# Separate autoscale condition evaluations from completed scaling actions

> Use both autoscale log categories to explain a capacity change.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-057-separate-autoscale-condition-evaluations-from-completed-scaling-actions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:03+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Use both autoscale log categories to explain a capacity change.

## Potentially affected

Use this review when investigating an expected capacity change. Identify the autoscale setting, rule, target resource and observation interval. Keep a rule evaluation, an initiated action and the resulting resource state as separate items in the investigation timeline.

## DSE recommendation

DSE recommends designing the incident worksheet to capture both log categories and the corresponding capacity observation.

## Article

## Source facts

Microsoft distinguishes Autoscale Evaluations logs from Autoscale Scale Actions logs. Evaluation entries describe observed metrics, evaluated rules and whether an action was triggered. Scale-action entries describe actions initiated by the service and their results, including success, failure and the amount of scaling observed. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-troubleshoot).

## Applicability

Use this review when investigating an expected capacity change. Identify the autoscale setting, rule, target resource and observation interval. Keep a rule evaluation, an initiated action and the resulting resource state as separate items in the investigation timeline.

## DSE recommendation

DSE recommends designing the incident worksheet to capture both log categories and the corresponding capacity observation. Start from the expected rule evaluation, then trace any resulting action to its outcome. Avoid closing the issue merely because an evaluation mentions a trigger. Agree with the service owner how resource readiness will be checked after a capacity change.

## Verification

For an approved scaling exercise, correlate evaluation time, action result and observed capacity. Confirm that the intended instances become usable for the application through a separate service check. Record unsuccessful or absent action outcomes explicitly and follow the matching diagnostic branch. Preserve the relevant identifiers and timestamps so another operator can reconstruct the chain.

## Official references

[Microsoft Learn: Troubleshoot Azure Monitor autoscale](https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-troubleshoot).

## Primary reference

- Name: Troubleshoot Azure Monitor autoscale - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-troubleshoot
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate autoscale condition evaluations from completed scaling actions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-057-separate-autoscale-condition-evaluations-from-completed-scaling-actions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.