"Alert processing rule" to disable specific "Azure Monitor Alert Exception Anomalies" emails

Question

"Alert processing rule" to disable specific "Azure Monitor Alert Exception Anomalies" emails

Matthew Robinson 5

Our Azure subscription is configured to send Azure Monitor Alert Exception Anomalies emails when there is an unusual rise in the rate of exceptions thrown by our app.

We don't need to receive email notifications for particular errors, so I configured an "Alert processing rule" to try and prevent emails being sent, with the following configuration:

Filters Alert context (payload) contains 'Voucher number already used. Please try again.' Rule settings Rule type: Suppress notifications Scheduling Apply the rule: Always

However I still receive these Azure Monitor Alert Exception Anomalies emails for the same errors. Is it possible to configure this differently to stop those email notifications?

Pranay Reddy Madireddy 6,340 Reputation points Moderator

2025-04-16T00:06:27.9866667+00:00

Hi Matthew Robinson

Verify the alert processing rule is enabled. If it's disabled, it won't take any action on incoming alerts.

check that the scope of the rule includes the relevant resources generating the alerts. Also, verify that the filter criteria match the alert payload precisely any mismatch can cause the rule to be skipped.

Please confirm whether the alerts are service health related. Currently, alert processing rules do not apply to service health alerts.

If there are multiple alert processing rules configured, it's important to ensure there's no conflict between them. One rule might be overriding or allowing notifications that another is trying to suppress.

You can test the rule by triggering an alert that meets the criteria and reviewing the History tab. This will show whether the processing rule was evaluated and what action was taken
https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-processing-rules?tabs=portal

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot#the-alert-processing-rule-isnt-working-as-expected

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Matthew Robinson 5 Reputation points

2025-04-16T03:50:38.01+00:00

Hi Pranay,

The alert processing rule is enabled, and the scope covers resources generating the alerts - Resource group, Location and Subscription all correspond to where the Azure Monitor Alert Exception Anomalies emails are being triggered from.

I too read elsewhere that alert processing rules do not apply to service health alerts - does this include Azure Monitor Alert Exception Anomalies emails?

There aren't any conflicts between multiple alerts.

The log history is not showing the processing rule being evaluated, despite the fact that Logs indicate that the error did fire containing the exact error message text: 'Voucher number already used. Please try again.' after I had created the alert processing rule described.

2 answers

Your answer

Pranay Reddy Madireddy 6,340 Reputation points Moderator

2025-04-16T00:06:27.9866667+00:00

Hi Matthew Robinson

Verify the alert processing rule is enabled. If it's disabled, it won't take any action on incoming alerts.

check that the scope of the rule includes the relevant resources generating the alerts. Also, verify that the filter criteria match the alert payload precisely any mismatch can cause the rule to be skipped.

Please confirm whether the alerts are service health related. Currently, alert processing rules do not apply to service health alerts.

If there are multiple alert processing rules configured, it's important to ensure there's no conflict between them. One rule might be overriding or allowing notifications that another is trying to suppress.

You can test the rule by triggering an alert that meets the criteria and reviewing the History tab. This will show whether the processing rule was evaluated and what action was taken
https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-processing-rules?tabs=portal

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-troubleshoot#the-alert-processing-rule-isnt-working-as-expected

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Matthew Robinson 5 Reputation points

2025-04-16T03:50:38.01+00:00

Hi Pranay,

The alert processing rule is enabled, and the scope covers resources generating the alerts - Resource group, Location and Subscription all correspond to where the Azure Monitor Alert Exception Anomalies emails are being triggered from.

I too read elsewhere that alert processing rules do not apply to service health alerts - does this include Azure Monitor Alert Exception Anomalies emails?

There aren't any conflicts between multiple alerts.

The log history is not showing the processing rule being evaluated, despite the fact that Logs indicate that the error did fire containing the exact error message text: 'Voucher number already used. Please try again.' after I had created the alert processing rule described.

Answer 1

Madugula Jahnavi 495 Microsoft External Staff Moderator

Hello Matthew Robinson,

The "Exception Anomalies" alerts are usually generated by Smart Detection, and these are often do not include full exception text in a way that's mostly filtered using a simple contains match on payload.

Instead of relying only on the payload context filtering, try adding an alert rule name or ID or any specific signal name to work it efficiently.

Alternatively, you can create a custom log based alert rule as shown below. Once you write a KQL query, you can click on the New Alert rule and while adding or creating the action group, choose email as no-email to stop receiving them.

User's image Hope this helps!

If the answer is helpful, please click on Accept Answer and upvote it. If you still have any queries, please click on Comment.

Matthew Robinson 5 Reputation points

2025-04-29T23:46:16.99+00:00

Hi Madugula, I've created an Alert rule called "Exceptions to ignore" based on the KQL query:

My Alert Processing Rule now references the Alert Rule "Exceptions to ignore" instead of using the filter: Alert context (payload) contains 'Voucher number already used. Please try again.'

