BrainyBeeBrainyBee
ExploreBlogStart Studying
HomeMicrosoft Azure Administrator (AZ-104)Lab — Find out what you can and cannot see about yesterday
Build Lab196 words

Lab — Find out what you can and cannot see about yesterday

AZ-104 › Unit 5 › Lab

Lab — Find out what you can and cannot see about yesterday

Lab brief

Node
AZ104-U5.T1
Time
25 minutes
Creates
A resource group, a diagnostic setting, an alert rule and an action group
Subscription
required
Difficulty
Core

The claim to make physical: turning collection on today tells you nothing about yesterday. This is the single most common wrong answer in Unit 5 and it takes ten minutes to become permanent knowledge.

These commands have not been run

There is no Azure subscription in the environment this lab was written in, so not one of these commands has been executed. The syntax is derived from Microsoft's own CLI documentation, and the elements this lab asserts are quoted from it at the bottom of the page — but the specific invocations, with these names in this order, are unrun. Read each command before you run it, and expect to adjust names and regions. Treat the teardown as part of the lab, not an optional extra.

Before you start

A subscription and any existing resource with no diagnostic setting on it — a resource group is enough for the activity-log half. A Log Analytics workspace is optional and the free ingestion allowance covers this lab's volume; skip it if you would rather not create one.

Walkthrough

Find out what you can and cannot see about yesterday

  1. 1

    1. Read the activity log for something you did last week

    Query the activity log for an operation from several days ago. It is there. The activity log is automatically collected without configuration — you never turned it on.

Did it teach you what it was meant to?

Multiple choice · HardRetroactive collection

An incident happened last Tuesday on a resource that has never had a diagnostic setting. What can you actually investigate?

Multiple choice · MediumAlert objects

An alert rule is firing hourly and the on-call engineer wants it quiet tonight without losing the detection. Which object?

What goes wrong

What goes wrong

Creating a diagnostic setting before its destination exists, which fails rather than provisioning one. Expecting one setting to cover a subscription. Expecting one rule across many resources to raise one alert. And trying to tidy up alerts that already fired — configuration changes reach only future ones.

Tear it down

Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.

Teardown

  1. 1

    Delete the rule, the action group, the setting, then the group

    Delete in that order, because the rule references the action group. If you created a Log Analytics workspace, delete it too — an idle workspace ingests nothing, but leaving one is how a free lab becomes a line on a bill.

Where these figures come from

Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.

Documentsha1
Diagnostic settings in Azure Monitor123baaa50c7f
What are Azure Monitor alerts?7080cb554190
All Microsoft Azure Administrator (AZ-104) Study Resources

Related Notes

  • AZ-104 exam map391 words
  • Unit 1 roadmap — Manage Azure identities and governance358 words
  • Unit 1 capstone — Onboarding an acquired subsidiary810 words
  • Lab — A budget notifies and stops nothing166 words
  • Lab — Prove that inheritance only flows one way212 words
  • Lab — Tags do not inherit, and a lock is not a permission204 words
  • Lab — Watch a dynamic group fill itself in183 words
  • Cram sheet — Manage access to Azure resources447 words
  • Cram sheet — Manage Azure subscriptions and governance841 words
  • Cram sheet — Manage Microsoft Entra users and groups580 words
  • Unit 2 roadmap — Implement and manage storage375 words
  • Unit 2 capstone — A media archive on a budget808 words

Ready to study Microsoft Azure Administrator (AZ-104)?

Practice tests, flashcards, and all study notes — free, no sign-up.

Start Studying

Ready to study Microsoft Azure Administrator (AZ-104)?

Practice tests, flashcards, and all study notes — free, no sign-up needed.

Start Studying — Free
Microsoft Azure Administrator (AZ-104) ResourcesExplore All HivesBlogHome

© 2026 BrainyBee. Free AI-powered exam prep.