Azure Monitor service limits

Article
08/16/2024

This article lists limits in different areas of Azure Monitor.

Alerts

Resource	Default limit	Maximum limit
Metric alerts (classic)	100 active alert rules per subscription. Classic alerts are retired for public cloud users. Classic alerts for Microsoft Azure operated by 21Vianet will retire on 29 February 2024.	Call support.
Metric alerts	5,000 active alert rules per subscription in Microsoft Azure operated by 21Vianet. If you're hitting this limit, explore if you can use the same type multi-resource alerts. 5,000 metric time-series per alert rule.	Call support.
Activity log alerts	100 active alert rules per subscription (can't be increased). As this limit can't be increased, consider sending your Activity Logs to a Log Analytics workspace and creating log search alerts instead, if you need a larger number of rules per subscription.	Same as default.
Log alerts	5,000 active alert rules per subscription. Out of which, 100 active alert rules with a 1-minute frequency. 1,000 active alert rules per resource. Each stateless alert rule can trigger up to 6,000 alerts per evaluation. Each stateful alert rule can trigger up to 300 alerts per evaluation. Up to 5,000 fired stateful alerts at a time. The combined size of all data in the log alert rule properties can't exceed 64 KB. The Kusto query results can't exceed more than 20 MB.	Call support.
Alert processing rules	1,000 active rules per subscription.	Call support.
Alert rules and alert processing rules description length	Log search alerts 4,096 characters. All others are 2,048 characters.	Same as default.

Alerts API

Azure Monitor alerts have several throttling limits to protect against users making an excessive number of calls. Such behavior can potentially overload the system back-end resources and jeopardize service responsiveness. The following limits are designed to protect customers from interruptions and ensure a consistent service level. The user throttling and limits are designed to affect only extreme usage scenarios. They shouldn't be relevant for typical usage.

Note

There is a limit of API calls per instance. The exact limit number depands on the number of instances.

Resource	Default limit	Maximum limit
Alerts - Get Summary	50 calls per minute per subscription	Same as default
Alerts - Get All (not "Get By ID")	100 calls per minute per subscription	Same as default
All other alerts calls	1,000 calls per minute per subscription	Same as default

Action groups

You can have an unlimited number of action groups in a subscription.

Resource	Default limit	Maximum limit
Email	1,000 email actions in an action group. No more than 100 emails every hour for each email address per region The character limit in an e-mail address is 64. The character limit in an e-mail is 55296. Also see the rate limiting information.	Same as Default
Email Azure Resource Manager role	10 Email ARM role actions per action group. In production: No more than 100 emails in an hour per region. In a test action group: No more than two emails in every one (1) minute.	Same as Default
Event Hubs	10 Event Hubs actions per action group.	Same as Default
Logic app	10 logic app actions in an action group.	Same as Default
Runbook	10 runbook actions in an action group.	Same as Default
Secure Webhook	10 secure webhook actions in an action group. Maximum number of webhook calls is 1500 per minute per subscription.	Same as Default
SMS	10 SMS actions in an action group. In production: No more than one SMS message every five minutes. In a test action group: No more than one SMS every one minute.	Same as Default
Webhook	10 webhook actions in an action group. Maximum number of webhook calls is 1500 per minute per subscription.	Same as Default

Autoscale

Resource	Default limit	Maximum limit
Autoscale settings	100 per region per subscription.	Same as default
Autoscale profiles	20 profiles per autoscale setting.	Same as default

Prometheus metrics

Ingestion

Azure managed Prometheus is a case insensitive system. It treats strings, such as metric names, label names, or label values, as the same time series if they differ from another time series only by the case of the string. For more information, see Prometheus metrics overview.

The following limits apply to the Azure Monitor workspace ingesting your Prometheus metrics.

Limit	Value
Active time series with metrics that have been reported in the last ~12 hours.	1,000,000 You can request an increase.
Events per minute ingested.	1,000,000 You can request an increase.

The following limits apply to the data collection rule (DCR) and data collection endpoint (DCE) sending Prometheus metrics data to your Azure Monitor workspace.

Limit	Value
Ingestion requests per minute to a data collection endpoint	15,000 This limit can't be increased.
Data ingestion per minute to a data collection endpoint	50 GB This limit can't be increased.

Queries

Prometheus queries are created by using PromQL and can be authored in either Azure Managed Grafana or self-managed Grafana.

Limit	Value
Data retention	18 months. This limit can't be increased.
Query time range	32 days between the start time and end time of your PromQL query. This limit can't be increased.
Query time series per metric	500,000 time series.
Query samples returned	50,000,000 samples per query.
Minimum query step size with time range >= 48 hours	60 seconds.

