Azure Advisor vs Azure Monitor

A few years ago, I joined a call with a retail company in Ohio. Their checkout API had slowed down every Friday evening for a month. Nobody had alerts set up, and the monthly Azure bill had jumped 30 percent. Half the team said, “Check Azure Advisor.” The other half said, “Open Azure Monitor.” They were both right, and they had never worked out how the two services fit together.

The confusion is common. Azure Advisor vs Azure Monitor comes up in almost every Azure review I run. Both show recommendations, charts, and warnings in the portal, so they look alike. They solve different problems. Advisor tells you what to change in your setup. Monitor tells you what your workloads are doing right now.

By the end, you will know what each service does and where each one stops. You will also be able to wire both into an Azure architecture with alerts, scripts, and Bicep.

Azure Advisor vs Azure Monitor: The Core Difference

Azure Advisor is a free, personalized recommendation engine. It scans your deployed resources and suggests changes across five categories: cost, security, reliability, operational excellence, and performance. You can read more about the service in this Azure Advisor overview.

Azure Monitor is the platform for collecting, storing, analyzing, and alerting on telemetry. Telemetry means the metrics, logs, and traces your resources produce. It answers questions like “Is my API slow right now?” and “Who deleted that resource?” For a deeper tour, see what Azure Monitor does.

Here is the shortest version I give to clients. Advisor reviews your design and configuration. Monitor watches your running behavior.

The cost row matters in planning. Advisor itself has no charge. Azure Monitor has a free tier of platform metrics, but Log Analytics ingestion and retention are billed by volume. I always flag this early, because a chatty diagnostic setting can quietly become a line item.

Pro Tip: In my experience, teams that treat Advisor as a “monitoring tool” end up with no alerts at all. Advisor never pages anyone about an outage. Write that down in your runbook on day one.

How Azure Advisor Works in Real Projects

Advisor analyzes your resource configuration and usage telemetry. It then ranks recommendations by impact. Each recommendation belongs to a subscription, which is the billing and governance boundary for your resources. Recommendations roll up to resource level, so you can see exactly which VM, disk, or database triggered a suggestion.

What Each Category Covers

• Cost: Flags idle or underused virtual machines, unattached disks, and opportunities to use reservations or savings plans.
• Security: Surfaces findings tied to Microsoft Defender for Cloud, such as missing endpoint protection or open management ports.
• Reliability: Points out gaps like single-instance VMs without availability protection or missing backups.
• Operational excellence: Suggests process and deployment improvements, such as using tags or policy.
• Performance: Highlights bottlenecks, such as database tiers that are under pressure.

Real Example: Cleaning Up Waste

On one project, a healthcare IT team had about 40 virtual machines left over from a finished migration. Advisor’s cost tab showed that many ran under 5 percent CPU for weeks. We used that list to decide which to shut down and which to resize. Learn the resize workflow in az vm resize. We also found orphaned disks, and this guide on finding unattached disks in Azure shows how to hunt them down.

Advisor also points you to commitment discounts. Compare options in Azure savings plan before committing. A commitment locks in spend, so right-size first and commit second.

Listing Recommendations With Azure CLI

az advisor recommendation list \
  --category Cost \
  --output table

This command lists cost recommendations for your current subscription in a readable table.

• --category Cost filters to one of the five categories. Other values include Security, HighAvailability, OperationalExcellence, and Performance.
• --output table makes the result easy to scan during a review meeting.

You can also run it with PowerShell:

$SubscriptionId = "<subscription-id>"
Set-AzContext -SubscriptionId $SubscriptionId
Get-AzAdvisorRecommendation -Category Cost |
Select-Object Category, Impact, ShortDescription

Set-AzContext makes sure you scan the right subscription. Get-AzAdvisorRecommendation pulls the list, and Select-Object keeps only the columns you need. The Az.Advisor module must be installed first.

Pro Tip: I schedule a 30-minute Advisor review every month and attach it to our change calendar. Recommendations sit forever if nobody owns them, so I assign each one to a named person with a due date.

How Azure Monitor Works in Real Projects

Azure Monitor is a platform, not a single tool. It collects metrics, which are numeric values sampled over time, like CPU percentage. It also collects logs, which are structured events stored in a Log Analytics workspace. A workspace is a data store you query with Kusto Query Language (KQL).

The main parts are listed here. For a wider survey, read Azure monitoring tools.

• Platform metrics: Collected automatically for most Azure resources at no extra charge.
• Diagnostic settings: The routing rule that sends resource logs to a workspace, storage account, or event hub.
• Activity log: A record of control-plane operations, such as who created or deleted a resource.
• Alerts and action groups: Rules that trigger email, SMS, webhooks, or automation.
• Application Insights: Application-level performance monitoring for requests, dependencies, and exceptions.
• Workbooks and dashboards: Visual reports built from your data.

Why Application Insights Matters

Infrastructure metrics tell you a VM is busy. They do not tell you which API call is slow. Application Insights traces requests down to the dependency, such as a SQL query or an external API call. Start with this Application Insights tutorial. If you run serverless code, enabling Application Insights for Azure Functions is the first step I take on any new function app.

Create a Workspace and Route Logs

The first step is a central workspace. Putting it in a dedicated resource group, a logical container for related resources, keeps it from being deleted with an app.

az group create \
  --name rg-monitoring-prod \
  --location eastus

az monitor log-analytics workspace create \
  --resource-group rg-monitoring-prod \
  --workspace-name log-platform-prod-eastus \
  --location eastus \
  --retention-time 90

The first command creates a resource group named rg-monitoring-prod in the East US region, a geographic location where Azure services run. The second creates a Log Analytics workspace in that group. The --retention-time 90 parameter keeps data for 90 days. Longer retention increases cost, so match it to your compliance needs.

Next, send a web app’s logs to the workspace:

az monitor diagnostic-settings create \
  --name diag-webapp-to-law \
  --resource <web-app-resource-id> \
  --workspace <workspace-resource-id> \
  --logs '[{"category":"AppServiceHTTPLogs","enabled":true}]' \
  --metrics '[{"category":"AllMetrics","enabled":true}]'

This creates a diagnostic setting called diag-webapp-to-law. The --resource value is the full ID of your app, and --workspace points to the workspace. The --logs and --metrics parameters choose what to send. Pick categories on purpose, because collecting everything raises ingestion cost.

Create a Metric Alert

az monitor metrics alert create \
  --name alert-vm-cpu-high \
  --resource-group rg-monitoring-prod \
  --scopes <vm-resource-id> \
  --condition "avg Percentage CPU > 85" \
  --window-size 15m \
  --evaluation-frequency 5m \
  --action <action-group-resource-id> \
  --severity 2

This alert fires when average CPU stays above 85 percent over a 15-minute window, checked every 5 minutes. The --action parameter links to an action group, which defines who gets notified. A 15-minute window avoids waking people for short spikes. For details on pulling numbers by script, see Get-AzMetric.

Pro Tip: I once got paged 40 times in one night because I set a 1-minute window on a batch server. Since then, I match the alert window to the workload pattern and test it before it goes to the on-call rotation.

Choosing Between Azure Advisor and Azure Monitor

Pick the tool by the question you are asking. I use this decision guide in architecture reviews.

Use Azure Advisor When You Need To

• Reduce Azure cost management waste before a budget review.
• Find reliability gaps before a go-live.
• Prioritize a security cleanup list.
• Prepare for an architecture review against Azure best practices.

Use Azure Monitor When You Need To

• Detect and respond to incidents as they happen.
• Investigate an outage after the fact with logs and traces.
• Track application performance and user-facing latency.
• Audit who changed what in the subscription.

Real Scenario: Slow Internal Portal

A manufacturing company ran an internal line-of-business app on Azure App Service, a managed web hosting platform. Users complained about slow pages each morning. Advisor suggested a higher App Service plan tier, which was a reasonable guess. Application Insights told the real story. A single SQL query took eight seconds at login, so the bigger plan would not have helped.

That example shows the trade-off clearly. Advisor gives you a starting hypothesis from patterns. Monitor gives you evidence from your own workload. I never approve a sizing change from an