within a metric definition, resourceType selects the resource type. The resourceTagFilter list uses OR matching and is applied after the resource-type filter; multiple listed tags do not express an all-tags condition. Microsoft Learn.

\n

Applicability

\n

Review this configuration when a chart appears to include a broader resource cohort than its owner intended. Write the intended resource membership down before interpreting the plotted metric. Keep the filter question separate from the chosen metric’s aggregation and the chart’s visual presentation.

\n

DSE recommendation

\n

DSE recommends comparing the resource-type constraint and each tag alternative with the intended monitoring population. If the intended requirement is a conjunction of tags, do not approve the existing list on that assumption. Reconsider the view design with the monitoring owner and document the expected membership. Avoid changing tags across production resources merely to force an unexplained chart into the expected shape.

\n

Verification

\n

Use a small approved set with the same resource type and distinguishable tag combinations, plus a resource of a different type. Compare which resources contribute under one tag and under the combined list. Keep the observed membership beside the view definition and explain any discrepancy before relying on the chart for an operational decision. Record actual results; the documented matching rule does not establish the state of a deployed view.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nA managed-application Metrics view can chart data from its resources through Azure Monitor Metrics. Within a metric definition, resourceType selects the resource type. The resourceTagFilter list uses OR matching and is applied after the resource-type filter; multiple listed tags do not express an all-tags condition. Microsoft Learn.\nApplicability\nReview this configuration when a chart appears to include a broader resource cohort than its owner intended. Write the intended resource membership down before interpreting the plotted metric. Keep the filter question separate from the chosen metric’s aggregation and the chart’s visual presentation.\nDSE recommendation\nDSE recommends comparing the resource-type constraint and each tag alternative with the intended monitoring population. If the intended requirement is a conjunction of tags, do not approve the existing list on that assumption. Reconsider the view design with the monitoring owner and document the expected membership. Avoid changing tags across production resources merely to force an unexplained chart into the expected shape.\nVerification\nUse a small approved set with the same resource type and distinguishable tag combinations, plus a resource of a different type. Compare which resources contribute under one tag and under the combined list. Keep the observed membership beside the view definition and explain any discrepancy before relying on the chart for an operational decision. Record actual results; the documented matching rule does not establish the state of a deployed view.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nA managed-application Metrics view can chart data from its resources through Azure Monitor Metrics. Within a metric definition, resourceType selects the resource type. The resourceTagFilter list uses OR matching and is applied after the resource-type filter; multiple listed tags do not express an all-tags condition. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/concepts-view-definition).\n\n## Applicability\n\nReview this configuration when a chart appears to include a broader resource cohort than its owner intended. Write the intended resource membership down before interpreting the plotted metric. Keep the filter question separate from the chosen metric’s aggregation and the chart’s visual presentation.\n\n## DSE recommendation\n\nDSE recommends comparing the resource-type constraint and each tag alternative with the intended monitoring population. If the intended requirement is a conjunction of tags, do not approve the existing list on that assumption. Reconsider the view design with the monitoring owner and document the expected membership. Avoid changing tags across production resources merely to force an unexplained chart into the expected shape.\n\n## Verification\n\nUse a small approved set with the same resource type and distinguishable tag combinations, plus a resource of a different type. Compare which resources contribute under one tag and under the combined list. Keep the observed membership beside the view definition and explain any discrepancy before relying on the chart for an operational decision. Record actual results; the documented matching rule does not establish the state of a deployed view.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/concepts-view-definition). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "url": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check the any-tag cohort behind a managed-application metrics view", "item": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "url": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/", "headline": "Check the any-tag cohort behind a managed-application metrics view", "description": "Does listing several tags require a managed-application metric resource to match all of them?", "abstract": "Does listing several tags require a managed-application metric resource to match all of them?", "articleBody": "Source facts\nA managed-application Metrics view can chart data from its resources through Azure Monitor Metrics. Within a metric definition, resourceType selects the resource type. The resourceTagFilter list uses OR matching and is applied after the resource-type filter; multiple listed tags do not express an all-tags condition. Microsoft Learn.\nApplicability\nReview this configuration when a chart appears to include a broader resource cohort than its owner intended. Write the intended resource membership down before interpreting the plotted metric. Keep the filter question separate from the chosen metric’s aggregation and the chart’s visual presentation.\nDSE recommendation\nDSE recommends comparing the resource-type constraint and each tag alternative with the intended monitoring population. If the intended requirement is a conjunction of tags, do not approve the existing list on that assumption. Reconsider the view design with the monitoring owner and document the expected membership. Avoid changing tags across production resources merely to force an unexplained chart into the expected shape.\nVerification\nUse a small approved set with the same resource type and distinguishable tag combinations, plus a resource of a different type. Compare which resources contribute under one tag and under the combined list. Keep the observed membership beside the view definition and explain any discrepancy before relying on the chart for an operational decision. Record actual results; the documented matching rule does not establish the state of a deployed view.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:06+00:00", "dateModified": "2026-09-10T01:40:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-350-check-the-any-tag-cohort-behind-a-managed-application-metrics-view/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check the any-tag cohort behind a managed-application metrics view" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 235, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Overview of view definition - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/concepts-view-definition" } } ] } }