Change Tracking and Inventory

Change Tracking and Inventory are features of Azure Automation that provide visibility into configuration changes and software inventory on Azure VMs, on-premises machines, and other cloud VMs (AWS, GCP) connected to Azure. Change Tracking monitors changes to:

Inventory collects and displays metadata about installed software, Windows services, Linux daemons, and Windows registry keys.

In any production environment, configuration drift—unintended changes to system settings, installed software, or services—can lead to security vulnerabilities, compliance violations, or application failures. Change Tracking provides an audit trail of who changed what and when, enabling rapid root cause analysis. Inventory helps maintain an up-to-date catalog of software assets for licensing, compliance, and vulnerability management.

Change Tracking and Inventory rely on the Log Analytics agent (formerly Microsoft Monitoring Agent) or the Azure Monitor Agent (AMA). The agent is installed on each VM and communicates with a Log Analytics workspace over HTTPS (port 443). The workspace stores change events and inventory data. An Automation Account is required to manage the feature configuration and to run the tracking solution.

Data Collection Flow: 1. On each VM, the agent collects configuration snapshots at regular intervals (default: every 15 minutes for files and registry, every 30 minutes for services and software). 2. The agent compares the current snapshot with the previous snapshot stored locally. 3. If a change is detected, the agent sends the change event (old value, new value, timestamp, user/process that made the change) to the Log Analytics workspace. 4. The workspace indexes the data and makes it queryable via Log Analytics queries or the Azure portal. 5. Inventory data is collected less frequently (default: every 24 hours) and includes a full list of installed software, services, and daemons.

Agent Communication: The agent uses the Azure Monitor Agent (AMA) for new deployments, but the legacy Log Analytics agent is still supported. The AMA uses data collection rules (DCRs) to define what to collect. For Change Tracking and Inventory, the solution requires the Microsoft.EnterpriseManagement.Monitoring solution installed in the Log Analytics workspace.

- Log Analytics Workspace: Required. Stores all change and inventory data. Must be in the same region as the Automation Account for Change Tracking. - Automation Account: Required. Hosts the Change Tracking and Inventory solution configuration. Linked to the Log Analytics workspace. - Azure Monitor Agent (AMA) or Log Analytics Agent: Installed on each VM. AMA is recommended for new deployments. - Data Collection Rules (DCRs): For AMA, you define which logs and performance counters to collect. For Change Tracking, you must add the appropriate DCRs. - Default Collection Frequencies: - Files and Registry: every 15 minutes - Services and Software: every 30 minutes - Inventory: every 24 hours - Retention: Change data is retained in the Log Analytics workspace according to the workspace’s retention policy (default 30 days for free tier, 31 days for paid tiers, configurable up to 730 days). - File Tracking: You can specify file paths (including wildcards) to monitor. For Windows, you can also monitor registry keys. - Inventory: Collects software from Windows (registry Uninstall key) and Linux (RPM/DPKG databases).

Enable Change Tracking and Inventory via Portal: 1. Navigate to Automation Account > Change Tracking and Inventory. 2. Select the Log Analytics workspace. 3. Choose VMs to enable (Azure VMs or non-Azure machines). 4. For Azure VMs, the agent can be automatically installed. For non-Azure, install manually.

Enable via PowerShell:

$automationAccount = Get-AzAutomationAccount -ResourceGroupName 'RG' -Name 'AutoAcc'
$workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName 'RG' -Name 'LAW'
$solution = New-AzOperationalInsightsSolution -Workspace $workspace -Product 'ChangeTracking' -Publisher 'Microsoft' -PlanName 'ChangeTracking' -Offer 'OMSGallery'

Query changes using Log Analytics:

ConfigurationChange
| where TimeGenerated > ago(24h)
| where ConfigChangeType == 'Software'
| project TimeGenerated, Computer, SoftwareName, OldValue, NewValue

Manual agent installation on Windows:

msiexec /i 'MMASetup-AMD64.exe' /qn ADD_OPINSIGHTS_WORKSPACE_ID=<WorkspaceID> OPINSIGHTS_WORKSPACE_KEY=<PrimaryKey>

Enterprise Scenario 1: Compliance Auditing for Financial Services A financial services company must comply with PCI DSS, which requires tracking all changes to critical system files and registry keys on payment processing servers. They deploy Change Tracking on 200 Windows Server VMs. They configure file tracking for C:\Program Files\PaymentApp\*.config and registry tracking for HKLM\Software\PaymentApp. The Log Analytics workspace retains data for 1 year. The compliance team runs weekly queries to generate change reports. They also set up alerts for any changes to the payment application configuration files, triggering an incident response. The biggest challenge is data volume—each VM sends change events every 15 minutes, resulting in ~10 GB of data per month. They optimize by filtering out known-good changes (e.g., scheduled updates) using Log Analytics queries.

Enterprise Scenario 2: Software License Management in a Large Enterprise A multinational corporation with 10,000 VMs uses Inventory to track software installations across Azure and on-premises. They need to ensure no unlicensed software is installed and to plan for license renewals. Inventory collects software names, versions, and publishers. The IT team runs monthly reports to identify unauthorized software (e.g., any instance of a non-approved media player). They also use Inventory to identify VMs with outdated software for patching. The scale requires careful cost management; they use data collection rules to exclude certain software categories (e.g., standard OS components) to reduce data ingestion. A common issue is that Inventory may miss software installed outside standard locations (e.g., portable apps), so they combine Inventory with Change Tracking for file-level monitoring.

Scenario 3: Security Incident Investigation A security team suspects a breach after a critical service stopped running. They use Change Tracking to see if any services were modified. They query: ConfigurationChange | where ConfigChangeType == 'WindowsServices' | where Computer == 'SQLServer01' | project TimeGenerated, ServiceName, OldState, NewState, InitiatingUser. They find that the SQL Server service was stopped by an unknown user at 2:00 AM. They also check file changes and find that a DLL was replaced. This evidence helps them contain the incident and patch the vulnerability. Without Change Tracking, they would have had to manually inspect logs from multiple sources.