I cannot easily trigger this error to occur manually to test this, so will just have to wait to see whether this now prevents email notification.
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator

2025-05-02T11:30:51.5+00:00

Matthew Robinson, Ok and have you tried creating it directly in log analytics workspace query?
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator

2025-05-05T08:04:07.5933333+00:00

Matthew Robinson, We haven't heard any response from you yet. Can you confirm the above one!
Matthew Robinson 5 Reputation points

2025-05-05T23:10:16.9+00:00

It will likely take a few weeks before we see whether my change has been successful.

What did you mean by "log analytics workspace query"? Is it different to the alert rule I showed in the screen shot from my previous post?
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator

2025-05-06T05:25:07.5166667+00:00

Matthew Robinson Like creating and executing a custom log search in alert rules, there is a workspace in Azure called log analytics workspace which is also used to create an alert with the custom KQL query. You can directly search for Log analytics workspace in Azure Portal search and execute it.
Matthew Robinson 5 Reputation points

2025-05-07T04:22:34.31+00:00

@Madugula Jahnavi Thanks for reaching out. If I could execute the custom log search in alert rules, how would this help to ensure the Azure Monitor Alert Exception Anomalies emails will exclude exceptions containing the text 'Voucher number already used. Please try again.'?

I tried running a query however it threw an error:
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator

2025-05-07T07:23:45.76+00:00

In order to create anomaly exception alert rules, we have to use alert processing rules only but when it comes to trigger an alert then this could be an approach I meant.

Answer 2

Naveena Patlolla 9,660 Microsoft External Staff Moderator

Hi Matthew Robinson If you want to disable specific "Azure Monitor Alert Exception Anomalies" emails. Please follow the below steps.

Go to Cost Management-->Configuration-->Alert rules

Click on Alert rule and delete as shown below User's image

Feel free to reach out if you have any further queries.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Naveena Patlolla 9,660 Reputation points Microsoft External Staff Moderator

2025-04-15T14:56:28.2566667+00:00

Hi Matthew Robinson
Have you had a chance to review my answer?

If this answers your query, please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Matthew Robinson 5 Reputation points

2025-04-16T03:52:54.31+00:00

Hi Naveena,

I do not wish to turn off all alerts from Azure Monitor Alert Exception Anomalies emails, I only want to avoid receiving those emails that were triggered with the specific error message 'Voucher number already used. Please try again.'
Naveena Patlolla 9,660 Reputation points Microsoft External Staff Moderator

2025-04-16T04:25:50.7933333+00:00

Hi Matthew Robinson
I have reached out to you in a private message

Thankyou
Naveena Patlolla 9,660 Reputation points Microsoft External Staff Moderator

2025-04-16T13:11:14.6+00:00
Hi Matthew Robinson

Thank you for your patience. We have tested this in our environment, it worked. Please follow the below steps to stop receiving emails

Step 1: Navigate to Alert Processing Rules

Navigate to Monitor → Alert Processing Rules

Step 2: Edit a Rule

Select an existing rule to edit.

Step 3: Configure Filter Conditions

In the Scope --> Filters tab:

Add Alert ID:

Add a filter for the specific Alert ID you want to target.

To exclude Specific Resources:

Add a filter for “Resource” and list the ones you want to exclude from email notifications.

Step 4: In the Rule Settings Tab

Under the "Rule Settings” section, choose “Suppress Notifications”.

This tells Azure Monitor to suppress emails for the filtered conditions.

Step 5: Review and Create

Review your settings and click “Create” to activate the rule.

Please let us know still you are experiencing any issues.

If this answers your query, please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Matthew Robinson 5 Reputation points

2025-04-16T23:00:42.43+00:00

Hi Naveena,

When I edit the alert processing rule, there's no "Alert ID" filter:

Did you mean "Alert rule id"? If so, would I use the "Alert rule ID" URL from my Azure Monitor Alert Exception Anomalies email notification?
Naveena Patlolla 9,660 Reputation points Microsoft External Staff Moderator

2025-04-17T04:13:56.7433333+00:00

Hi Matthew Robinson
Apologies for the inconvenience. Yes, I was referring to the Alert Rule ID.
The second filter can be either a resource or a resource group—select the one you want to exclude

If you have any further questions, please don't hesitate to reach out. We're here to assist you.

Please do not forget to "Accept the answer” and “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Matthew Robinson 5 Reputation points

2025-04-17T06:37:42.04+00:00

Hi Naveena,

Sorry this doesn't help either - all my "Azure Monitor Alert Exception Anomalies" emails share the same Alert Rule ID, and adding filtering on Resource or Resource Group doesn't narrow it down to just the error message 'Voucher number already used. Please try again.'
Madugula Jahnavi 495 Reputation points Microsoft External Staff Moderator

2025-04-24T12:13:37.6233333+00:00

Matthew Robinson, I understand that the issue has still persisted. I have initiated a conversation through chat to check the issue further. Kindly respond there.

Share via

"Alert processing rule" to disable specific "Azure Monitor Alert Exception Anomalies" emails

2 answers

Your answer