# Separate independent monitoring consumers before sharing an Event Hubs export

> What should be checked before two downstream tools consume the same Azure Monitor export?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-423-separate-independent-monitoring-consumers-before-sharing-an-event-hubs-export/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:53+00:00
- Modified: 2026-09-10T02:04:57+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Checklist
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

What should be checked before two downstream tools consume the same Azure Monitor export?

## Potentially affected

Azure Monitor platform-log or metric streams sent through Event Hubs to downstream monitoring tools.

## DSE recommendation

Approve the consumer-group arrangement, partition compatibility and recoverable interruption window with each tool owner.

## Article

## Source facts

Microsoft’s Azure Monitor export guidance recommends the default Event Hubs consumer group unless separate tools need to consume the same data. Partitions permit parallel consumption, but the receiving tool may not support multiple partitions. The guidance recommends retaining messages for at least seven days so a stopped consumer can catch up within that retained period. Diagnostic settings provide a streaming path for platform logs and metrics. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/platform/stream-monitoring-data-event-hubs).

## Applicability

Review an existing or proposed Event Hubs destination and every independent monitoring tool reading it. Distinguish a second tool’s consumption requirement from scaling workers within one tool. Confirm each receiver’s documented partition behavior and the currently configured retention interval; the source’s recommendation is not evidence that either setting is present.

## DSE recommendation

Approve the consumer-group arrangement, partition compatibility and recoverable interruption window with each tool owner. Record which destination and stream categories each receiver expects. Before connecting another tool, agree how its ingestion will be checked separately from the first receiver. Match the outage-recovery plan to actual retained messages rather than treating the export as an indefinite archive. Avoid selecting partition counts from an example without checking receiver support.

## Verification

In a controlled test, send identifiable non-sensitive events and confirm their arrival in both intended tools. Pause and resume a test consumer within the approved retention window, then reconcile recovered events against the source interval. Inspect whether all configured partitions were consumed. Record missing data and receiver-specific errors independently; success in one tool does not establish complete ingestion in the other.

## Official references

[Microsoft Learn: Stream Azure monitoring data to an event hub and external partner](https://learn.microsoft.com/en-us/azure/azure-monitor/platform/stream-monitoring-data-event-hubs). Source reviewed September 9, 2026.

## Primary reference

- Name: Stream Azure monitoring data to an event hub and external partners - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/platform/stream-monitoring-data-event-hubs
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate independent monitoring consumers before sharing an Event Hubs export,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-423-separate-independent-monitoring-consumers-before-sharing-an-event-hubs-export/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.