I have another conversation about the sunset of the Microsoft Monitoring Agent (MMA). Back on November 13, 2023 I posted and article on how to do a bulk removal of the Azure MMA agent, but before you can remove the MMA agent you need to have the AMA agent ready to take over the work. Below are details to assist in this endeavor.

<Updated 8/21/2024>

With the recent release of a new tool to help with the MMA Migration, I would suggest folks review:

MMA Discovery and Removal Utility - Azure Monitor | Microsoft Learn

I will leave this blog up in the event the above isn't what you are looking for

</Updated 8/21/2024>

I have another conversation about the sunset of the Microsoft Monitoring Agent (MMA). Back on November 13, 2023 I posted and article on how to do a bulk removal of the Azure MMA agent, but before you can remove the MMA agent you need to have the AMA agent ready to take over the work. Below are details to assist in this endeavor.  *17

Just as my miniature schnauzer, Raven, loves to explore the backyard, sniffing out new scents and chasing after squirrels, so too must we venture into the world of Azure’s new AMA agent. Raven’s curiosity and adaptability are traits we can admire and emulate as we navigate this transition. She doesn’t shy away from the unfamiliar; instead, she embraces it with a wagging tail and an eager spirit. Similarly, we should approach the migration from Azure’s MMA agent to the AMA agent with the same enthusiasm and readiness for discovery.

Think of the DCR as a specific set of instructions or a recipe that you use when baking Raven’s favorite dog treats. This recipe precisely dictates what ingredients should go into the mix. Similarly, the DCR in the Azure environment defines what log components should be sent to Azure. Just as you wouldn’t add anything not listed in Raven’s treat recipe, the AMA agent only sends the log components specified by the DCR.

Now, installing the AMA agent alongside the MMA agent is like giving Raven a new bone while she still has her old one. However, the key is to ensure that the new bone is presented before the old one is taken away. Raven, being the smart dog she is, immediately takes to the new bone, forgetting all about the old one. Similarly, once the DCR definition has been pushed to the server, the new AMA agent becomes active, and the old MMA agent becomes redundant. It’s a seamless transition, just like Raven’s shift of attention from the old bone to the new one. This way, we ensure a smooth transition while avoiding redundancy, making our migration process more efficient and tailored to our needs.

This is a large article, so I have added a content listing to help.

Contents

\n
• Transitioning to the Azure Monitor Agent (AMA) when you are using the Log Analytics Agent (MMA/OMS).
\n
• What is the MMA agent (Also known as OMS or Log Analytics agent)?
\n
• What is the AMA agent?
\n
• Coexistence with other agents
\n
• When should I consider using/migrating from MMA to AMA?
\n
• Agent Installation\n
  \n
  • Creating a DCR for Windows machines
  \n
  • Using Azure Policy to install the Windows Azure Monitoring Agent (AMA)
  \n
  • Verify that the AMA Agent Install Policy was Assigned and Create a Remediation Task for Any Existing Windows Servers
  \n
  • Verify that the Windows AMA Agent Installation Remediation Worked
  \n
  • Using Azure Policy to install the Windows Data Collection Rule
  \n
  • Verify that the DCR Policy was Uploaded and Create a Remediation Task for Any Existing Windows Servers
  \n
  • Creating a DCR for Linux Machines
  \n
  • Using Azure Policy to install the Linux Azure Monitoring Agent
  \n
  • Using Azure Policy to install the Linux Data Collection Rules
  \n
  • Verify Policy Assignments Have Been Completed
  \n
  \n
\n
• Installation of the AMA agent and Push of the DCR Definition on Azure ARC Hosts\n
  \n
  • Using Azure Policy to install the Windows Azure Monitoring Agent for Azure ARC
  \n
  • Using Azure Policy to install the Windows Data Collection Rule for Azure ARC
  \n
  • Using Azure Policy to install the Linux Azure Monitoring Agent for Azure ARC
  \n
  • Using Azure Policy to install the Linux Data Collection Rule for Azure ARC
  \n
  \n
\n
• Verify Agents Are Communicating with Azure\n
  \n
  • Querying the Heartbeat Table
  \n
  \n
\n
• Find Out Which Agents are Loaded and Where
\n
• AMA Data Sources and Locations
\n
• OMS Gateway
\n
• MMA Agent Removal
\n
• References
\n

Transitioning to the Azure Monitor Agent (AMA) when you are using the Log Analytics Agent (MMA/OMS).

What is the MMA agent (Also known as OMS or Log Analytics agent)? *1

The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends collected data to your Log Analytics workspace in Azure Monitor. The Log Analytics agent also supports insights and other services in Azure Monitor such as VM insights, Microsoft Defender for Cloud, and Azure Automation.

