Azure audit securitycenter monitoring agent not provisioned remediation

Using Console

Below are step‑by‑step console instructions to fix “Monitoring Agent is not provisioned” in Azure Security Center (now Microsoft Defender for Cloud).The goal:

Have a Log Analytics workspace, and
Enable the Azure Monitor Agent (or MMA, depending on your setup) on all relevant resources so Defender for Cloud can collect data.

1. Verify / Create a Log Analytics Workspace

Sign in to the Azure portal: https://portal.azure.com
In the left menu, search for and select Log Analytics workspaces.
Check if you already have a workspace you want to use for Defender for Cloud.
- If yes, note its name and region and skip to section 2.
- If not, create one:
  1. Click + Create.
  2. Choose Subscription and Resource group.
  3. Enter a Name and choose a Region.
  4. Click Review + create → Create.

2. Enable Auto‑Provisioning of the Monitoring Agent (Recommended)

In the Azure portal, search for and select Microsoft Defender for Cloud (or Security Center if still labeled).
In the left pane, select Environment settings (or Getting started → Upgrade if you haven’t enabled Defender plans).
Select the Subscription you want to configure.
In the subscription blade, go to Auto-provisioning (sometimes under Settings).
Find:
- Log Analytics agent for Azure VMs (legacy MMA) and/or
- Azure Monitor Agent (newer recommended agent).
Set Auto-provisioning to On for the relevant agent.
For each enabled agent, select the Log Analytics workspace you created or verified earlier.
Click Save.

Result: New and existing supported VMs in that subscription will automatically receive the agent extension and the Defender “Monitoring agent is not provisioned” recommendation will be resolved once deployment completes.

3. Manually Install the Agent on Specific VMs (If Needed)

Use this if you don’t want to enable auto‑provisioning or need to fix specific VMs immediately.

3.1 Azure Monitor Agent (preferred)

In the Azure portal, go to Virtual machines.
Select the VM that shows the recommendation.
In the VM blade, select Extensions + applications.
Click + Add.
Choose AzureMonitorWindowsAgent or AzureMonitorLinuxAgent (depending on OS).
In the configuration:
- Select the Region and Data Collection Rule (DCR) if prompted.
- If you don’t have a DCR, you may need to create one (under Azure Monitor → Data collection rules) and associate it with your Log Analytics workspace.
Click Review + create → Create.
Wait for the extension to show as Provisioning succeeded.

3.2 Log Analytics Agent (legacy MMA, if that’s what your environment uses)

In Virtual machines, select the VM.
Go to Extensions + applications.
Click + Add.
Select Log Analytics agent (OMS) or similar name.
In the configuration:
- Pick the Log Analytics workspace.
Click Review + create → Create.
Wait for provisioning to complete.

Repeat for other VMs as needed, or better: rely on auto‑provisioning for coverage.

4. Confirm Remediation in Defender for Cloud

Go back to Microsoft Defender for Cloud.
In the left pane, select Recommendations.
Find the recommendation like “Monitoring agent should be installed on your virtual machines” (or similar).
Open it:
- The list of affected resources should shrink as agents finish installing.
- Status moves from Unhealthy to Healthy once Defender detects the agent.

There can be a short delay (often up to 30–60 minutes) before Defender for Cloud reflects the new status.

If you tell me whether your recommendation mentions Azure Monitor Agent or the older Log Analytics agent, I can tailor the exact steps to that specific case.

Using CLI

Below are CLI-only steps to remediate the “Monitoring agent is not provisioned” recommendation in Azure Security Center (Defender for Cloud) by installing the Log Analytics agent and enabling auto‑provisioning.

1. Log in and select subscription

az login
az account set --subscription "<SUBSCRIPTION_ID>"

2. Create (or identify) a Log Analytics workspace

If you already have one, skip to step 3. To create:

RESOURCE_GROUP="<RG_NAME>"
LOCATION="eastus"
WORKSPACE_NAME="<WORKSPACE_NAME>"

az group create -n "$RESOURCE_GROUP" -l "$LOCATION"

az monitor log-analytics workspace create \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$WORKSPACE_NAME" \
  --location "$LOCATION"

Get workspace info (needed later for the agent):

WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$WORKSPACE_NAME" \
  --query customerId -o tsv)

WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \
  --resource-group "$RESOURCE_GROUP" \
  --workspace-name "$WORKSPACE_NAME" \
  --query primarySharedKey -o tsv)

3. Connect Defender for Cloud to the workspace

az security workspace-setting create \
  --name "default" \
  --target-workspace "/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.OperationalInsights/workspaces/$WORKSPACE_NAME"

4. Enable auto‑provisioning of the monitoring agent

This lets Defender for Cloud automatically install the agent on supported VMs:

az security auto-provisioning-setting update \
  --name "default" \
  --auto-provision "On"

This alone will remediate most future “Monitoring agent is not provisioned” findings.

5. (Optional) Manually install the agent on existing VMs

If you want to remediate immediately on specific VMs instead of waiting for auto‑provisioning:

For Windows VMs

VM_NAME="<WINDOWS_VM_NAME>"
VM_RG="<VM_RESOURCE_GROUP>"

az vm extension set \
  --resource-group "$VM_RG" \
  --vm-name "$VM_NAME" \
  --publisher "Microsoft.EnterpriseCloud.Monitoring" \
  --name "MicrosoftMonitoringAgent" \
  --settings "{\"workspaceId\": \"$WORKSPACE_ID\"}" \
  --protected-settings "{\"workspaceKey\": \"$WORKSPACE_KEY\"}"

For Linux VMs

VM_NAME="<LINUX_VM_NAME>"
VM_RG="<VM_RESOURCE_GROUP>"

az vm extension set \
  --resource-group "$VM_RG" \
  --vm-name "$VM_NAME" \
  --publisher "Microsoft.EnterpriseCloud.Monitoring" \
  --name "OmsAgentForLinux" \
  --settings "{\"workspaceId\": \"$WORKSPACE_ID\"}" \
  --protected-settings "{\"workspaceKey\": \"$WORKSPACE_KEY\"}"

6. Verify in Azure Security Center

After a few minutes:

az security task list --query "[?contains(displayName, 'Monitoring agent is not installed')]" -o table

Tasks related to those VMs should disappear or move to “resolved” once the agent is detected.

Using Python

Below are two common Python-based remediation paths for “Monitoring agent is not provisioned” in Azure Security Center (Defender for Cloud):

Turn Auto-Provisioning ON (recommended – Security Center will deploy the agent to supported VMs).
Manually install the Monitoring Agent extension on specific VMs.

1) Enable Auto-Provisioning of the Monitoring Agent (Python + REST)

This tells Azure Security Center to automatically deploy the Log Analytics / Monitoring agent to supported VMs.

Prerequisites

pip install azure-identity
pip install requests
An Azure AD app or logged-in environment that DefaultAzureCredential can use.
Your subscription ID.

Python script

import requests
from azure.identity import DefaultAzureCredential

# --------- CONFIG ---------
subscription_id = "<YOUR_SUBSCRIPTION_ID>"
api_version = "2017-08-01"
auto_provisioning_name = "default"  # fixed name
# --------------------------

credential = DefaultAzureCredential()
scope = "https://management.azure.com/.default"
token = credential.get_token(scope).token

url = (
    f"https://management.azure.com/subscriptions/{subscription_id}"
    f"/providers/Microsoft.Security/autoProvisioningSettings/{auto_provisioning_name}"
    f"?api-version={api_version}"
)

headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}

body = {
    "properties": {
        "autoProvision": "On"      # valid values: "On" or "Off"
    }
}

response = requests.put(url, headers=headers, json=body)

print("Status code:", response.status_code)
print("Response:", response.text)

Run this once per subscription where the recommendation appears.
After a few minutes, Azure Security Center will start provisioning the monitoring agent on supported machines.

2) Manually Install the Monitoring Agent on a VM (Python SDK)

Use this if you want immediate remediation on specific VMs or do not want global auto‑provision.

Prerequisites

pip install azure-identity azure-mgmt-compute

You also need:

Subscription ID
Resource group name
VM name
Workspace ID and key for Log Analytics (where the agent should send logs)

Python script (Windows or Linux VM)

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

# --------- CONFIG ---------
subscription_id    = "<YOUR_SUBSCRIPTION_ID>"
resource_group     = "<YOUR_RESOURCE_GROUP>"
vm_name            = "<YOUR_VM_NAME>"

# Log Analytics workspace info
workspace_id       = "<YOUR_WORKSPACE_ID>"
workspace_key      = "<YOUR_WORKSPACE_PRIMARY_KEY>"
workspace_region   = "<YOUR_WORKSPACE_REGION>"  # e.g. "westeurope", "eastus"
# --------------------------

credential = DefaultAzureCredential()
compute_client = ComputeManagementClient(credential, subscription_id)

extension_name = "MicrosoftMonitoringAgent"

extension_parameters = {
    "location": workspace_region,
    "publisher": "Microsoft.EnterpriseCloud.Monitoring",
    "virtual_machine_extension_type": "MicrosoftMonitoringAgent",
    "type_handler_version": "1.0",
    "auto_upgrade_minor_version": True,
    "settings": {
        "workspaceId": workspace_id
    },
    "protected_settings": {
        "workspaceKey": workspace_key
    }
}

poller = compute_client.virtual_machine_extensions.begin_create_or_update(
    resource_group_name=resource_group,
    vm_name=vm_name,
    vm_extension_name=extension_name,
    extension_parameters=extension_parameters
)

result = poller.result()
print("Extension provisioning state:", result.provisioning_state)

Run this for each VM that is missing the monitoring agent.
After deployment, Azure Security Center should mark the recommendation as resolved for that VM (allow some time for evaluation).

