Cosmos DB IoT Telemetry Threshold Alerting

Overview

This flow turns IoT telemetry stored in Azure Cosmos DB into actionable, de-duplicated alerts. On a 15-minute schedule it queries the telemetry container for readings above a configurable threshold within a lookback window, and for each breach it opens a Dataverse incident and notifies the on-call Microsoft Teams channel - while suppressing duplicate alerts for the same device inside a configurable window.

Why it matters: telemetry sitting in Cosmos notifies no one. Server-side threshold filtering plus a Dataverse-backed suppression check turns it into timely alerts without alert fatigue.

Ships Off (demo).

Use Case

A device fleet writes telemetry documents (deviceId, metric, value, unit) to a Cosmos DB SQL-API container. Operations needs to be alerted when a reading crosses a threshold, with an auditable incident record and without being spammed by repeat alerts while an incident is already open.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Per-device thresholds

Store a threshold field on each document and filter c.value > c.threshold, or look thresholds up from a Dataverse config table.

Severity tiers

Map magnitude (% over threshold) to Low/Medium/High instead of always High.

Auto-resolve

Add a companion flow that closes incidents when subsequent readings normalize.

Escalation

If an incident stays Open past an SLA, escalate via Approvals or a paging connector.

Volume

For very high telemetry rates prefer Azure Stream Analytics; use this flow for moderate rates or as the notification layer.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

sub(div(sub(ticks(utcNow()),ticks('1970-01-01T00:00:00Z')),10000000),mul(variables('varLookbackMinutes'),60))

concat('SELECT * FROM c WHERE c.value > ', string(variables('varAlertThreshold')), ' AND c._ts >= ', string(variables('varEpochCutoff')))

empty(body('List_Recent_Open_Incidents')?['value'])

formatDateTime(addMinutes(utcNow(), mul(-1, variables('varSuppressionMinutes'))), 'yyyy-MM-ddTHH:mm:ssZ')