> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Monitoring Agent is not provisioned ### More Info: Automatic provisioning of monitoring agent should be set. ### Risk Level Medium ### Address Security, Operational Maturity ### Compliance Standards CBP, CIS Microsoft Azure Foundations ### Triage and Remediation ### Remediation Below are step‑by‑step console instructions to fix “Monitoring Agent is not provisioned” in Azure Security Center (now Microsoft Defender for Cloud). The goal: 1. Have a Log Analytics workspace, and 2. Enable the Azure Monitor Agent (or MMA, depending on your setup) on all relevant resources so Defender for Cloud can collect data. *** ## 1. Verify / Create a Log Analytics Workspace 1. Sign in to the **Azure portal**: [https://portal.azure.com](https://portal.azure.com) 2. In the left menu, search for and select **Log Analytics workspaces**. 3. Check if you already have a workspace you want to use for Defender for Cloud. * If yes, note its **name** and **region** and skip to section 2. * If not, create one: 1. Click **+ Create**. 2. Choose **Subscription** and **Resource group**. 3. Enter a **Name** and choose a **Region**. 4. Click **Review + create** → **Create**. *** ## 2. Enable Auto‑Provisioning of the Monitoring Agent (Recommended) 1. In the Azure portal, search for and select **Microsoft Defender for Cloud** (or **Security Center** if still labeled). 2. In the left pane, select **Environment settings** (or **Getting started** → **Upgrade** if you haven’t enabled Defender plans). 3. Select the **Subscription** you want to configure. 4. In the subscription blade, go to **Auto-provisioning** (sometimes under **Settings**). 5. Find: * **Log Analytics agent for Azure VMs** (legacy MMA) and/or * **Azure Monitor Agent** (newer recommended agent). 6. Set **Auto-provisioning** to **On** for the relevant agent. 7. For each enabled agent, select the **Log Analytics workspace** you created or verified earlier. 8. Click **Save**. Result: New and existing supported VMs in that subscription will automatically receive the agent extension and the Defender “Monitoring agent is not provisioned” recommendation will be resolved once deployment completes. *** ## 3. Manually Install the Agent on Specific VMs (If Needed) Use this if you don’t want to enable auto‑provisioning or need to fix specific VMs immediately. ### 3.1 Azure Monitor Agent (preferred) 1. In the Azure portal, go to **Virtual machines**. 2. Select the VM that shows the recommendation. 3. In the VM blade, select **Extensions + applications**. 4. Click **+ Add**. 5. Choose **AzureMonitorWindowsAgent** or **AzureMonitorLinuxAgent** (depending on OS). 6. In the configuration: * Select the **Region** and **Data Collection Rule (DCR)** if prompted. * If you don’t have a DCR, you may need to create one (under **Azure Monitor** → **Data collection rules**) and associate it with your Log Analytics workspace. 7. Click **Review + create** → **Create**. 8. Wait for the extension to show as **Provisioning succeeded**. ### 3.2 Log Analytics Agent (legacy MMA, if that’s what your environment uses) 1. In **Virtual machines**, select the VM. 2. Go to **Extensions + applications**. 3. Click **+ Add**. 4. Select **Log Analytics agent (OMS)** or similar name. 5. In the configuration: * Pick the **Log Analytics workspace**. 6. Click **Review + create** → **Create**. 7. Wait for provisioning to complete. Repeat for other VMs as needed, or better: rely on auto‑provisioning for coverage. *** ## 4. Confirm Remediation in Defender for Cloud 1. Go back to **Microsoft Defender for Cloud**. 2. In the left pane, select **Recommendations**. 3. Find the recommendation like **“Monitoring agent should be installed on your virtual machines”** (or similar). 4. Open it: * The list of affected resources should shrink as agents finish installing. * Status moves from **Unhealthy** to **Healthy** once Defender detects the agent. There can be a short delay (often up to 30–60 minutes) before Defender for Cloud reflects the new status. *** If you tell me whether your recommendation mentions Azure Monitor Agent or the older Log Analytics agent, I can tailor the exact steps to that specific case. Below are CLI-only steps to remediate the “Monitoring agent is not provisioned” recommendation in Azure Security Center (Defender for Cloud) by installing the Log Analytics agent and enabling auto‑provisioning. *** ### 1. Log in and select subscription ```bash theme={null} az login az account set --subscription "" ``` *** ### 2. Create (or identify) a Log Analytics workspace If you already have one, skip to step 3. To create: ```bash theme={null} RESOURCE_GROUP="" LOCATION="eastus" WORKSPACE_NAME="" az group create -n "$RESOURCE_GROUP" -l "$LOCATION" az monitor log-analytics workspace create \ --resource-group "$RESOURCE_GROUP" \ --workspace-name "$WORKSPACE_NAME" \ --location "$LOCATION" ``` Get workspace info (needed later for the agent): ```bash theme={null} WORKSPACE_ID=$(az monitor log-analytics workspace show \ --resource-group "$RESOURCE_GROUP" \ --workspace-name "$WORKSPACE_NAME" \ --query customerId -o tsv) WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \ --resource-group "$RESOURCE_GROUP" \ --workspace-name "$WORKSPACE_NAME" \ --query primarySharedKey -o tsv) ``` *** ### 3. Connect Defender for Cloud to the workspace ```bash theme={null} az security workspace-setting create \ --name "default" \ --target-workspace "/subscriptions//resourceGroups/$RESOURCE_GROUP/providers/Microsoft.OperationalInsights/workspaces/$WORKSPACE_NAME" ``` *** ### 4. Enable auto‑provisioning of the monitoring agent This lets Defender for Cloud automatically install the agent on supported VMs: ```bash theme={null} az security auto-provisioning-setting update \ --name "default" \ --auto-provision "On" ``` This alone will remediate most future “Monitoring agent is not provisioned” findings. *** ### 5. (Optional) Manually install the agent on existing VMs If you want to remediate immediately on specific VMs instead of waiting for auto‑provisioning: #### For Windows VMs ```bash theme={null} VM_NAME="" VM_RG="" az vm extension set \ --resource-group "$VM_RG" \ --vm-name "$VM_NAME" \ --publisher "Microsoft.EnterpriseCloud.Monitoring" \ --name "MicrosoftMonitoringAgent" \ --settings "{\"workspaceId\": \"$WORKSPACE_ID\"}" \ --protected-settings "{\"workspaceKey\": \"$WORKSPACE_KEY\"}" ``` #### For Linux VMs ```bash theme={null} VM_NAME="" VM_RG="" az vm extension set \ --resource-group "$VM_RG" \ --vm-name "$VM_NAME" \ --publisher "Microsoft.EnterpriseCloud.Monitoring" \ --name "OmsAgentForLinux" \ --settings "{\"workspaceId\": \"$WORKSPACE_ID\"}" \ --protected-settings "{\"workspaceKey\": \"$WORKSPACE_KEY\"}" ``` *** ### 6. Verify in Azure Security Center After a few minutes: ```bash theme={null} az security task list --query "[?contains(displayName, 'Monitoring agent is not installed')]" -o table ``` Tasks related to those VMs should disappear or move to “resolved” once the agent is detected. Below are two common Python-based remediation paths for “Monitoring agent is not provisioned” in Azure Security Center (Defender for Cloud): 1. Turn **Auto-Provisioning ON** (recommended – Security Center will deploy the agent to supported VMs). 2. **Manually install the Monitoring Agent extension** on specific VMs. *** ## 1) Enable Auto-Provisioning of the Monitoring Agent (Python + REST) This tells Azure Security Center to automatically deploy the Log Analytics / Monitoring agent to supported VMs. ### Prerequisites * `pip install azure-identity` * `pip install requests` * An Azure AD app or logged-in environment that `DefaultAzureCredential` can use. * Your subscription ID. ### Python script ```python theme={null} import requests from azure.identity import DefaultAzureCredential # --------- CONFIG --------- subscription_id = "" api_version = "2017-08-01" auto_provisioning_name = "default" # fixed name # -------------------------- credential = DefaultAzureCredential() scope = "https://management.azure.com/.default" token = credential.get_token(scope).token url = ( f"https://management.azure.com/subscriptions/{subscription_id}" f"/providers/Microsoft.Security/autoProvisioningSettings/{auto_provisioning_name}" f"?api-version={api_version}" ) headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } body = { "properties": { "autoProvision": "On" # valid values: "On" or "Off" } } response = requests.put(url, headers=headers, json=body) print("Status code:", response.status_code) print("Response:", response.text) ``` Run this once per subscription where the recommendation appears.\ After a few minutes, Azure Security Center will start provisioning the monitoring agent on supported machines. *** ## 2) Manually Install the Monitoring Agent on a VM (Python SDK) Use this if you want immediate remediation on specific VMs or do not want global auto‑provision. ### Prerequisites ```bash theme={null} pip install azure-identity azure-mgmt-compute ``` You also need: * Subscription ID * Resource group name * VM name * Workspace ID and key for Log Analytics (where the agent should send logs) ### Python script (Windows or Linux VM) ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient # --------- CONFIG --------- subscription_id = "" resource_group = "" vm_name = "" # Log Analytics workspace info workspace_id = "" workspace_key = "" workspace_region = "" # e.g. "westeurope", "eastus" # -------------------------- credential = DefaultAzureCredential() compute_client = ComputeManagementClient(credential, subscription_id) extension_name = "MicrosoftMonitoringAgent" extension_parameters = { "location": workspace_region, "publisher": "Microsoft.EnterpriseCloud.Monitoring", "virtual_machine_extension_type": "MicrosoftMonitoringAgent", "type_handler_version": "1.0", "auto_upgrade_minor_version": True, "settings": { "workspaceId": workspace_id }, "protected_settings": { "workspaceKey": workspace_key } } poller = compute_client.virtual_machine_extensions.begin_create_or_update( resource_group_name=resource_group, vm_name=vm_name, vm_extension_name=extension_name, extension_parameters=extension_parameters ) result = poller.result() print("Extension provisioning state:", result.provisioning_state) ``` Run this for each VM that is missing the monitoring agent.\ After deployment, Azure Security Center should mark the recommendation as resolved for that VM (allow some time for evaluation). ```hcl theme={null} resource "azurerm_virtual_machine_extension" "azure_monitor_agent" { name = "AzureMonitorAgent" virtual_machine_id = azurerm_windows_virtual_machine.MY_VM.id # or azurerm_linux_virtual_machine.MY_VM.id publisher = "Microsoft.Azure.Monitor" type = "AzureMonitorWindowsAgent" # use AzureMonitorLinuxAgent for Linux type_handler_version = "1.10" # or latest supported in your region auto_upgrade_minor_version = true settings = jsonencode({ workspaceId = azurerm_log_analytics_workspace.MY_WORKSPACE.workspace_id }) protected_settings = jsonencode({ workspaceKey = azurerm_log_analytics_workspace.MY_WORKSPACE.primary_shared_key }) } ``` * Replace `MY_VM` with your VM resource name and `MY_WORKSPACE` with your `azurerm_log_analytics_workspace` resource. * This installs the Azure Monitor Agent extension required for Azure Security Center; only the extension resource is created/updated (the VM itself is not replaced). Verification: `terraform plan` should show one `azurerm_virtual_machine_extension.azure_monitor_agent` to be created (or updated) and no VM replacement. ### Additional Reading: