Skip to main content

Azure Health: Incidents, RCA and Resources

Overview​

Azure Health in Spotto shows Azure platform incidents and resource availability for the subscriptions you select. It puts Service Health events, PIR/RCA content, impacted services, regions and resources, and Resource Health availability on one page so you can answer the practical question: "Was this us, Azure, or both?"

It complements Change Monitoring: Change Monitoring explains what changed inside the subscription; Health explains which Azure platform or resource health event affected it.

Where to find it: In the Spotto Portal sidebar, go to Investigate -> Cloud Estate -> Health.

How it works​

Spotto collects Azure Resource Health data for each subscription on every sync and shapes it into the page.

Spotto reads three Azure Resource Health sources for each subscription: health events (service issues, planned maintenance, health and security advisories, RCAs), the impacted resources for each event (resource ID, type and region), and availability statuses (the current state of each resource, with reason and recommended actions). On each sync Spotto: 1. fetches new events, looking back 180 days on the first sync and starting 24 hours before the newest stored update after that, keeping the latest version of each event; 2. fetches the impacted resources for each event and links them to it; 3. splits Microsoft's PIR text into sections such as What happened and What went wrong and why, marks Preliminary or Final PIRs from the event tags, and keeps no PIR, actions or resources for sensitive events; 4. replaces the previous availability snapshot, and if that call fails, events still update and the sync is marked partial. The Health page shows summary cards (active incidents, impacted resources, final PIRs, latest update), a Service events tab that shows events with impacted resources unless you pick All events, where you can open an event for timing, PIR sections, actions and resources or add it to the Kanban Board, and a Resource availability tab that lists Unavailable, Degraded and Unknown resources first, shows Available ones under All resources, and links names to resource details.Spotto reads three Azure Resource Health sources for each subscription: health events (service issues, planned maintenance, health and security advisories, RCAs), the impacted resources for each event (resource ID, type and region), and availability statuses (the current state of each resource, with reason and recommended actions). On each sync Spotto: 1. fetches new events, looking back 180 days on the first sync and starting 24 hours before the newest stored update after that, keeping the latest version of each event; 2. fetches the impacted resources for each event and links them to it; 3. splits Microsoft's PIR text into sections such as What happened and What went wrong and why, marks Preliminary or Final PIRs from the event tags, and keeps no PIR, actions or resources for sensitive events; 4. replaces the previous availability snapshot, and if that call fails, events still update and the sync is marked partial. The Health page shows summary cards (active incidents, impacted resources, final PIRs, latest update), a Service events tab that shows events with impacted resources unless you pick All events, where you can open an event for timing, PIR sections, actions and resources or add it to the Kanban Board, and a Resource availability tab that lists Unavailable, Degraded and Unknown resources first, shows Available ones under All resources, and links names to resource details.

Why use this? (Jobs, pains, gains)​

Jobs to be done​

  • When an outage is reported, I want to see whether Azure published a related incident, so I can separate platform impact from tenant-side changes.
  • When Microsoft publishes a post-incident review, I want the RCA/PIR sections in the same place as the affected subscription context, so I can brief teams without rebuilding the timeline by hand.
  • When a resource is degraded or unavailable, I want a resource-level view with links back to Spotto resource details, so ownership and remediation are easier to follow.

Common pains​

  • Azure Service Health and Resource Health answer different questions, and switching between them during an incident is not anyone's idea of a good time.
  • Activity logs show management operations, but not the full customer-facing incident summary, impact window, PIR tags, or recommended actions from Microsoft.
  • Resource-level health can be missed when the subscription-level incident has already moved to Resolved.

Turn the evidence into a decision​

Select the labelled briefcase Business Value button beside Notes. The brief combines live incident, impacted/unavailable resource, and post-incident review facts with a resilience decision.

Technical severity does not establish business criticality; validate that context with service owners. Generate tailors only the narrative for permitted users and saves it to the exact scope. Clear removes that saved narrative and immediately restores the standard Business Value content without deleting Customer Context or changing live facts. Regenerate when evidence changes. Above 100 subscriptions, the curated live brief remains available without tailoring.

Current position and priority work​

Stabilize active incidents according to business-service priority, then turn recurring events and post-incident findings into owned resilience improvements.

Business outcomes​

Health review connects Azure incidents and resource availability to services, users, and recovery commitments. That connection helps teams restore the most important services first and fund resilience improvements from real incident evidence.

Cost of delay​

Technical severity alone may not reveal business criticality, which can prolong customer impact or misdirect response effort. Repeated failure patterns may continue when PIR actions are not assigned, funded, and tracked.

Decision required​

Confirm service priority, approve the immediate recovery and follow-up work, and assign owners and dates to post-incident actions.

Validate with stakeholders​

When you can manage Company Notes, select any question in the portal to retain the answer in the relevant Customer Context note.

  • Which business services and users are affected?
  • What availability commitments, workarounds, and escalation thresholds apply?
  • Which PIR actions require an owner and investment decision?

