Observability, cost, and operational controls

Chapter 5 of 6

Implement#

1. Complete the retained decisions#

Complete the telemetry contract, deployment parameters, budget parameters, retention decision, content-logging decision, cost-allocation record, and incident runbook. Keep the service name consistent across machine-readable files.

Leave externalExport.enabled set to false when the customer keeps telemetry in Azure Monitor. When export is required, record the destination type, stable alias, owner, and restore reference. The export pipeline must remove every prohibited attribute before Azure Event Hubs or another customer transport sends the event.

For a disabled content-logging exception, set its detail fields to N/A. An approved exception needs a bounded purpose, isolated scope, access owner, retention, expiry, and data-protection approval.

Set the deployment coordinates:

$approvedSubscriptionId = $env:AZURE_SUBSCRIPTION_ID
$approvedResourceGroupName = $env:OBSERVABILITY_RESOURCE_GROUP
$approvedApplicationInsightsResourceId = $env:APPLICATION_INSIGHTS_RESOURCE_ID
$deploymentLocation = $env:AZURE_DEPLOYMENT_LOCATION

approved_subscription_id="${AZURE_SUBSCRIPTION_ID}"
approved_resource_group_name="${OBSERVABILITY_RESOURCE_GROUP}"
approved_application_insights_resource_id="${APPLICATION_INSIGHTS_RESOURCE_ID}"
deployment_location="${AZURE_DEPLOYMENT_LOCATION}"

2. Confirm the pre-work#

The application uses the supported Azure Monitor OpenTelemetry distro for its language and receives the Application Insights connection string through the deployment environment. It emits separate agent, model, tool, evaluation, and security signals; propagates traceparent and x-correlation-id; and drops prohibited attributes before export.

The customer-owned APIM policy preserves the gateway controls, trace context, and bounded token metrics. Do not use user, email, request, correlation, prompt, response, or free-text values as metric dimensions.

3. Run preflight#

.\scripts\preflight.ps1 `
  -ApprovedSubscriptionId $approvedSubscriptionId `
  -ApprovedResourceGroupName $approvedResourceGroupName `
  -ApprovedApplicationInsightsResourceId $approvedApplicationInsightsResourceId `
  -DeploymentLocation $deploymentLocation

./scripts/preflight.sh \
  --approved-subscription-id "$approved_subscription_id" \
  --approved-resource-group-name "$approved_resource_group_name" \
  --approved-application-insights-resource-id "$approved_application_insights_resource_id" \
  --deployment-location "$deployment_location"

Preflight checks every required decision, artifact syntax, telemetry privacy and cardinality, resource binding, both Bicep templates, and the resource-group and subscription what-if previews.

4. Deploy the workbook, alerts, and budget#

After the observability and cost owners approve both previews:

az deployment group create `
  --subscription $approvedSubscriptionId `
  --resource-group $approvedResourceGroupName `
  --template-file .\artifacts\infra\main.bicep `
  --parameters .\artifacts\infra\main.bicepparam

az deployment sub create `
  --subscription $approvedSubscriptionId `
  --location $deploymentLocation `
  --template-file .\artifacts\cost\budget.bicep `
  --parameters .\artifacts\cost\budget.bicepparam

az deployment group create \
  --subscription "$approved_subscription_id" \
  --resource-group "$approved_resource_group_name" \
  --template-file ./artifacts/infra/main.bicep \
  --parameters ./artifacts/infra/main.bicepparam

az deployment sub create \
  --subscription "$approved_subscription_id" \
  --location "$deployment_location" \
  --template-file ./artifacts/cost/budget.bicep \
  --parameters ./artifacts/cost/budget.bicepparam

Open the workbook. Run the request-error and tool-failure queries over their 15-minute windows and the quality query over its 30-minute window. Each query must parse and return its expected result column, even when the count is zero. The action-group owner uses the existing authorized test path to confirm delivery. Do not generate unsafe traffic to force an alert.