# Read an Azure metric average with its missing measurements in view

> How does a NULL measurement change an Azure Monitor metric average compared with a recorded zero?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-120-read-an-azure-metric-average-with-its-missing-measurements-in-view/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:56+00:00
- Modified: 2026-09-10T00:52:38+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Explainer
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

How does a NULL measurement change an Azure Monitor metric average compared with a recorded zero?

## Potentially affected

Azure Monitor platform and custom metrics, including standard Application Insights metrics.

## DSE recommendation

Compare the valid measurement count and provider's missing-data behavior before interpreting a changed average.

## Article

## Source facts

Azure Monitor does not count NULL values as valid metric measurements. An average containing missing measurements therefore uses fewer inputs; it does not silently substitute zero for them. Custom metrics use NULL when data is absent, while each platform resource provider chooses whether its metric records NULL or zero. Alerts consume the values written by that provider. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-aggregation-explained).

Count measures the number of observations rather than their magnitudes. For most metrics, Average is calculated from Sum divided by Count. Line charts can represent NULL intervals with dotted or dashed segments. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-aggregation-explained).

## Applicability

Use this interpretation for Azure Monitor platform and custom metrics, including standard Application Insights metrics. Identify the exact metric and provider before deciding what an empty interval means.

## DSE recommendation

DSE recommends reviewing the available measurement count alongside the average when a reporting source disappears. Keep the selected dimensions and interval consistent during the comparison. Ask whether the apparent improvement reflects the same population of observations or fewer participating measurements. Document the provider’s actual missing-data behavior before adopting an alert threshold based on the displayed average.

## Verification

Compare a controlled interval with complete reporting against one with a known collection gap. Reconcile available Sum, Count and Average values where the metric supports those aggregations. Confirm how the chart renders the gap and how the chosen alert treats the written values. Preserve that example so a later dashed segment is not casually described as a measured zero.

## Official references

[Microsoft Learn: Metrics aggregation and display](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-aggregation-explained).

## Primary reference

- Name: Azure Monitor metrics aggregation and display explained - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/metrics-aggregation-explained
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Read an Azure metric average with its missing measurements in view,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-120-read-an-azure-metric-average-with-its-missing-measurements-in-view/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.