Using Terraform

resource "azurerm_virtual_machine_extension" "azure_monitor_agent" {
  name                       = "AzureMonitorAgent"
  virtual_machine_id         = azurerm_windows_virtual_machine.MY_VM.id # or azurerm_linux_virtual_machine.MY_VM.id
  publisher                  = "Microsoft.Azure.Monitor"
  type                       = "AzureMonitorWindowsAgent"              # use AzureMonitorLinuxAgent for Linux
  type_handler_version       = "1.10"                                  # or latest supported in your region
  auto_upgrade_minor_version = true

  settings = jsonencode({
    workspaceId = azurerm_log_analytics_workspace.MY_WORKSPACE.workspace_id
  })

  protected_settings = jsonencode({
    workspaceKey = azurerm_log_analytics_workspace.MY_WORKSPACE.primary_shared_key
  })
}

Replace MY_VM with your VM resource name and MY_WORKSPACE with your azurerm_log_analytics_workspace resource.
This installs the Azure Monitor Agent extension required for Azure Security Center; only the extension resource is created/updated (the VM itself is not replaced).

Verification: terraform plan should show one azurerm_virtual_machine_extension.azure_monitor_agent to be created (or updated) and no VM replacement.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Azure audit securitycenter monitoring agent not provisioned remediation

Triage and Remediation

Remediation

1. Verify / Create a Log Analytics Workspace

2. Enable Auto‑Provisioning of the Monitoring Agent (Recommended)

3. Manually Install the Agent on Specific VMs (If Needed)

3.1 Azure Monitor Agent (preferred)

3.2 Log Analytics Agent (legacy MMA, if that’s what your environment uses)

4. Confirm Remediation in Defender for Cloud

1. Log in and select subscription

2. Create (or identify) a Log Analytics workspace

3. Connect Defender for Cloud to the workspace

4. Enable auto‑provisioning of the monitoring agent

5. (Optional) Manually install the agent on existing VMs

For Windows VMs

For Linux VMs

6. Verify in Azure Security Center

1) Enable Auto-Provisioning of the Monitoring Agent (Python + REST)

Prerequisites

Python script

2) Manually Install the Monitoring Agent on a VM (Python SDK)

Prerequisites

Python script (Windows or Linux VM)

​Triage and Remediation

​Remediation

​1. Verify / Create a Log Analytics Workspace

​2. Enable Auto‑Provisioning of the Monitoring Agent (Recommended)

​3. Manually Install the Agent on Specific VMs (If Needed)

​3.1 Azure Monitor Agent (preferred)

​3.2 Log Analytics Agent (legacy MMA, if that’s what your environment uses)

​4. Confirm Remediation in Defender for Cloud

​1. Log in and select subscription

​2. Create (or identify) a Log Analytics workspace

​3. Connect Defender for Cloud to the workspace

​4. Enable auto‑provisioning of the monitoring agent

​5. (Optional) Manually install the agent on existing VMs

​For Windows VMs

​For Linux VMs

​6. Verify in Azure Security Center

​1) Enable Auto-Provisioning of the Monitoring Agent (Python + REST)

​Prerequisites

​Python script

​2) Manually Install the Monitoring Agent on a VM (Python SDK)

​Prerequisites

​Python script (Windows or Linux VM)

Triage and Remediation

Remediation

1. Verify / Create a Log Analytics Workspace

2. Enable Auto‑Provisioning of the Monitoring Agent (Recommended)

3. Manually Install the Agent on Specific VMs (If Needed)

3.1 Azure Monitor Agent (preferred)

3.2 Log Analytics Agent (legacy MMA, if that’s what your environment uses)

4. Confirm Remediation in Defender for Cloud

1. Log in and select subscription

2. Create (or identify) a Log Analytics workspace

3. Connect Defender for Cloud to the workspace

4. Enable auto‑provisioning of the monitoring agent

5. (Optional) Manually install the agent on existing VMs

For Windows VMs

For Linux VMs

6. Verify in Azure Security Center

1) Enable Auto-Provisioning of the Monitoring Agent (Python + REST)

Prerequisites

Python script

2) Manually Install the Monitoring Agent on a VM (Python SDK)

Prerequisites

Python script (Windows or Linux VM)