Query data limits
For client traffic:

Limit	Value
Throttling window lookup length	30 seconds
Data returned per Azure Monitor workspace	0.5 GB

For recording rules traffic:

Limit	Value
Throttling window lookup length	3 minutes
Data returned per Azure Monitor workspace	1 GB

Query pre-parsing limits
Based on query time range and request type, over a 30-second window (for client traffic):

Limit	Value
Query hours per user (Microsoft Entra ID, managed identity, Azure Managed Grafana workspace)	30,000
Query hours per Azure Monitor workspace	60,000
Query hours per Azure tenant	600,000

Based on query time range and request type, over a 3-minute window (for recording rules traffic):

Limit	Value
Query hours per Azure Monitor workspace	60,000
Query hours per Azure tenant	600,000

Query post-parsing limits
Based on query time range and range vectors in query over a 30-second window (for client traffic):

Limit	Value
Query hours per user (Microsoft Entra ID, managed identity, Azure Managed Grafana workspace)	2,000,000
Query hours per Azure Monitor workspace	2,000,000
Query hours per Azure tenant	20,000,000

Based on query time range and range vectors in query over a 3-minute window (for recording rules traffic):

Limit	Value
Query hours per Azure Monitor workspace	2,000,000
Query hours per Azure tenant	20,000,000

Query cost throttling limits

Limit	Value
Maximum query cost per query	15000
Maximum query cost for recording rules query	3000

Query cost calculation is done as follows:

Query Cost = (Number of time series requested * (queried time duration in seconds / Inferred time resolution of queried data)) / 5000

Inferred time resolution of queried data = Number of data points stored in any one randomly selected time series keys of queried metric / queried time duration in seconds

Alert and recording rules

Prometheus alert rules and recording rules are defined in PromQL. They're performed on the managed Ruler service as part of Azure Monitor managed service for Prometheus.

Limit	Value
Rule groups per Azure Monitor workspace, in an Azure subscription	500 You can request an increase.
Rules per rule group	20 This limit can't be increased.
Rule group evaluation interval	Between 1 minute - 24 hours. Default is 1 minute.
Active alerts	No limit at this time.

Remote write

Calculations were determined by using a remote batch size of 500, which is the default.

Limit	Value
CPU usage	0.25 x (number of metrics) + 1.25 x (average number of series per metric)
CPU request	0.75 x (CPU usage)
CPU limit	2 x (CPU request)
Memory request	150 Mb
Memory limit	200 Mb
Maximum throughput	Remote write container can process up to 150,000 unique time series. The container might throw errors serving requests over 150,000 because of the high number of concurrent connections. This issue can be mitigated by increasing the remote batch size from 500 to 1,000. This change reduces the number of open connections.

Logs Ingestion API

Limit	Value	Comments
Maximum size of API call	1 MB	Both compressed and uncompressed data.
Maximum size for field values	64 KB	Fields longer than 64 KB are truncated.
Maximum data/minute per DCR	2 GB	Both compressed and uncompressed data. Retry after the duration listed in the `Retry-After` header in the response.
Maximum requests/minute per DCR	12,000	Retry after the duration listed in the `Retry-After` header in the response.

Data collection rules

Limit	Value
Maximum number of data sources	10
Maximum number of counter specifiers in performance counter	100
Maximum number of facility names in Syslog	20
Maximum number of XPath queries in Event Log	100
Maximum number of data flows	10
Maximum number of data streams	10
Maximum number of extensions	10
Maximum size of extension settings	32 Kb
Maximum number of Log Analytics workspaces	10
Maximum number of characters in a transformation	15,360

Diagnostic settings

Resource	Default Limit	Maximum Limit
Maximum number of diagnostic settings per resource	5	Same as default.

Log queries and language

General query limits

Limit	Description
Query language	Azure Monitor uses the same Kusto Query Language (KQL) as Azure Data Explorer. See Azure Monitor log query language differences for KQL language elements not supported in Azure Monitor.
Azure regions	Log queries can experience excessive overhead when data spans Log Analytics workspaces in multiple Azure regions. See Query limits for details.
Cross resource queries	Maximum number of Application Insights resources and Log Analytics workspaces in a single query limited to 100. Cross-resource query isn't supported in View Designer. Cross-resource query in log alerts is supported in the new scheduledQueryRules API. See Cross-resource query limits for details.
Log Analytics dashboard queries	Maximum number of records returned in a single Log Analytics dashboard query is 2,000.

User query throttling

Azure Monitor has several throttling limits to protect against users sending an excessive number of queries. Such behavior can potentially overload the system back-end resources and jeopardize service responsiveness. The following limits are designed to protect customers from interruptions and ensure consistent service level. The user throttling and limits are designed to affect only extreme usage scenarios and shouldn't be relevant for typical usage.

Measure	Limit per user	Description
Concurrent queries	5	A user can run up to five concurrent queries. Any other query is added to a queue. When one of the running queries finishes, the first query in the queue is pulled from the queue and starts running. Alert queries aren't part of this limit.
Time in concurrency queue	3 minutes	If a query sits in the queue for more than 3 minutes without being started, it's terminated with an HTTP error response with code 429.
Total queries in concurrency queue	200	When the number of queries in the queue reaches 200, the next query is rejected with an HTTP error code 429. This number is in addition to the five queries that can be running simultaneously.
Query rate	200 queries per 30 seconds	Overall rate of queries that can be submitted by a single user to all workspaces. This limit applies to programmatic queries or queries initiated by visualization parts such as Azure dashboards and the Log Analytics workspace summary (deprecated) page.

Optimize your queries as described in Optimize log queries in Azure Monitor.
Dashboards and workbooks can contain multiple queries in a single view that generate a burst of queries every time they load or refresh. Consider breaking them up into multiple views that load on demand.
In Power BI, consider extracting only aggregated results rather than raw logs.

Log Analytics workspaces

Data collection volume and retention

Pricing tier	Limit per day	Data retention	Comment
Pay-as-you-go (introduced April 2018)	No limit	Up to 730 days interactive retention/ up to 12 years data archive	Data retention beyond 31 days is available for extra charges. Learn more about Azure Monitor pricing.
Commitment tiers (introduced November 2019)	No limit	Up to 730 days interactive retention/ up to 12 years data archive	Data retention beyond 31 days is available for extra charges. Learn more about Azure Monitor pricing.

Number of workspaces per subscription

Pricing tier	Workspace limit	Comments
Legacy Free tier	10	This limit can't be increased. Creating new workspaces in, or moving existing workspaces into, the legacy trial pricing tier is possible only until July 1, 2022.
All other tiers	No limit	You're limited by the number of resources within a resource group and the number of resource groups per subscription.

Azure portal

Category	Limit	Comments
Maximum records returned by a log query	30,000	Reduce results by using query scope, time range, and filters in the query.

Data Collector API

Category	Limit	Comments
Maximum size for a single post	30 MB	Split larger volumes into multiple posts.
Maximum size for field values	32 KB	Fields longer than 32 KB are truncated.

Query API

Category	Limit	Comments
Maximum records returned in a single query	500,000
Maximum size of data returned	~104 MB (~100 MiB)	The API returns up to 64 MB of compressed data, which translates to up to 100 MB of raw data.
Maximum query running time	10 minutes	See Timeouts for details.
Maximum request rate	200 requests per 30 seconds per Microsoft Entra user or client IP address	See Log queries and language.

Azure Monitor Logs connector

Category	Limit	Comments
Maximum size of data	~16.7 MB (~16 MiB)	The connector infrastructure dictates that limit is set lower than query API limit.
Maximum number of records	500,000
Maximum connector timeout	110 second
Maximum query timeout	100 second
Charts		The Logs page and the connector use different charting libraries for visualization. Some functionality isn't currently available in the connector.

Summary rules

Category	Limit
Maximum number of active rules in a workspace	30
Maximum number of results per bin	500,000
Maximum results set volume	100 MB
Query time-out for bin processing	10 minutes

General workspace limits

Category	Limit	Comments
Maximum columns in a table	500	AzureDiagnostics -- columns above the limit are added to the dynamic 'AdditionalFields' column Custom log created by Data collector API -- columns above the limit are added to the dynamic 'AdditionalFields' column Custom log -- contact support for more
Maximum number of custom log tables	500	Contact support for more
Maximum characters for column name	45

Data ingestion volume rate

Azure Monitor is a high-scale data service that serves thousands of customers sending Terabytes of data daily at a growing pace. To isolate and prevent interruptions in multitenancy service from sudden ingestion bursts, a default ingestion volume rate limit is placed in workspaces and set to 500 MB per minute compressed, which is translated to approximately 6 GB per minute uncompressed. This limit applies to data ingested from Azure resources via Diagnostic settings. The limit doesn't apply to data ingested from agents, or Data Collection Rules.

When the ingested volume rate reaches 80% of the rate limit set in workspace, an event is sent to the Operation table in your workspace every 6 hours while the threshold is exceeded. When volume rate limit is reached, a retry mechanism attempts to ingest the data four times in a period of 12 hours and drop it if fails, an event is sent to the Operation table in your workspace every 6 hours while the threshold is exceeded.

If your ingestion volume rate continues to exceed threshold or you're expecting to reach it sometime soon, you can request to increase this limit by opening a support request.

It's recommended to create an alert to get notified proactively when nearing or reaching ingestion limits. See Monitor health of Log Analytics workspace in Azure Monitor.