Azure Monitor or our existing Grafana for 20–30 VMs?

I’d start with Azure Monitor for collection and use your existing Grafana as a dashboard layer where it fits. Grafana can query Azure Monitor data, so you may not need to copy everything to an on-premises store. That avoids running a second ingestion pipeline, though you should check connectivity, permissions, and which data sources and queries your dashboards need.

Before enabling broad log collection, estimate the volume from a small pilot. Metrics, diagnostic logs, and agent-collected events can have different billing rules, and retention and alerting can add costs too. Set a retention target and collection filters, then review actual usage before expanding.

If you mainly need charts and already have people maintaining Grafana, keeping it as the front end is reasonable. The catch is where the data lives. Sending data to an on-premises system means you need to account for network access, possible outbound transfer charges, and the work of operating and securing that storage.

For Azure Monitor, don’t rely on a single price estimate from a discussion. Rates depend on the specific service, region, and configuration. Use a limited test to measure ingestion, then check the current pricing for your chosen log tier, retention, and alerts.

I’d lean toward Azure Monitor Workbooks for Azure-specific troubleshooting, especially if the existing views already help with AVD and ExpressRoute. It keeps the investigation close to the Azure metrics and logs, and you can build a shared view instead of hopping between service pages.

That doesn’t mean every signal should go there forever. Keep the collection focused, decide how long you need detailed logs, and test whether the delay in log availability is acceptable for the alerts you care about.

For security-sensitive events, think about whether all monitoring data should remain inside the same environment it is meant to monitor. A separate destination can help preserve evidence if the monitored environment is compromised, but it also creates another system to secure and maintain. Decide which critical events need independent retention rather than exporting everything by default.

Don’t forget alert costs when comparing options. Also, metrics and logs aren’t interchangeable: decide which ones you need for dashboards, which need alerting, and which are only useful during an investigation. A short pilot with a few representative VMs should give you a much better cost signal than enabling every available diagnostic setting at once.