What you need to know
What should a PromQL expression return when its alert threshold will be learned dynamically?
Potentially affected
Azure Monitor query-based metric alerts using preview dynamic thresholds with PromQL expressions.
DSE recommendation
Review the expression's output contract before selecting dynamic sensitivity or investigating alert noise.
Source facts
Dynamic thresholds for Azure Monitor query-based metric alerts are preview functionality. They evaluate PromQL expressions against managed Prometheus or OTel metrics in an Azure Monitor workspace. Microsoft advises returning numeric measurements rather than Boolean comparisons: calculate CPU usage instead of embedding a CPU threshold comparison in the expression. The configured condition is met when the expression’s value crosses the dynamically calculated threshold. Microsoft Learn.
Applicability
This concerns the input contract of a preview query-based metric alert, not a promise that any particular anomaly will be detected. Start with the measurement the operator actually needs to distinguish.
DSE recommendation
Review the expression’s output contract before selecting dynamic sensitivity or investigating alert noise. Ask the rule owner to explain the units, aggregation and intended meaning of each returned series. Keep the measured quantity separate from the decision boundary. When adapting a query used elsewhere as a fixed pass/fail check, explicitly reconsider that comparison rather than copying it unchanged into the dynamic rule.
Verification
Run the proposed expression over a representative approved time range and inspect its numerical results. Compare the preview chart with those same measurements and identify where the dynamic bounds sit relative to them. Document any intentional differences from the previous fixed-threshold rule. Treat a readable preview as validation of the query’s intended input, not as evidence that future incidents are covered or that production notification paths were tested.
Official references
Microsoft Learn: Dynamic alert thresholds. Source reviewed September 9, 2026.
Review the official source
Create a Log Search alert rule with dynamic threshold - Azure Monitor | Microsoft Learn · Verified September 9, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE