The answer is to enable auto-provisioning of the Log Analytics agent in Defender for Cloud’s environment settings. This feature is technically designed to automatically deploy the Log Analytics agent onto all existing and new Azure virtual machines, ensuring that security logs are collected from the moment a VM is provisioned without requiring manual intervention. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of Defender for Cloud’s data collection policies, often appearing as a straightforward configuration question where the trap is confusing auto-provisioning with manual agent installation or with Azure Policy-based solutions. A common memory tip is to think of “auto-provisioning” as the one-click switch that enforces agent deployment across your entire subscription, directly linking the keyword “auto” to the requirement for automatic installation on new VMs.
AZ-500 Practice Question: Auto-provisioning is a Defender for Cloud feature.
This AZ-500 practice question tests your understanding of manage identity and access. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: auto-provisioning is a Defender for Cloud feature.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Option B is correct because Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.
Key principle: Auto-provisioning is a Defender for Cloud feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Data Collection Rules (DCR) in Azure Monitor.
Why it's wrong here
DCRs define how data is collected after the agent is installed, but do not install the agent.
✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Why this is correct
This setting automatically installs the agent on new VMs and monitors for compliance.
Related concept
Auto-provisioning is a Defender for Cloud feature.
✗
Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.
Why it's wrong here
This is an Azure Policy initiative, not a Defender for Cloud-specific feature, though it can achieve the same result.
✗
Use Azure Automation State Configuration.
Why it's wrong here
State Configuration is for configuration management, not agent deployment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Azure Policy-based deployment (Option C) with Defender for Cloud's native auto-provisioning, but the question specifically asks for the feature within Defender for Cloud's environment settings, which is auto-provisioning, not a separate policy assignment.
Detailed technical explanation
How to think about this question
Under the hood, Defender for Cloud's auto-provisioning uses an Azure Policy initiative (built-in) that deploys the Log Analytics agent extension to VMs at creation time, leveraging the VM extension framework. This feature also handles agent health monitoring and can automatically upgrade the agent, ensuring continuous security log collection without manual policy assignment. In a real-world scenario, if auto-provisioning is disabled, new VMs will not have the agent installed, leading to gaps in security monitoring until a manual or policy-based deployment is triggered.
KKey Concepts to Remember
Auto-provisioning is a Defender for Cloud feature.
It automatically installs the Log Analytics agent on new VMs.
Enables immediate security log collection for Defender for Cloud.
Configured within Defender for Cloud's environment settings.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Auto-provisioning is a Defender for Cloud feature.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Manage identity and access — This question tests Manage identity and access — Auto-provisioning is a Defender for Cloud feature..
What is the correct answer to this question?
The correct answer is: Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings. — Option B is correct because Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.
What should I do if I get this AZ-500 question wrong?
Review auto-provisioning is a Defender for Cloud feature., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Auto-provisioning is a Defender for Cloud feature.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to ensure that whenever a new virtual machine is created, the Log Analytics agent is automatically installed to collect security events. Which feature should they configure in Defender for Cloud?
easy
A.Automation rules
✓ B.Auto-provisioning settings
C.Security contacts
D.Workflow automation
Why B: Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.