Key capabilities​

Select subscriptions to scope the view​

Use the subscription selector at the top of the page to choose one or more subscriptions. Health only loads data for subscriptions that are ready for review.

Review incidents​

Events are sorted by latest update, newest first. Each row in the Service events tab shows the event title, subscription, last update, event type (ServiceIssue, PlannedMaintenance, HealthAdvisory, SecurityAdvisory, RCA, EmergingIssues), status (Active or Resolved), level when provided, and a Preliminary PIR or Final PIR badge.

Select an event to open its details: impact start, mitigation time, last update, duration, summary, impacted services and regions, recommended actions, and impacted resources. When Microsoft includes post-incident review content, the details also show What happened, What went wrong and why, How Microsoft responded, How Microsoft is reducing recurrence and How customers can reduce impact. Microsoft does not publish every section for every event.

Use the star on an event to add it to the Kanban Board as a reliability work item, or share the event from its details.

Review current resource availability​

Each row in the Resource availability tab shows the resource name, type and subscription, its health state and title, the reason and summary, recommended actions, the time Azure reported it, and how many service events are linked to it.

Search and filter​

Search matches events by title, summary, type, status, level, service, region, subscription or recommended action, and resources by name, ID, type, subscription, state, reason, summary or recommended action.

The filters switch between:

  • All, active and resolved events
  • Events with impacted resources, or all events
  • Impacted (not Available), Unavailable, Degraded, Unknown or all resources

How it differs from Change Monitoring​

QuestionUse
"Who changed this resource or subscription setting?"Change Monitoring
"Did Azure report a platform incident, outage, maintenance event, or RCA?"Health
"Which resources are currently degraded, unavailable, or recently impacted?"Health
"Was there a failed deployment, policy assignment, or administrative operation?"Change Monitoring

Activity logs can contain health-looking categories, but they are compact management events. Health keeps the Service Health and Resource Health fields such as impact windows, impacted services and regions, PIR tags, article content, recommended actions, and availability status.

Coverage and limitations​

  • Event history starts 180 days before the subscription's first health sync. Older events are not collected.
  • Some events are subscription-level only and have no impacted resources list.
  • Resource availability is a snapshot from the latest sync. If Azure health changes after that, wait for the next sync.
  • Sensitive advisory details may require additional Azure permissions and may not be visible in every environment.

Permissions and access​

Health uses the same Spotto portal access as Change Monitoring. If a user cannot access Change Monitoring for a company, they will not see Health.

For Azure collection, Spotto needs read access to Resource Health data, including:

  • Microsoft.ResourceHealth/events/read
  • Microsoft.ResourceHealth/events/impactedResources/read
  • Microsoft.ResourceHealth/AvailabilityStatuses/read
  • Microsoft.ResourceHealth/AvailabilityStatuses/current/read

Troubleshooting​

The Health page is empty​

What you're seeing: The page shows no Service Health events or Resource Health availability statuses.

Likely causes:

  • No subscriptions are selected.
  • The selected subscriptions are not ready yet.
  • Azure has no health events or availability statuses for the selected subscriptions.
  • The Service events tab is showing only events with impacted resources.
  • Resource Health permissions are missing from the cloud account.

How to fix:

  1. Select at least one ready subscription.
  2. Wait for the cloud account sync to complete.
  3. Switch the event filter to All events and the resource filter to All resources.
  4. Confirm the Azure role assigned to Spotto includes the Resource Health read permissions listed above.

PIR or RCA sections are missing​

What you're seeing: An event appears, but fields such as "What happened" or "What went wrong and why" are blank.

Likely causes:

  • Microsoft has not published a preliminary or final PIR for that event.
  • The event type does not include post-incident review sections.
  • The event has only summary, update, or article content.
  • Azure marks the event as sensitive.

How to fix:

  1. Check whether the event has a Preliminary PIR or Final PIR badge.
  2. Review the event summary and recommended actions.
  3. Recheck after Microsoft publishes the final update.

A resource is affected but does not link to a resource detail page​

What you're seeing: An impacted resource appears as text, but there is no usable Spotto resource link.

Likely causes:

  • Azure did not provide a targetResourceId for the impacted resource.
  • The resource is outside the selected subscriptions or has not been collected into Spotto inventory.
  • The resource was deleted before the latest inventory sync.

How to fix:

  1. Search for the resource by name or ID in Cloud Resources.
  2. Select the subscription that owns the resource.
  3. Refresh after the next inventory sync if the resource was recently created or restored.

Resource Health says Available but users still reported impact​

What you're seeing: Resource availability rows show Available, but users reported downtime or degradation.

Likely causes:

  • The impact was transient and resolved before the latest sync.
  • The incident affected an upstream dependency rather than the resource directly.
  • The issue was tenant-side, such as a deployment, policy, network, or identity change.

How to fix:

  1. Check Service Health events for the same time window.
  2. Review Change Monitoring for deployments or administrative changes around the incident.
  3. Check resource metrics and logs for tenant-side symptoms.
Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation