This chapter covers Azure VM Insights and the Dependency Agent, critical for monitoring Azure virtual machines at scale. You will learn how VM Insights provides performance and dependency mapping, how the Dependency Agent enables deep application-level visibility, and how to configure, troubleshoot, and interpret these tools. On the AZ-104 exam, this topic appears in Domain 5.1 (Monitor resources using Azure Monitor), typically accounting for 5-10% of questions. Expect scenario-based questions where you must choose between VM Insights, Log Analytics, or the Azure Monitor agent for specific monitoring needs.
Jump to a section
Think of VM Insights as a hospital telemetry system for your Azure virtual machines. Each VM is a patient, and the Dependency Agent is a wearable biosensor that continuously monitors heart rate, oxygen levels, and location. The telemetry system (Azure Monitor) collects data from all biosensors and displays it on a central dashboard (the Map feature). When a patient's heart rate spikes, the system sends an alert to the nurse's station (Azure Alerts). The nurse can then check the patient's location (dependency mapping) and vital signs (performance metrics). The map shows which patients are connected to which IV pumps or monitors (process dependencies on TCP connections). Without the biosensor, the telemetry system only knows basic vitals like room temperature (VM-level metrics from the Azure Monitor agent). With the Dependency Agent, it sees detailed internal processes and network connections. Just as a hospital uses telemetry to detect sepsis early, Azure VM Insights detects application issues by correlating CPU spikes with a specific process that opened hundreds of outbound connections. The Dependency Agent adds the "who is talking to whom" layer, enabling root-cause analysis without logging into the VM.
What is Azure VM Insights?
Azure VM Insights is a feature of Azure Monitor that provides a quick, at-scale view of the performance and health of your Azure virtual machines (VMs) and virtual machine scale sets. It goes beyond basic metrics by offering: - Performance charts that show CPU, memory, disk, and network utilization across multiple VMs. - Dependency mapping that visualizes the network connections between processes on the VM and external resources. - Health status (if enabled via guest health) that aggregates VM health based on configured criteria.
VM Insights is built on top of two agents: the Azure Monitor agent (AMA) for performance metrics, and the Dependency Agent for network and process data. The Dependency Agent is optional but essential for the full map experience.
Why VM Insights Exists
Before VM Insights, administrators had to manually configure Log Analytics workspaces, install agents, and build custom queries to get a holistic view. VM Insights simplifies this by providing pre-built workbooks and a unified interface. It solves three key problems: 1. Performance at scale – Quickly identify which VMs are over-utilized without checking each one individually. 2. Dependency mapping – Understand inter-VM and external dependencies, crucial for troubleshooting application slowdowns or planning migrations. 3. Health monitoring – Get a summary of VM health based on guest OS metrics (requires additional configuration).
How VM Insights Works Internally
VM Insights relies on the following components: - Azure Monitor Agent (AMA) – Collects performance counters (CPU, memory, disk, network) and sends them to a Log Analytics workspace. This agent replaces the older Log Analytics agent. - Dependency Agent – Installed on the VM, it collects data about processes running on the VM and their network connections. It sends this data to the same Log Analytics workspace. - Log Analytics Workspace – The central repository where all data is stored. The workspace must be in the same region as the VM for optimal performance. - VM Insights Solution – A solution pack in the Log Analytics workspace that defines the data model and workbooks for visualizing the data. It is automatically enabled when you enable VM Insights.
The data flow:
1. The AMA collects performance metrics every 60 seconds by default (configurable).
2. The Dependency Agent collects process and connection data every 30 seconds and sends it to the workspace.
3. The Log Analytics workspace ingests the data into tables like InsightsMetrics, VMBoundPort, VMConnection, VMProcess, and VMComputer.
4. The Azure portal queries these tables and renders the performance charts and dependency map.
Key Components, Values, Defaults, and Timers
Data collection interval for AMA: 60 seconds for performance counters. You can customize via data collection rules (DCRs) to collect specific counters at different intervals.
Dependency Agent data collection: Every 30 seconds for process and connection data. This is not configurable.
Log Analytics workspace retention: By default, 30 days for all data. Can be extended to up to 730 days (2 years) for a cost.
Health criteria (Guest Health): You define rules based on performance thresholds (e.g., CPU > 90% for 5 minutes triggers unhealthy). Health is computed every 5 minutes.
Supported OS: Windows Server 2012 R2 and later, Ubuntu 16.04+, CentOS 7+, Red Hat Enterprise Linux 7+, SUSE Linux Enterprise Server 12 SP3+.
Dependency Agent version: Latest is 12.10.0 (as of 2025). It requires the .NET Framework 4.7.2 or higher on Windows.
Configuration and Verification Commands
Enable VM Insights via Azure CLI:
# For a single VM
az vm monitor enable --name MyVM --resource-group MyRG
# For multiple VMs using a Log Analytics workspace
az vm monitor enable --name MyVM --resource-group MyRG --workspace /subscriptions/.../workspaces/MyWorkspaceEnable Dependency Agent via PowerShell (if not using VM Insights wizard):
Set-AzVMExtension -ResourceGroupName "MyRG" -VMName "MyVM" -Location "eastus" -ExtensionType "DependencyAgentWindows" -Publisher "Microsoft.Azure.Monitoring.DependencyAgent" -TypeHandlerVersion "9.10"Verify installation:
- On Windows: Check C:\Program Files\Microsoft Dependency Agent\DependencyAgent.exe is running.
- On Linux: Run systemctl status dependency-agent.
- In Azure Portal: Under the VM's 'Extensions + applications' blade, ensure both AzureMonitorWindowsAgent (or Linux) and DependencyAgentWindows (or Linux) show 'Provisioning succeeded'.
Query dependency data in Log Analytics:
VMConnection
| where TimeGenerated > ago(1h)
| summarize count() by Direction, RemoteIpHow VM Insights Interacts with Related Technologies
Azure Monitor Alerts: You can create alerts based on performance metrics collected by VM Insights (e.g., CPU > 80% for 10 minutes). Use metric alerts or log alerts.
Azure Workbooks: VM Insights uses built-in workbooks for performance and map. You can customize them or create new ones.
Azure Migrate: Dependency mapping from VM Insights helps discover dependencies for migration planning. Azure Migrate can import this data directly.
Service Map: The predecessor to VM Insights. Service Map was a standalone solution; VM Insights now provides the same functionality integrated into Azure Monitor.
Azure Policy: You can enforce VM Insights enablement using Azure Policy (e.g., deploy AMA and Dependency Agent automatically to new VMs).
Trap Patterns on the Exam
Confusing VM Insights with Azure Monitor for VMs (guest health): Guest health is an add-on feature of VM Insights, not the core. The exam may ask which feature provides health rollup – answer is VM Insights with guest health enabled.
Thinking Dependency Agent alone gives performance metrics: It does not. It only provides process and connection data. Performance metrics come from AMA.
Assuming VM Insights works without a Log Analytics workspace: It does not. A workspace is mandatory. The exam may present a scenario where a VM is monitored but no workspace exists – that is invalid.
Mixing up the agents: The older Log Analytics agent (OMS) is deprecated. AZ-104 expects you to know the Azure Monitor agent (AMA) is the current agent for VM Insights. The Dependency Agent is separate and optional.
Default data retention: The exam may ask the default retention for VM Insights data – answer is 31 days (Log Analytics default).
Identify Monitoring Requirements
Begin by determining what you need to monitor. For basic performance (CPU, memory, disk, network), the Azure Monitor agent alone suffices. If you need to visualize inter-process dependencies and network connections (e.g., for troubleshooting a distributed application), you must also install the Dependency Agent. Ensure you have a Log Analytics workspace created in the same region as your VMs to minimize latency and data transfer costs.
Create or Select Log Analytics Workspace
If you do not already have a workspace, create one via Azure Portal, CLI, or PowerShell. The workspace must be in the same region as the VMs. Note the workspace ID and key, as you will need them when enabling VM Insights. For existing workspaces, ensure the 'VMInsights' solution is installed – this happens automatically when you enable VM Insights through the portal.
Install the Azure Monitor Agent
Deploy the AMA to each VM, either manually via the portal (Extensions blade), via Azure Policy (recommended for scale), or using CLI/PowerShell. The AMA collects performance counters and sends them to the workspace. On Windows, the extension is 'AzureMonitorWindowsAgent'; on Linux, 'AzureMonitorLinuxAgent'. Default collection interval is 60 seconds. You can create Data Collection Rules (DCRs) to customize which counters are collected and how often.
Install the Dependency Agent
If you need the Map feature, install the Dependency Agent. On Windows, the extension is 'DependencyAgentWindows'; on Linux, 'DependencyAgentLinux'. This agent collects process and connection data every 30 seconds. It requires the .NET Framework 4.7.2+ on Windows. It can be installed via the portal, CLI, PowerShell, or Azure Policy. The agent sends data to the same workspace as the AMA.
Enable VM Insights Solution
In the Azure Portal, navigate to 'Monitor' > 'Virtual Machines' and select the VMs you want to monitor. Click 'Enable' and choose the workspace. This action installs the 'VMInsights' solution in the workspace (if not already present) and starts data ingestion. Alternatively, you can enable via CLI: `az vm monitor enable`. After a few minutes, data will populate the performance charts and map.
Verify and Interpret Data
After enabling, wait 15-30 minutes for initial data. Go to the VM's 'Insights' blade to see performance charts (CPU, Memory, Disk, Network). Click 'Map' to see the dependency map – processes are shown as circles, and connections as lines. Verify that the map shows expected processes and connections. Use Log Analytics queries to dig deeper, e.g., `VMProcess | where TimeGenerated > ago(1h)` to see running processes. If data is missing, check agent status and firewall rules (the agents require outbound HTTPS to specific endpoints).
Scenario 1: Migration Dependency Discovery
A large enterprise is migrating 200 VMs from on-premises to Azure. The migration team needs to understand application dependencies to ensure they migrate related VMs together and avoid breaking connectivity. They enable VM Insights on all VMs (using Azure Policy to deploy AMA and Dependency Agent). The dependency map reveals that a legacy finance application running on VM-A connects to a SQL Server on VM-B and also to an on-premises file server via a site-to-site VPN. The team uses this information to plan the migration sequence: migrate the SQL Server first, then the app VM, and set up a temporary connection to the on-premises file server. Without VM Insights, they would have missed the file server dependency, causing a critical outage post-migration. Performance considerations: For 200 VMs, each Dependency Agent sends about 2-3 MB of data per day per VM, resulting in ~600 MB/day to the Log Analytics workspace. This is well within the free tier of 5 GB/day included with Azure Monitor, but beyond that, data ingestion costs apply ($2.30/GB ingested). The team also creates a Log Analytics saved query to alert if any VM loses dependency data for more than 30 minutes, indicating an agent failure.
Scenario 2: Troubleshooting Application Performance Degradation
A web application hosted on a set of VMs behind a load balancer is experiencing intermittent slow responses. The operations team uses VM Insights to check CPU and memory – all normal. They then open the Map view for one of the VMs and notice that the process 'w3wp.exe' (IIS) has an unusually high number of outbound connections to an IP address that is not the database server. Further investigation reveals that the VM is infected with malware making outbound calls. The team isolates the VM, removes the malware, and restores service. They also create a log alert for any process on any VM that opens more than 500 outbound connections within 5 minutes. This scenario highlights the power of the Dependency Agent – without it, they would only see high network outbound (a generic metric) and would not know which process was responsible.
Scenario 3: Capacity Planning for a Cloud-Native Application
A SaaS company runs a microservices application on 50 VMs in Azure. They need to right-size their VMs based on actual usage. VM Insights provides historical performance data via workbooks. They analyze the 90th percentile CPU and memory usage over 30 days and find that most VMs are over-provisioned (e.g., D4s v3 VMs with 4 vCPUs rarely exceed 20% CPU). They downsize to D2s v3 VMs, saving 50% on compute costs. However, they also notice via the Map that the 'gateway' VM has high network throughput and memory pressure – they upgrade that single VM to a memory-optimized series. The data collection interval of 60 seconds is sufficient for capacity planning; they do not need sub-minute granularity. Misconfiguration trap: If they had enabled VM Insights without the Dependency Agent, they would have missed the network flow details needed to identify the gateway as the bottleneck.
AZ-104 Objective 5.1: Monitor resources using Azure Monitor
This objective includes configuring and interpreting VM Insights. The exam tests your ability to:
Enable VM Insights (via portal, CLI, Azure Policy).
Understand the role of the Azure Monitor agent and Dependency Agent.
Interpret the performance charts and dependency map.
Configure health monitoring (guest health) – though this is less emphasized.
Common Wrong Answers on Exam Questions
Choosing 'Log Analytics agent' instead of 'Azure Monitor agent' – The exam may ask which agent is required for VM Insights. The correct answer is Azure Monitor agent. The older Log Analytics agent is deprecated and not used for new deployments. Candidates often pick the familiar-sounding 'Log Analytics agent'.
Selecting 'Dependency Agent only' for performance metrics – Some questions ask what is needed for CPU/memory charts. The Dependency Agent does not collect performance counters; it collects process/connection data. The correct answer is the Azure Monitor agent (or the combination).
Thinking VM Insights works without a Log Analytics workspace – Every VM Insights deployment requires a workspace. A question might describe a scenario where VM Insights is enabled but no workspace exists – that is invalid. The correct action is to create or select a workspace.
Mixing up 'Service Map' and 'VM Insights' – Service Map is the older version. The exam may refer to 'Service Map' but the correct term is 'VM Insights'. If a question asks for the current solution, pick VM Insights.
Specific Numbers and Values That Appear on the Exam
Default data collection interval: 60 seconds for performance, 30 seconds for dependency.
Default retention: 31 days (Log Analytics default).
Supported OS: Windows Server 2012 R2+, Ubuntu 16.04+, RHEL 7+, CentOS 7+, SLES 12 SP3+.
Dependency Agent version handler: 9.10 for Windows, 9.10 for Linux (as of recent exam updates).
Extension publishers: 'Microsoft.Azure.Monitoring.DependencyAgent' and 'Microsoft.Azure.Monitor.AzureMonitorWindowsAgent'.
Edge Cases and Exceptions
VMs in a different region than the workspace: Works but incurs egress costs and higher latency. The exam may test that the workspace should be in the same region for optimal performance.
VMs without outbound internet access: The agents require connectivity to the Log Analytics service. If VMs are isolated, you must use a Log Analytics gateway or configure firewall rules to allow the endpoints. The exam may present a scenario where VMs are in a locked-down network and ask what to do – answer: configure the Log Analytics gateway.
Linux VMs without .NET: The Dependency Agent on Linux does not require .NET, but on Windows it requires .NET Framework 4.7.2+. A question might ask why the Dependency Agent fails to install on a Windows Server 2012 R2 VM – answer: missing .NET Framework.
How to Eliminate Wrong Answers
If a question asks about 'performance metrics', eliminate any option that mentions Dependency Agent alone.
If a question asks about 'dependencies', eliminate options that mention only the Azure Monitor agent.
Look for keywords: 'process', 'connections', 'map' indicate Dependency Agent. 'CPU', 'memory', 'disk' indicate Azure Monitor agent.
Remember that VM Insights is a feature of Azure Monitor, not a separate service.
VM Insights requires a Log Analytics workspace – always remember this.
The Azure Monitor agent collects performance metrics; the Dependency Agent collects process and connection data.
Default data collection intervals: AMA every 60 seconds, Dependency Agent every 30 seconds.
Default Log Analytics retention is 31 days.
VM Insights can be enabled via Azure CLI: `az vm monitor enable`.
The Dependency Agent is optional – needed only for Map feature.
For scale, use Azure Policy to deploy agents automatically.
These come up on the exam all the time. Here's how to tell them apart.
Azure Monitor Agent (AMA)
Collects performance counters: CPU, memory, disk, network.
Sends data every 60 seconds (configurable via DCR).
Required for VM Insights performance charts.
Works on Windows and Linux.
Supports Data Collection Rules for granular control.
Dependency Agent
Collects process and network connection data.
Sends data every 30 seconds (not configurable).
Required for VM Insights Map feature.
Requires .NET Framework 4.7.2+ on Windows.
Does not collect performance metrics.
Mistake
VM Insights requires both the Azure Monitor agent and the Dependency Agent to function.
Correct
VM Insights can work with only the Azure Monitor agent for performance charts. The Dependency Agent is optional and only needed for the Map feature (dependency visualization). You can enable VM Insights without the Dependency Agent and still see performance data.
Mistake
The Dependency Agent collects CPU and memory metrics.
Correct
The Dependency Agent does not collect any performance counters. It only collects data about running processes and their network connections (source/destination IP, port, protocol, process name). CPU and memory metrics come from the Azure Monitor agent.
Mistake
VM Insights can be enabled without a Log Analytics workspace.
Correct
A Log Analytics workspace is mandatory. VM Insights stores all its data in a workspace. If you try to enable VM Insights without specifying a workspace, the portal will prompt you to create one. The workspace must be in the same region as the VMs for optimal performance.
Mistake
The older Log Analytics agent (OMS) is still the recommended agent for VM Insights.
Correct
The Log Analytics agent is deprecated. Microsoft recommends using the Azure Monitor agent (AMA) for all new deployments. The AMA provides better performance, supports Data Collection Rules, and is the only agent that works with VM Insights for new VMs.
Mistake
VM Insights data is stored indefinitely by default.
Correct
By default, data in Log Analytics is retained for 31 days. You can increase retention to up to 730 days, but that incurs additional costs. The exam expects you to know the default retention period.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
VM Insights is the current name for what was previously called Azure Monitor for VMs. They are the same feature. Microsoft rebranded it to VM Insights. The exam may use either term, but expect 'VM Insights' as the modern name.
Yes, VM Insights can monitor on-premises VMs if they have the Azure Monitor agent and Dependency Agent installed and can communicate with Azure Log Analytics. However, the exam context is usually Azure VMs. For on-premises, you need to ensure network connectivity via ExpressRoute or VPN, and the agents must be able to reach the Log Analytics endpoints.
Common reasons: (1) Dependency Agent is not installed or not running. (2) The VM has no outbound internet connectivity to the Log Analytics service. (3) Data takes 15-30 minutes to appear after first installation. (4) The Log Analytics workspace does not have the VMInsights solution enabled – check under 'Workspace' > 'Solutions'. (5) The VM is running an unsupported OS.
You can create a log alert using Kusto queries on the `InsightsMetrics` or `VMConnection` tables. For example, to alert when CPU > 90% for 5 minutes: create a log alert with query `InsightsMetrics | where Computer == 'MyVM' and Namespace == 'Processor' and Name == 'UtilizationPercentage' and Val > 90` and set the time window to 5 minutes. Alternatively, use metric alerts on the same data if you have configured the AMA to send to Azure Monitor Metrics.
VM Insights itself is free, but you pay for data ingestion into Log Analytics (first 5 GB/month free, then $2.30/GB). There is no additional cost for the Dependency Agent or the Azure Monitor agent. If you enable guest health, there is a per-VM cost (approx. $0.10/VM/month). Data retention beyond 31 days incurs additional storage costs.
Yes, VM Insights supports virtual machine scale sets. You can enable it on the scale set resource, and it will monitor all instances. The agents must be installed on each instance, which can be done via extension profile in the scale set model.
The Dependency Agent is updated automatically by the Azure extension framework when a new version is published. You can also manually trigger an update by disabling and re-enabling the extension. The exam does not require deep knowledge of update procedures, but you should know that it is managed as a VM extension.
You've just covered VM Insights and Dependency Agent — now see how well it sticks with free AZ-104 practice questions. Full explanations included, no account needed.
Done with this chapter?