liveBook · Manning

Multihoming

As explained in Azure Security

Multihoming is the configuration of a monitoring agent to send collected data to multiple destinations or workspaces.

Multihoming sends different data collected from Azure virtual machines to multiple Log Analytics workspaces. Separating performance data from security events can reduce Sentinel-related ingestion costs when performance data provides limited security value. section 9.1.4

Azure Monitor Agent supports multihoming through data collection rules. A single agent can collect logs and performance counters from Windows or Linux VMs, while DCRs determine which data types go to which destinations. section 9.1.4 section 9.4.1

Configure multihoming by following this sequence:

  • Install AMA on the target VMs and use managed identity authentication; automatic extension upgrades can be enabled during installation. section 9.1.4
  • Create a DCR and select the required data sources, such as Linux authentication logs or performance counters. section 9.4.1
  • Add destinations for the selected data, assigning different data types to multiple Log Analytics workspaces where appropriate. section 9.4.1
  • Review and create the DCR, then use the collected data with monitoring and alert rules to identify anomalous usage. section 9.4.1
Table 9.3 Prerequisites for installing AMA on your Azure VMs (view table figure)

Permissions

Networking

Authentication

The Virtual Machine Contributor role on VMs

The Azure Connected Machine Resource Administrator role on VMs

The Log Analytics Contributor role on your VMs (or any other role that includes the action Microsoft .Resources/deployments/*)

The VMs must have access to the following HTTPS endpoints:

  • global.handler.control.monitor.azure.com
  • <your-VMs-region-name>.handler.control.monitor.azure.com
  • <log-analytics-workspace-id>.ods.opinsights.azure.com

Managed identities must be enabled on your VMs.

You can use either a user- or system-assigned managed identity.

Check required permissions, HTTPS endpoints, and managed identity settings before installing AMA on Azure VMs. section 9.1.4

Figure 9.9 Adding data sources when creating DCRs

Use the data-source configuration view to choose which logs or performance data the DCR collects before assigning destinations. section 9.4.1

How Azure Security covers it

How deep it goes
Explains the AMA-and-DCR workflow, destination selection, prerequisites, and data-type limitations without detailing DCR internals.
Examples
Uses Linux authentication logs, performance counters, separate workspaces, and a subscription-wide security-log DCR exercise.
What it assumes
Assumes Azure VM administration and requires specified roles, HTTPS access to Azure endpoints, and a user- or system-assigned managed identity.
What you can do after
Operate/configure multihoming by installing AMA, creating DCRs, selecting data sources, and routing them to multiple destinations.
How it connects
Connects Azure Monitor Agent, data collection rules, Log Analytics workspaces, Microsoft Sentinel, managed identities, and alert rules.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.