You need to specify Log Analytics as the source for this alert, and not the VM as source for the alert. 1. You create an Azure Log Analytics workspace and configure the data settings. 2. You install the Microsoft Monitoring Agent on VM1. 3. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview