liveBook · Manning

Azure Monitor agent

As explained in Azure Security

Azure Monitor Agent is Microsoft's agent for collecting and routing monitoring data from Azure resources and connected machines to supported Azure monitoring services.

Azure Monitor agent (AMA) collects guest operating system data from Azure virtual machines running Windows or Linux. It supports security monitoring by routing selected events and performance data to Azure monitoring destinations, where they can support investigation of suspicious activity and signs of compromise. section 9.1.4 section 9.10

AMA is the successor direction for the Log Analytics agent. A key reason to use it is multihoming: data collection rules can send performance data and security events to different Log Analytics workspaces, helping avoid placing lower-security-value performance data in a workspace that incurs Microsoft Sentinel ingestion charges. section 9.1.4

Deploy AMA with its operational dependencies in mind:

  • Grant deployment permissions, including Virtual Machine Contributor, Azure Connected Machine Resource Administrator, and Log Analytics Contributor or a role with Microsoft.Resources/deployments/*. section 9.1.4
  • Provide HTTPS access to the handler control endpoints and the target Log Analytics workspace ingestion endpoint. section 9.1.4
  • Enable a managed identity. Either system-assigned or user-assigned identities work; favor user-assigned identities for large-scale deployments. section 9.1.4 section 9.4.1
  • Install the AzureMonitorWindowsAgent VM extension with Azure CLI when configuring Windows VMs directly, optionally enabling automatic extension upgrades. section 9.1.4

Collect Linux authentication data

Create a data collection rule in Azure Monitor, choose Linux, add the target VMs, and define the required data sources and destinations. Selecting Azure VMs during this flow automatically installs AMA. When using a data collection endpoint, place it in the same region as the connected agents; use one endpoint per agent region. section 9.4.1

Table 9.3 Prerequisites for installing AMA on your Azure VMs (view table figure)

Permissions

Networking

Authentication

The Virtual Machine Contributor role on VMs

The Azure Connected Machine Resource Administrator role on VMs

The Log Analytics Contributor role on your VMs (or any other role that includes the action Microsoft .Resources/deployments/*)

The VMs must have access to the following HTTPS endpoints:

  • global.handler.control.monitor.azure.com
  • <your-VMs-region-name>.handler.control.monitor.azure.com
  • <log-analytics-workspace-id>.ods.opinsights.azure.com

Managed identities must be enabled on your VMs.

You can use either a user- or system-assigned managed identity.

Review the required roles, network endpoints, and managed-identity configuration before installing AMA on Azure VMs. section 9.1.4

AMA integration availability can vary by Azure service. Although AMA is generally available, its Microsoft Defender for Cloud integration is identified as public preview, while the Log Analytics agent integration is generally available; assess that distinction before choosing an agent for production Defender for Cloud workflows. section 9.1.4 section 6.2.1

How Azure Security covers it

How deep it goes
Explains prerequisites, CLI installation, managed identities, regional endpoints, and DCR-based collection routing.
Examples
Walks through a Linux authentication-data DCR and an Azure CLI Windows VM extension installation.
What it assumes
Assumes access to Azure VMs, Azure roles, HTTPS connectivity, and managed identities while guiding DCR creation.
What you can do after
Operate/configure it by installing AMA and defining DCRs that select VM data sources and destinations.
How it connects
Connects Data Collection Rules, Log Analytics workspaces, managed identities, Microsoft Sentinel, and Microsoft Defender for Cloud.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain Azure Monitor agent →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.