Monitor and maintain Azure resources
Network Watcher and Connection Monitor
CoreChoose network diagnostic capabilities and interpret continuous reachability evidence without conflating them with general monitoring.
Aligned to the current AZ-104 study guide, verified August 21, 2026.
Why this matters
Network incidents need path-specific evidence, while recurring business paths need continuous reachability and latency observation rather than one-time guesses.
Must Know
- Azure Network Watcher supplies network monitoring and diagnostic capabilities for Azure IaaS networking.
- Connection Monitor continuously tests reachability and latency between configured sources and destinations and records results for monitoring.
- Network Watcher tools can inspect next hop, IP flow, effective security, topology, packet capture, connection behavior, and related evidence where supported.
- Choose a point-in-time diagnostic for a current failure and Connection Monitor for recurring end-to-end measurement.
- Connection Monitor is the current product capability; classic Connection Monitor should not be taught as the deployment choice.
Compare and Distinguish
- Network Watcher vs Azure Monitor: network-specific diagnostic toolset vs broad telemetry, logs, visualizations, and alerting platform.
- Network Watcher vs Connection Monitor: umbrella network capabilities vs continuous end-to-end reachability and latency tests.
- Connection troubleshoot vs Connection Monitor: on-demand path diagnosis vs recurring monitored test configuration.
Scenario examples
- Scenario: Operations needs ongoing latency and reachability history from branch agents to an Azure endpoint. Think: Configure Connection Monitor tests and alert on failed criteria.
- Scenario: One VM flow is denied now and the administrator needs the deciding rule. Think: Use Network Watcher IP flow or effective-rule evidence for the exact flow.
- Scenario: A route is suspected of choosing the wrong appliance. Think: Use next-hop and effective-route evidence before editing route tables.
Exam traps
- A single successful connection test does not establish continuous availability over time.
- General Azure Monitor charts do not replace a network-specific next-hop or IP-flow diagnosis.
- Classic Connection Monitor terminology is historical and should not drive a new configuration choice.
Key takeaways
- Use Network Watcher for network-specific evidence and Connection Monitor for recurring end-to-end tests.
- Select the diagnostic that directly answers route, filter, packet, topology, or longitudinal reachability.
How it works
- Network Watcher queries platform network state or coordinates diagnostic capture against supported resources.
- Connection Monitor schedules probes, records reachability and performance, and exposes results for analysis and alerting.
Objects and administrative surfaces
- Region and subscription — Network Watcher availability and supported monitored resources.
- Connection Monitor — test group, sources, destinations, protocol, frequency, thresholds, collected results, and alerts.
- VM, NIC, VNet, and network path — diagnostic evidence such as effective rules, next hop, packet capture, and connection result.
When to use it
- Use a focused Network Watcher diagnostic when one current path needs explanation.
- Use Connection Monitor for service paths whose reachability and latency require a history and proactive detection.
Security and governance implications
- Protect packet captures and diagnostic logs because they can reveal sensitive endpoints and traffic metadata.
- Grant diagnostic permissions narrowly and maintain monitored paths as applications move.
How to reason about this
- Define source, destination, protocol, and time window, then compare Connection Monitor status with DNS, next hop, effective NSG, and endpoint response.
- If tests produce no data, inspect source support and agent state where applicable, endpoint definition, permissions, workspace collection, and test enablement.
More detail
- Use appropriate Network Watcher capabilities to inspect routes, security decisions, packets, and connection paths.
- Configure Connection Monitor sources, endpoints, tests, frequency, thresholds, and monitoring integration.
Ready for the quiz?
- Which capability records reachability and latency over time?
- Which evidence identifies the next hop Azure selected?
- Why is broad resource monitoring insufficient for every network fault?
Related objectives
- D5.1.S6 — Use Azure Network Watcher and Connection monitor