VM_AGENTS_EXTENSIONS.md

Azure VM Agents and Extensions

VM Agents and Extensions Security Responsibilities

Azure Monitor Agent

Azure Monitor Agent is implemented as an Azure VM extension with the details in the following table. You can install it by using any of the methods to install virtual machine extensions including the methods described in this article.

Property	Windows	Linux
Publisher	Microsoft.Azure.Monitor	Microsoft.Azure.Monitor
Type	AzureMonitorWindowsAgent	AzureMonitorLinuxAgent
TypeHandlerVersion	See Azure Monitor agent extension versions	Azure Monitor agent extension versions

New Capabilities

• Ingestion-Time Transformations
• Filtering
• Scoping
• Multi-Homing

Considerations

• Prerequisites
  • Permissions
    • Deployment/Management
  • Azure/Non-Azure
    • To install the agent on physical servers and virtual machines hosted outside of Azure (that is, on-premises) or in other clouds, you must install the Azure Arc Connected Machine agent first, at no added cost.
  • Authentication
    • Managed identity must be enabled on Azure virtual machines. Both user-assigned and system-assigned managed identities are supported.
  • Networking
    • Access
      • global.handler.control.monitor.azure.com
      • <virtual-machine-region-name>.handler.control.monitor.azure.com
        • example: eastus2.handler.control.azure.com
        • example: centralus.handler.control.azure.com
      • <log-analytics-workspace-id>.ods.opinsights.azure.com
• Installation
• Configuration
• Disk Space
• Log Rotation
• Log Retention
• Data Collection Rule(s)
  • Sentinel Syslog Forwarder Data Collection Rule

Filepaths

• /var/opt/microsoft/azuremonitoragent
• /etc/opt/microsoft/azuremonitoragent/mdsd.xml
• /etc/rsyslog.d/10-azuremonitoragent.conf
• /run/azuremonitoragent/
• /etc/logrotate.d/rsyslog
• /etc/rsyslog.conf

Discover VM Extensions

az vm extension image list

az deployment group create --resource-group "" --template-file "" --parameters "@<parameter-filename.json>"

References

GitHub

• GitHub - Open Management Infrastructure
• GitHub - Azure VM Linux Extensions

YouTube

• Everything You Ever Wanted to Know About Using the New Azure Monitor Agent with Microsoft Sentinel

Official Documentation

• Discover VM Extensions for Linux
• Discover VM Extensions for Windows
• Automatic Extension Upgrade
• Microsoft Sentinel Support for Ingestion Time Data
• Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions

Blogs

• Sentinel Syslog Forwarder with Azure Monitor Agent
• Understanding the security responsibilities of Azure VM Agents and Extensions