# Expect batch-local totals from Azure Monitor pipeline aggregation

> Why can a pipeline aggregation emit more than one result for the same time bin?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-592-expect-batch-local-totals-from-azure-monitor-pipeline-aggregation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:04+00:00
- Modified: 2026-09-10T02:14:32+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Explainer
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

Why can a pipeline aggregation emit more than one result for the same time bin?

## Potentially affected

Azure Monitor pipeline dataflows that aggregate logs with summarize before cloud ingestion.

## DSE recommendation

Design downstream interpretation around batch-local aggregates rather than assuming one final record per time bin.

## Article

## Source facts

Azure Monitor pipeline aggregates each incoming batch; its default processing interval is one minute. A batch processor is required, and changing that interval is not available through the portal. Microsoft warns that aggregation adds up to five minutes of latency and that a query using bin() can produce multiple records for the same interval because ingestion is streaming and batched. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-transformations).

## Applicability

Review dataflows using summarize, their batch-processor configuration, and the queries consuming the resulting records. Keep the aggregation window separate from the time bins expressed in KQL. Establish what each exported value represents before treating repeated timestamps as duplicate source events.

## DSE recommendation

Design downstream interpretation around batch-local aggregates rather than assuming one final record per time bin. Have the query owner document how multiple partial results will be handled for the chosen calculation. Retain the original count or other necessary supporting fields in the proposed schema when the downstream calculation needs them. Review latency tolerance before using these aggregates for urgent decisions.

## Verification

Send a controlled set of records across more than one collection batch while keeping their event times inside one selected bin. Compare emitted aggregates with the known inputs and the downstream result. Check timing as well as arithmetic. Preserve the batch configuration, transformation, input set, and outputs so a later interval change can be assessed without assuming that matching bin labels imply a single completed total.

## Official references

[Microsoft Learn: Azure Monitor pipeline transformations](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-transformations). Source reviewed September 9, 2026.

## Primary reference

- Name: Configure Azure Monitor pipeline transformations - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/pipeline-transformations
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Expect batch-local totals from Azure Monitor pipeline aggregation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-592-expect-batch-local-totals-from-azure-monitor-pipeline-aggregation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.