Create workbooks for interactive analysis

What this covers

Azure Monitor Workbooks are interactive reports inside Azure Monitor: parameterized KQL, metrics, charts, grids and Markdown in one document. Use them when a dashboard is not enough and you need guided analysis of AI app telemetry, such as "why is RAG slow for this service in this time window?". This page covers workbook steps, parameters and their syntax, visualizations, drill-down with links and conditional visibility, and saving and sharing.

Exam weight: Secure, monitor, and troubleshoot Azure solutions (20–25%)

Skills measured

• "Write KQL queries to analyze logs and metrics"

Key concepts

Workbook

An Azure Workbook is an interactive canvas of steps rendered top to bottom. Data sources include Logs (Log Analytics / Application Insights), Metrics, Azure Resource Graph and others. Authors build the analysis story; operators change parameters without rewriting KQL. Open workbooks from Azure Monitor, a Log Analytics workspace or an Application Insights resource; the gallery has templates for performance, failure and usage analysis.

Parameters

Parameters make workbooks interactive. Reference them inside queries with braces: {TimeRange}, {ServiceName}, {OperationName}. When a user changes a value, every step that references it re-runs.

Multi-select values become a comma-separated list, so filter with in: | where AppRoleName in ({ServiceName}).

Drill-down: conditional visibility and links

• Conditional visibility shows or hides a step based on a parameter value (for example, show exception details only after a service is selected).
• Grid link actions make a column clickable to open end-to-end transaction details, open another workbook, or export a parameter that filters later steps.

When to use

How it works

Typical structure for an AI API workbook:

1. Parameters: time range, service.name (cloud role), HTTP route
2. Overview: request volume, failure rate, P95
3. Dependencies: slow or failing outbound calls (Cosmos DB, PostgreSQL vector stores, model endpoints)
4. Exceptions: top ProblemIds linked by OperationId
5. Sample traces: grid of recent failed OperationIds to open in Transaction search

Hands-on

Azure portal

1. Azure Monitor or Application Insights → Workbooks → + New (Empty), or start from a template.
2. Add parameters: TimeRange (Time range picker); ServiceName (Drop down, query below, allow multiple selections).
3. Add query: data source Logs, resource type Application Insights, write KQL, choose visualization (time chart, grid, tiles).
4. On a grid, open Column settings → set a column to Link and choose an action (export parameter or open details).
5. On a detail step, open Advanced settings → Make this item conditionally visible when the parameter is set.
6. Save to a resource group with a clear name (AI-200 RAG health), as a shared workbook so teammates with RBAC read access can open it.

Azure CLI

# Workbooks are ARM resources (Microsoft.Insights/workbooks); list them in a resource group
az resource list --resource-group <resource-group> \
  --resource-type "Microsoft.Insights/workbooks" --output table

Python

Test a workbook query outside the portal before adding it as a step:

from datetime import timedelta
from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient

client = LogsQueryClient(DefaultAzureCredential())
q = "AppRequests | summarize count() by AppRoleName"
print(client.query_workspace("<workspace-guid>", q, timespan=timedelta(days=1)).tables[0].rows)

KQL steps

Dropdown parameter source (distinct services):

AppRequests
| where TimeGenerated {TimeRange}
| distinct AppRoleName

Overview step bound to parameters:

AppRequests
| where TimeGenerated {TimeRange}
| where AppRoleName in ({ServiceName})
| where Name has "{OperationName}"
| summarize
    Total = count(),
    Failures = countif(Success == false),
    P95 = percentile(DurationMs, 95)
  by bin(TimeGenerated, 1h)

Success rate per service (classic names, as in the Learn unit, where {TimeRange} is used with ago()):

requests
| where timestamp > ago({TimeRange})
| summarize totalRequests = count(),
    failedRequests = countif(success == false)
    by cloud_RoleName
| extend successRate = round(100.0 * (totalRequests - failedRequests) / totalRequests, 2)
| project cloud_RoleName, totalRequests, failedRequests, successRate

Model deployment parameter via custom dimensions:

AppDependencies
| where TimeGenerated {TimeRange}
| where tostring(Properties["gen_ai.model"]) == "{ModelName}"
| summarize P95 = percentile(DurationMs, 95) by Name

Exam traps

Quick review

• Workbooks combine text, parameters, KQL and metrics steps in one report.
• Parameters are referenced with {ParamName}.
• Parameter types: time range, dropdown, resource picker, text.
• Grid link actions and conditional visibility enable drill-down.
• Save as a shared workbook to a resource group; access is governed by RBAC.
• Start from gallery templates for failures and performance.

Practice

Practice: KQL questions

Official references

• Create workbooks for interactive analysis (Learn unit)
• Azure Workbooks overview
• Workbook parameters
• AI-200 study guide