No notification sent despite alert firing – Action Group deduplication

Goal: Set up Azure Monitor metric and log alerts that fire only for genuine problems, while using Action Groups, Alert Processing Rules, and dynamic thresholds to minimize duplicate or unnecessary notifications.

Constraints: Action‑Group deduplication can collapse multiple firings into a single notice, which may mask a sustained issue if the alert continues to fire; dynamic thresholds require at least seven days of data to model normal behavior, so new resources may generate noisy alerts until the model trains; Alert Processing Rules are applied after an alert is generated, so they do not reduce evaluation cost, and using the “Only send notifications if the alert is resolved” option with ITSM connectors could delay awareness of ongoing incidents.

Questions: How should deduplication windows be sized to suppress flapping without hiding genuine persistent alerts? What is the minimum historical period needed for dynamic thresholds to become reliable for a given metric, and how can interim noise be managed? When using Alert Processing Rules with ITSM connectors, how can the “Only send notifications if the alert is resolved” setting be balanced with the need for real‑time awareness of ongoing issues?