Azure Web App Service 403告警未触发问题咨询及测试验证

First: Your Test Method Isn't Generating HTTP 403s #

When you stop your Azure Web App instance, refreshing the page won't return a 403 Forbidden status code. By default, Azure sends back a 503 Service Unavailable response (or a custom downtime page if you’ve set one up) when the app is stopped. That means your test isn’t actually hitting the condition you configured—5+ 403s in 5 minutes—so the alert never triggers.

A valid test to trigger 403s would be:

• Adding an IP restriction rule in your Web App to block your own IP, then refreshing the page repeatedly.
• Deploying a simple endpoint in your app that explicitly returns a 403 status code, then sending multiple requests to it.

Next: Check These Common Configuration Gaps #

Even with a correct test method, there are easy-to-miss setup steps that could block alerts:

• Verify the alert rule’s target resource: Double-check that the rule is linked directly to your specific Web App (not an App Service Plan or another unrelated resource).
• Confirm your action group is properly set up:
  • Make sure the email address in your action group is correct and saved.
  • Azure sends a verification email to new recipients—you must click the confirmation link in that email to activate alerts. This is one of the most overlooked steps!
• Enable diagnostic logs for HTTP data: Azure Monitor relies on your Web App’s diagnostic logs to track HTTP status codes. Head to your Web App’s Diagnostic settings and ensure HTTP logs are enabled and set to send data to Azure Monitor Logs. You can validate this by querying the AppServiceHttpLogs table in Log Analytics to see if 403 requests are being captured.
• Audit the alert rule’s trigger logic:
  • Double-check the aggregation window is set to "Last 5 minutes", the aggregation type is "Count", and the threshold is "Greater than 5".
  • If you added dimension filters (e.g., specific URLs, app instances), ensure your test requests match those filters.
• Check Gmail’s spam/promotions folders: Azure’s alert emails sometimes get routed to these folders instead of your primary inbox—don’t forget to look there.
• Ensure the alert rule is enabled: It sounds obvious, but confirm the rule isn’t in a "Disabled" state in the Azure portal.

Once you fix the test method and work through these checks, your alert should fire as expected.

内容的提问来源于stack exchange，提问作者WenHao