Incident Playbooks¶

Symptom-oriented troubleshooting guides for Azure Functions.

Each playbook follows a hypothesis-driven structure: start from the symptom, list competing hypotheses, collect evidence, validate or disprove, and identify the root cause.

graph TD
    A[Reported symptom] --> B{Primary symptom area}
    B --> C[Execution]
    B --> D[Performance]
    B --> E["Queue / Event Processing"]
    B --> F[Deployment]
    B --> G[Triggers]
    B --> H[Scaling]
    B --> I["Auth / Config"]
    C --> C1[Functions not executing]
    C --> C2[Functions failing with errors]
    D --> D1["High latency / slow responses"]
    E --> E1[Queue messages piling up]
    E --> E2[Blob trigger not firing]
    F --> F1[Deployment failures]
    G --> G1["Timeout / Execution Limit"]
    G --> G2["Event Hub / Service Bus Lag"]
    H --> H1["Out of Memory / Worker Crash"]
    H --> H2[Durable Orchestration Stuck]
    I --> I1["Managed Identity / RBAC Failure"]
    I --> I2[App Settings Misconfiguration]

Execution¶

Performance¶

Queue / Event Processing¶

Deployment¶

Triggers¶

Scaling¶

Auth / Config¶

How to Use These Playbooks¶

1. Identify the primary symptom your incident matches.
2. Open the corresponding playbook.
3. Follow the hypothesis-driven workflow: What you observe → Hypotheses → Checks → Interpretation → Fix.
4. Use inline KQL queries directly in the playbook — no need to switch to a separate query library.

See Also¶

• First 10 Minutes
• Methodology
• KQL Query Library
• Lab Guides
• Evidence Map