Azure Monitor & Agents
Azure Monitor Agent · Data collection rules · Azure Arc · VM insights
Practice questions for this topic →
Data sources
| Data | Collected by default? | How to collect / route |
|---|---|---|
| Platform metrics | Yes | Diagnostic setting to send elsewhere |
| Activity log (control plane) | Yes | Diagnostic setting to a workspace for longer retention and KQL |
| Resource logs (data plane) | No | Diagnostic setting |
| Guest OS logs and performance (VMs, servers) | No | Azure Monitor Agent + a data collection rule (DCR) |
| Application telemetry | No | Application Insights |
Agents
| Agent | Status | Notes |
|---|---|---|
| Azure Monitor Agent (AMA) | Current | Configured by DCRs; replaces the Log Analytics agent (MMA/OMS) for Windows and Linux in Azure, on-prem and other clouds |
| Log Analytics agent (MMA/OMS) | Retired Aug 31, 2024 | Cloud ingestion for it is being shut down; uploads can stop at any time after Mar 2, 2026. Exception: an agent connected exclusively to on-prem SCOM isn't affected |
| Azure Arc Connected Machine agent | Current | Makes on-prem and other-cloud servers Azure resources so AMA, Policy and Defender can target them |
| Dependency agent | Optional | Only for the VM insights Map feature (processes and dependencies) |
Migration facts
- Use the Azure Monitor Agent Migration Helper workbook to inventory agents, audit workspaces, identify dependent services and track progress.
- Both agents can run side by side during migration, but collecting the same data twice raises ingestion cost: validate AMA, then remove the legacy agent.
- AMA needs data collection rules; VM insights on AMA creates or downloads one for you.
Exam Tips
Tick each tip once you can answer it without looking.
“Collect Windows event logs and Linux syslog from VMs into a workspace” → Azure Monitor Agent + a data collection rule. Trap: The Log Analytics agent (MMA) is retired.
“Monitor on-premises or AWS servers with Azure Monitor” → Install Azure Arc first, then Azure Monitor Agent via a DCR.
“Collect only specific events (filter) to reduce ingestion cost” → DCR with XPath / transformation filters.
“Same VM must send data to two workspaces (ops and security)” → AMA with multiple DCRs / destinations. Trap: MMA multi-homing is legacy.
“Show which processes and ports VMs talk to” → VM insights Map (Dependency agent).
“Monitor request rates, failures and dependencies of a web app” → Application Insights (workspace-based).
“Need resource logs (e.g. Key Vault access logs)” → Create a diagnostic setting. Trap: Resource logs aren't collected by default.
“Deploy AMA + DCR to every VM automatically, including new ones” → Azure Policy (deployIfNotExists) initiative.
“Log Analytics agent connected only to on-premises SCOM” → Not affected by the MMA retirement. Trap: Every other MMA use retired Aug 31, 2024.
“Track migration from the Log Analytics agent to AMA” → Azure Monitor Agent Migration Helper workbook. Trap: Run both agents side by side only during migration to avoid duplicate ingestion.