Azure Monitor log alert firing repeatedly for a single Automation runbook completion event

Hello Bipin, it looks like your Scheduled Query Alert is working exactly as it’s designed today—it’s stateless, so as long as the query returns ≥1 row in each 5-minute evaluation window, it will fire again, even if it’s the same runbook completion event. Historically you may have only seen one notification because either the record fell outside subsequent windows, or the platform silently suppressed duplicate firings, but under the current behavior every evaluation cycle that sees that single JobLogs record will trigger the action.

Here’s what you can do to get back to just one notification per runbook job:

1. Scope the query to the evaluation window Add an explicit time filter so the query only returns records in the last 5 minutes. For example:

   
      AzureDiagnostics
   
      | where ResourceProvider == "MICROSOFT.AUTOMATION"
   
        and Category == "JobLogs"
   
        and ResultType == "Completed"
   
        and RunbookName_s == "Restart-MyApp-Runbook"
   
        and TimeGenerated > ago(5m)
   
      | summarize Jobs = dcount(JobId_g)
   
   

   Then alert on Jobs >= 1. Because you’re deduplicating by JobId_g and only looking at the recent window, once your runbook’s completion record moves out of that 5-minute bucket, the alert stops firing.
2. Use distinct count instead of raw row count If you leave the built-in aggregation as “Table rows” + Count >= 1, the rule simply checks “is there at least one row?” each cycle. By switching to a Kusto summarize dcount(JobId_g) you ensure each unique job only counts once.
3. Consider a metric alert on Total Jobs Azure Automation emits a “Total Jobs” platform metric with dimensions for RunbookName and Status. Metric alerts on “TotalJobs” = 1 for status “Completed” will fire once per job and resolve automatically when the metric drops back below the threshold.
4. (Optional) Use Alert Processing Rules for suppression If you want to keep your query as-is but suppress duplicate notifications, you can author an Alert Processing Rule to “suppress” actions from firing more than once within a given time span.

To answer your specific questions:

• We’re not aware of any Azure Monitor backend change that would retroactively duplicate log records—but Azure Scheduled Query Alerts have always been stateless, and every cycle that returns a match will fire again.
• Yes, under the default configuration a log alert will keep firing every evaluation interval as long as it sees ≥1 matching record in that period.
• The root cause in your case is the combination of “table rows” + “count ≥ 1” + no dedup/time filter—so once the same completed log exists in each new time window, you get repeat emails.

Give the above tweaks a try, and you should see exactly one alert per runbook run.

Reference list

1. Troubleshoot log alerts firing when they shouldn’t
2. Why an alert’s action or notification happens more than once
3. Monitor runbooks with metric alert
4. Forward Azure Automation diagnostic logs & sample KQL

Hope this helps. If the information was useful, please consider accepting the answer and upvoting. Feel free to reach out if you need any further assistance. Thank you.

Just checking to see, If the information shared was helpful, please accept the answer and upvote. Please feel free to reach out if you have any additional questions or need further clarification. Thanks