Auto-Provisioning Log Analytics Agent in Defender for Cloud
A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?
Quick Answer
The answer is to enable auto-provisioning of the Log Analytics agent in Defender for Cloud’s environment settings. This feature is technically designed to automatically deploy the Log Analytics agent onto all existing and new Azure virtual machines, ensuring that security logs are collected from the moment a VM is provisioned without requiring manual intervention. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of Defender for Cloud’s data collection policies, often appearing as a straightforward configuration question where the trap is confusing auto-provisioning with manual agent installation or with Azure Policy-based solutions. A common memory tip is to think of “auto-provisioning” as the one-click switch that enforces agent deployment across your entire subscription, directly linking the keyword “auto” to the requirement for automatic installation on new VMs.
⚠ Common exam trap
Many exam-takers confuse Azure Policy-based deployment (Option C) with Defender for Cloud's native auto-provisioning, but the question specifically asks for the feature within Defender for Cloud's environment settings, which is auto-provisioning, not a separate policy assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Collection Rules (DCR) in Azure Monitor.
Why it's wrong here
DCRs define how data is collected after the agent is installed, but do not install the agent.
- ✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Why this is correct
This setting automatically installs the agent on new VMs and monitors for compliance.
- ✗
Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.
Why it's wrong here
This is an Azure Policy initiative, not a Defender for Cloud-specific feature, though it can achieve the same result.
- ✗
Use Azure Automation State Configuration.
Why it's wrong here
State Configuration is for configuration management, not agent deployment.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to ensure that whenever a new virtual machine is created, the Log Analytics agent is automatically installed to collect security events. Which feature should they configure in Defender for Cloud?
easy- A.Automation rules
- ✓ B.Auto-provisioning settings
- C.Security contacts
- D.Workflow automation
Why B: Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.