Auto-Provisioning Log Analytics Agent in Defender for Cloud
A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure environment. They want to ensure that the Log Analytics agent is automatically installed on all new Azure virtual machines as soon as they are provisioned, to collect security logs. Which feature should they enable in Defender for Cloud?
Quick Answer
The answer is to enable auto-provisioning of the Log Analytics agent in Defender for Cloud’s environment settings. This feature is technically designed to automatically deploy the Log Analytics agent onto all existing and new Azure virtual machines, ensuring that security logs are collected from the moment a VM is provisioned without requiring manual intervention. On the Microsoft Azure Security Engineer Associate AZ-500 exam, this scenario tests your understanding of Defender for Cloud’s data collection policies, often appearing as a straightforward configuration question where the trap is confusing auto-provisioning with manual agent installation or with Azure Policy-based solutions. A common memory tip is to think of “auto-provisioning” as the one-click switch that enforces agent deployment across your entire subscription, directly linking the keyword “auto” to the requirement for automatic installation on new VMs.
⚠ Common exam trap
Many exam-takers confuse Azure Policy-based deployment (Option C) with Defender for Cloud's native auto-provisioning, but the question specifically asks for the feature within Defender for Cloud's environment settings, which is auto-provisioning, not a separate policy assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Defender for Cloud's auto-provisioning feature is specifically designed to automatically install the Log Analytics agent on all existing and new Azure VMs to collect security logs. When enabled in the environment settings, it ensures that any new VM provisioned in the subscription gets the agent installed without manual intervention, directly addressing the requirement for automatic installation on new VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Collection Rules (DCR) in Azure Monitor.
Why it's wrong here
Data Collection Rules define what data the Azure Monitor agent sends and where, but they do not provision agents onto virtual machines. They are the right choice when routing or filtering telemetry from already-onboarded machines, not for automatic installation at provisioning time.
- ✓
Auto-provisioning of the Log Analytics agent in Defender for Cloud's environment settings.
Why this is correct
Auto-provisioning installs the Log Analytics agent automatically on newly created and existing Azure VMs, using the workspace configured in environment settings. This satisfies the requirement that new VMs receive the agent immediately at provisioning without manual installation.
- ✗
Azure Policy 'Deploy Log Analytics agent for Linux/Windows VM'.
Why it's wrong here
This Azure Policy audits and deploys the agent, but it is the compliance mechanism rather than the Defender for Cloud feature that auto-provisions the agent on new VMs. It is tempting because policy-based deployment genuinely installs agents, yet the question asks which Defender for Cloud setting enables automatic provisioning.
- ✗
Use Azure Automation State Configuration.
Why it's wrong here
Azure Automation State Configuration manages desired-state configuration of existing machines via DSC; it does not hook into VM provisioning to install the Log Analytics agent. It is tempting where ongoing configuration drift correction across a fleet is the requirement, rather than onboarding newly provisioned VMs.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team uses Microsoft Defender for Cloud to monitor the security posture of their Azure subscription. They want to ensure that whenever a new virtual machine is created, the Log Analytics agent is automatically installed to collect security events. Which feature should they configure in Defender for Cloud?
easy- A.Automation rules
- ✓ B.Auto-provisioning settings
- C.Security contacts
- D.Workflow automation
Why B: Auto-provisioning settings in Microsoft Defender for Cloud automatically deploy the Log Analytics agent to all supported Azure VMs and new ones as they are created. This ensures that security events are collected without manual intervention, directly addressing the requirement for automatic installation on new VMs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.