Azure Arc Monitoring for Hybrid VMs

Azure Arc is a hybrid management platform that extends Azure Resource Manager (ARM) control plane to non-Azure environments. For monitoring, it allows you to manage and monitor servers running outside Azure—on-premises, in other clouds (AWS, GCP), or at the edge—using the same tools and policies as native Azure VMs. The exam focuses on Azure Arc-enabled servers (not Kubernetes or data services). The key benefit: you can use Azure Monitor, Azure Policy, Microsoft Defender for Cloud, and Update Management across all your servers from a single pane of glass.

Install Agent and Connect to Azure (example for Windows):

# Download and install agent
$msi = "https://aka.ms/AzureConnectedMachineAgent"
Start-BitsTransfer -Source $msi -Destination "$env:TEMP\AzureConnectedMachineAgent.msi"
Start-Process msiexec.exe -ArgumentList "/i $env:TEMP\AzureConnectedMachineAgent.msi /quiet" -Wait

# Connect to Azure
azcmagent connect --resource-group "my-rg" --tenant-id "<tenant-id>" --location "eastus" --subscription-id "<sub-id>"

Verify Connection:

azcmagent show

Output includes machine name, status (Connected/Disconnected), agent version, and last heartbeat time.

Deploy Azure Monitor Agent via CLI:

az connectedmachine extension create --name AzureMonitorWindowsAgent --type AzureMonitorWindowsAgent --publisher Microsoft.Azure.Monitor --machine-name "myHybridVM" --resource-group "my-rg" --location "eastus"

Create Data Collection Rule (DCR) via PowerShell:

New-AzDataCollectionRule -ResourceGroupName "my-rg" -Location "eastus" -RuleName "myDCR" -DataSources @{ performanceCounters = @( @{ name="perfCounter1"; streams=@("Microsoft-Perf"); performanceCounters=@(@{counterSpecifiers=@("\Processor(_Total)\% Processor Time"); samplingFrequencyInSeconds=60}) } ) } -Destinations @{ logAnalytics = @( @{ workspaceResourceId="/subscriptions/<sub-id>/resourceGroups/my-rg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace"; name="logAnalyticsDest" } ) }

Associate DCR to Machine:

az monitor data-collection rule association create --name "myAssociation" --rule-id "/subscriptions/<sub-id>/resourceGroups/my-rg/providers/Microsoft.Insights/dataCollectionRules/myDCR" --resource "/subscriptions/<sub-id>/resourceGroups/my-rg/providers/Microsoft.HybridCompute/machines/myHybridVM"

A large financial institution has 500 Windows and Linux servers across three data centers. They use Azure Arc to bring these servers under Azure Monitor. The team deploys the Connected Machine agent using a Configuration Manager task sequence (Windows) and a shell script (Linux) with a service principal for authentication. They create a single Data Collection Rule that collects common performance counters (CPU, memory, disk) and critical Windows Event Logs (Security, Application, System) and syslog (auth, kern). The DCR sends data to a centralized Log Analytics workspace. They set up dashboards and alerts for disk space >90%, CPU >80%, and failed logins. The benefits: unified view, no need for separate monitoring tools, and ability to use Azure Workbooks. Common issues: network proxy configuration; the agent must be configured with proxy URL if servers require proxy for outbound traffic. Also, if the Log Analytics workspace is in a different region, data egress charges apply.

A healthcare company must audit and secure servers across on-premises and AWS. They onboard all servers to Azure Arc and enable Microsoft Defender for Cloud. They use Azure Policy to automatically deploy the Connected Machine agent and AMA to new servers. Defender for Cloud provides vulnerability assessments, file integrity monitoring, and adaptive application controls. They also collect security events via DCR and use Azure Sentinel for SIEM. The challenge: some legacy servers run Windows Server 2008 R2, which is not supported by the AMA; they must use the Log Analytics agent instead. Also, Defender for Cloud requires the Log Analytics agent for some features, so they plan a migration. Performance: the AMA uses about 1-2% CPU and 50 MB memory per server, acceptable for most workloads.

A retail company uses Azure Automation Update Management to patch 200 Arc-enabled servers. They deploy the Log Analytics agent (required for Update Management) and link the workspace to an Automation account. They schedule monthly patching windows. The DCR collects update compliance data. They use Azure Monitor alerts to notify when updates are missing or installation fails. Pitfalls: the Log Analytics agent must be version 10.0.0 or later; the Automation account and workspace must be in the same region. If the server is disconnected for more than 30 days, it must be re-onboarded, and the Update Management enrollment is lost.