{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
        "slug": "dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/"
        },
        "title": "Rebuild resource grouping and authorization when moving metric queries to getBatch",
        "summary": "Why can individually working Azure metric queries fail after they are combined into a batch?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:22:51+00:00",
        "modified_at": "2026-09-10T02:11:19+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 251,
        "potentially_affected": "Azure Monitor clients migrating standard metric queries to metrics:getBatch.",
        "dse_recommendation": "Group compatible resources and verify subscription-level monitoring permission before converting the client request.",
        "primary_source": {
            "name": "Migrate from the metrics API to the getBatch API - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Azure Monitor&#8217;s metrics:getBatch query accepts at most fifty distinct resource IDs, all sharing a subscription, region and resource type. It uses a subscription-level POST to a regional metrics endpoint; resource IDs move into the request body. The body property resourceids must be lowercase. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>Unlike individual metric queries, this API requires Monitoring Reader on the queried subscription. Having that role on every requested resource is insufficient. Custom metrics and namespaces that are not resource types are unsupported. Each returned resource&#8217;s metric list includes its resourceid for identification. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this migration check for Azure Monitor clients moving standard metric queries to metrics:getBatch. Do not include guest metrics merely because the same client can retrieve them through another API.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends building the grouping plan from actual resource inventory before changing the request loop. Review whether subscription-level monitoring access is appropriate for the caller; do not silently expand privileges to make a migration pass. Preserve separate query paths for unsupported namespaces. Update response handling to associate results with explicit resource IDs instead of assuming a single-resource response.</p>\n<h2>Verification</h2>\n<p>Compare a small approved batch with individual queries over the same time window, metrics and dimensions. Confirm every requested resource is accounted for and verify the caller&#8217;s real permission scope. Exercise an intentionally incompatible grouping in a test path to confirm the client reports the failure clearly rather than presenting an empty dashboard as success.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Migrate to the metrics getBatch API</a>.</p>",
        "content_text": "Source facts\nAzure Monitor’s metrics:getBatch query accepts at most fifty distinct resource IDs, all sharing a subscription, region and resource type. It uses a subscription-level POST to a regional metrics endpoint; resource IDs move into the request body. The body property resourceids must be lowercase. Microsoft Learn.\nUnlike individual metric queries, this API requires Monitoring Reader on the queried subscription. Having that role on every requested resource is insufficient. Custom metrics and namespaces that are not resource types are unsupported. Each returned resource’s metric list includes its resourceid for identification. Microsoft Learn.\nApplicability\nUse this migration check for Azure Monitor clients moving standard metric queries to metrics:getBatch. Do not include guest metrics merely because the same client can retrieve them through another API.\nDSE recommendation\nDSE recommends building the grouping plan from actual resource inventory before changing the request loop. Review whether subscription-level monitoring access is appropriate for the caller; do not silently expand privileges to make a migration pass. Preserve separate query paths for unsupported namespaces. Update response handling to associate results with explicit resource IDs instead of assuming a single-resource response.\nVerification\nCompare a small approved batch with individual queries over the same time window, metrics and dimensions. Confirm every requested resource is accounted for and verify the caller’s real permission scope. Exercise an intentionally incompatible grouping in a test path to confirm the client reports the failure clearly rather than presenting an empty dashboard as success.\nOfficial references\nMicrosoft Learn: Migrate to the metrics getBatch API.",
        "content_markdown": "## Source facts\n\nAzure Monitor’s metrics:getBatch query accepts at most fifty distinct resource IDs, all sharing a subscription, region and resource type. It uses a subscription-level POST to a regional metrics endpoint; resource IDs move into the request body. The body property resourceids must be lowercase. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api).\n\nUnlike individual metric queries, this API requires Monitoring Reader on the queried subscription. Having that role on every requested resource is insufficient. Custom metrics and namespaces that are not resource types are unsupported. Each returned resource’s metric list includes its resourceid for identification. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api).\n\n## Applicability\n\nUse this migration check for Azure Monitor clients moving standard metric queries to metrics:getBatch. Do not include guest metrics merely because the same client can retrieve them through another API.\n\n## DSE recommendation\n\nDSE recommends building the grouping plan from actual resource inventory before changing the request loop. Review whether subscription-level monitoring access is appropriate for the caller; do not silently expand privileges to make a migration pass. Preserve separate query paths for unsupported namespaces. Update response handling to associate results with explicit resource IDs instead of assuming a single-resource response.\n\n## Verification\n\nCompare a small approved batch with individual queries over the same time window, metrics and dimensions. Confirm every requested resource is accounted for and verify the caller’s real permission scope. Exercise an intentionally incompatible grouping in a test path to confirm the client reports the failure clearly rather than presenting an empty dashboard as success.\n\n## Official references\n\n[Microsoft Learn: Migrate to the metrics getBatch API](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Rebuild resource grouping and authorization when moving metric queries to getBatch",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/",
                "headline": "Rebuild resource grouping and authorization when moving metric queries to getBatch",
                "description": "Why can individually working Azure metric queries fail after they are combined into a batch?",
                "abstract": "Why can individually working Azure metric queries fail after they are combined into a batch?",
                "articleBody": "Source facts\nAzure Monitor’s metrics:getBatch query accepts at most fifty distinct resource IDs, all sharing a subscription, region and resource type. It uses a subscription-level POST to a regional metrics endpoint; resource IDs move into the request body. The body property resourceids must be lowercase. Microsoft Learn.\nUnlike individual metric queries, this API requires Monitoring Reader on the queried subscription. Having that role on every requested resource is insufficient. Custom metrics and namespaces that are not resource types are unsupported. Each returned resource’s metric list includes its resourceid for identification. Microsoft Learn.\nApplicability\nUse this migration check for Azure Monitor clients moving standard metric queries to metrics:getBatch. Do not include guest metrics merely because the same client can retrieve them through another API.\nDSE recommendation\nDSE recommends building the grouping plan from actual resource inventory before changing the request loop. Review whether subscription-level monitoring access is appropriate for the caller; do not silently expand privileges to make a migration pass. Preserve separate query paths for unsupported namespaces. Update response handling to associate results with explicit resource IDs instead of assuming a single-resource response.\nVerification\nCompare a small approved batch with individual queries over the same time window, metrics and dimensions. Confirm every requested resource is accounted for and verify the caller’s real permission scope. Exercise an intentionally incompatible grouping in a test path to confirm the client reports the failure clearly rather than presenting an empty dashboard as success.\nOfficial references\nMicrosoft Learn: Migrate to the metrics getBatch API.",
                "datePublished": "2026-09-10T00:22:51+00:00",
                "dateModified": "2026-09-10T02:11:19+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-545-rebuild-resource-grouping-and-authorization-when-moving-metric-queries-to-getbatch/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Rebuild resource grouping and authorization when moving metric queries to getBatch"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 251,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Migrate from the metrics API to the getBatch API - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/migrate-to-batch-api"
                }
            }
        ]
    }
}