The MMA collects ALL the data from the logs defined below, with limited ability to filter:

Regardless as to which O/S or installation method the installer will require the workspace ID and key for the Log Analytics workspace that the agent will connect to. This requirement is a key differentiator from the new AMA because the AMA does the installation for the customer.

What is the AMA agent? *2

The Azure Monitor agent (AMA) collects monitoring data from the guest operating system of Azure virtual machines and delivers it to Azure Monitor solutions, including Log Analytics and products such as Microsoft Sentinel. The Azure Monitor agent is meant to replace the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines.

NOTE: The Log Analytics agent will be deprecated on August 31, 2024, so if you are using the MMA/OMS agent, it’s a good idea to start planning your migration to AMA well ahead of time.

Eventually, the Azure Monitor agent will replace the following legacy monitoring agents that are currently used by Azure Monitor.

\n
• Log Analytics agent: Sends data to a Log Analytics workspace and supports VM insights and monitoring solutions.
\n
• Telegraf agent: Sends data to Azure Monitor Metrics (Linux only)
\n
• Diagnostics extension: Sends data to Azure Monitor Metrics (Windows only), Azure Event Hubs, and Azure Storage.
\n

In addition to consolidating this functionality into a single agent, the Azure Monitor agent provides the following benefits over the existing agents:

\n
• Cost savings\n
  \n
  • Granular targeting via Data Collection Rules to collect specific data types from specific machines, as compared to the \"all or nothing\" mode that the MMA supports.
  \n
  \n
\n
• Security and performance\n
  \n
  • For authentication and security, it uses Managed Identity (for virtual machines) and AAD device tokens (for clients)
  \n
  • This agent performs better at higher EPS compared to legacy agents.
  \n
  \n
\n
• Simplified management of data collection
\n
• Management of dependent solutions or services
\n

Coexistence with other agents

The Azure Monitor agent can coexist (run side by side on the same machine) with the legacy Log Analytics agents so that you can continue to use their existing functionality during evaluation or migration. For this reason, you can begin transition even with limitations, but you must review the following points carefully:  *12

\n
• Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards, or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents.
\n
• If you install the Azure Monitor agent and create a data collection rule for these same events and performance data, it will result in duplicate data. As a result, ensure you're not collecting the same data from both agents. If you are, ensure they're collecting from different machines or going to separate destinations.
\n
• Besides data duplication, this scenario would also generate more charges for data ingestion and retention.
\n
• Running two telemetry agents on the same machine would result in double the resource consumption, including but not limited to CPU, memory, storage space, and network bandwidth. In general, we only recommend this for short periods of time when cutting over from the MMA/OMS agents to AMA and to validate that the same data is being collected but not for extended periods. 
\n

When should I consider using/migrating from MMA to AMA?

AMA is feature complete with MMA with reference to Windows Server. For the most up to date details please see *3 in the References section.

Agent Installation

The first set of steps will be to apply an Azure policy to deploy both the AMA agent and the Data Collection Rules. The use of Azure policy is no different, in their use, than other Azure policies you may have built and applied.

What are Data Collection Rules, you might ask?

“Data Collection Rules (DCRs) define the data collection process in Azure Monitor. DCRs specify what data should be collected, how to transform that data, and where to send that data. DCRs will be created and managed by Azure Monitor to collect a specific set of data to enable insights and visualizations. You may also create your own DCRs to define the set of data required for other scenarios.”  *4

Data Collection Rules (DCRs) in Azure Monitor are sets of instructions that support data collection. They provide a consistent and centralized way to define and customize different data collection scenarios. Depending on the scenario, DCRs specify details such as what data should be collected, how to transform that data, and where to send it. They are stored in Azure so that you can centrally manage them. Different components of a data collection workflow will access the DCR for particular information that it requires. In some cases, you can use the Azure portal to configure data collection, and Azure Monitor will create and manage the DCR for you. Other scenarios will require you to create your own DCR.

Note: If the Azure Monitor Agent (AMA) isn’t already installed, pushing a Data Collection Rule (DCR) to a host server in the Azure environment can trigger an automatic installation of the AMA. The AMA agent then becomes active and starts working according to the instructions provided by the DCR, ensuring an efficient data collection process. However, it’s important to note that this is not the recommended approach. Best practices suggest a more controlled deployment and configuration of the AMA to suit the specific needs of your environment.

Creating a DCR for Windows machines

\n
• Browse to the Azure “Monitor” blade and select “Data Collection Rules”.
\n

\n
• Select “Create.
\n
• Enter Rule Name.
\n
• Subscription.
\n
• Resource Group.
\n
• Region.
\n
\n
• This needs to be in the same location as the Log Analytics Workspace.
\n
\n
• Platform Type.
\n

\n
• Select “Next: Resources >”.
\n
• Click on the “Add resources”.
\n
• Drill down through the subscription to find a resource. In this example I have selected a Resource Group (RG). The DCR rule created for this RG will be used to apply against all the machines that fall within the scope of the Resource Group.
\n
• Click “Apply”.
\n

\n
• Select “Next: Collect and deliver >”
\n
• Select “+ Add data source”.
\n
• Select “Data source type”.
\n
\n
• In this example we will select “Windows Event Logs”.
\n
\n

At this point here is a key difference from the MMA agent. The data can now be filtered. For now the example shown will choose the complete set of Events from a log file, but they could be filtered using an XPath definition.

Before we continue on, I just wanted to show that if the “Custom” definition of logs is selected, it can be noted that there is no logs being collected. After we select the logs to collect, we will look at the “Custom” again to see the XPath generated by the system.

\n
• Choose custom.
\n

\n
• Choose Basic\n
  \n
  • The “Information” type was selected to help gather more events but in reality, both “Information” and “Verbose” probably wouldn’t be selected.
  \n
  \n
\n
\n
• Select all but “Verbose” as seen in the screen grab below.
\n
\n

Once these have all been selected, click on “Custom” to see what the XPath filter looks like for this selection.

\n
• Select “Next: Destination”.
\n
• Select “+ Add destination”.
\n
\n
• Destination type = “Azure Monitor Logs »
\n
• Suscription = 999999999999999999999999999
\n
• Account or namespace = xxxxxxxxxxxxxxxxxxxxxxxxx
\n
\n

Note the 9's and X's are place holders for the user to populate with your specific tenant.

Limit event log data collection from VM’s via XPath Filters.  *5

\n
• Select “Add data source”.
\n

\n
• Select “Review + create”.
\n

\n
• Select “Create”.
\n

As can be seen, the new DCR has been created. This new DCR is the exact same definition as “Paul-Test” so from this point forward all examples will use “Paul-Test” since there has already been a deployment using this DCR.

\n
• Select the DCR to be used for the Azure policy.
\n

\n
• Select “JSON view”
\n

When the DCR rules “Resource ID” is needed, the “Copy to Clipboard” is all that will be needed.

\n
• Cancel out of here.
\n

Using Azure Policy to install the Windows Azure Monitoring Agent

Note: Although the documentation doesn’t specifically call out that installing the agent on Windows 10/11 or later (Current documentation only states the MSI) is supported via Azure Policy, this is being amended to reflect that endpoint workstations are supported pushing the AMA agent via Azure policy.  #18

\n
• Browse to the Azure Policy blade.
\n
• Select Definitions.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Windows virtual machines”.
\n
\n

\n
• Select “Configure Windows virtual machines to run Azure Monitor Agent using system-assigned managed identity”.
\n

Note: You must have system-assigned managed identity enabled on each virtual machine before you deploy the agent.

To check to see if the virtual machine is configured for system assigned Identity:

\n
• Open up a new browser tab and browse to Azure Virtual Machines.\n
  \n
  • “System assigned” tab.
  \n
  \n
\n
\n
• Settings > Identity.
\n
\n
• Verify that the “Status” is set to “Enabled”.
\n

\n
• The new tab can be closed.
\n

\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Select “Next”.
\n

\n
• There is nothing to be Configured in “Advanced”, so click “Next”.
\n

\n
• There should be no “Parameters”, so click “Next.
\n

If there are any resources that already exist a remediation task can be created once this “Policy Definition” has been completed. Ensure the following have been completed:

Note: If you’re deploying a large number of Azure Monitor Agents (AMA), it’s better to use user-assigned managed identities. These identities are more flexible and can handle more volume compared to system-assigned identities. You can create them once and use them across many virtual machines, which is helpful for big deployments. Remember, each method has its own advantages, so choose based on what your setup needs.

\n
• The “Create a Managed Identity” is selected.
\n
• Select “System assigned managed identity”.
\n
\n
• If you want to use a “User assigned managed identity” then the policy needs to be “Configure Windows virtual machines to run Azure Monitor Agent using user-assigned managed identity”.
\n
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter any details required in the “Non-compliance message”.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Verify that the AMA Agent Install Policy was Assigned and Create a Remediation Task for Any Existing Windows Servers

\n
• Browse to Policy > Authoring / Assignments.
\n
\n
• Review the “Assignment name” column looking for the newly created Assignment.
\n
\n

For servers that already exist, a remediation task will need to be run to install the AMA agent. The following steps will create a remediation task to install the AMA agent on any servers in the scope defined.

\n
• Click on the newly created Policy Assignment
\n

\n
• On the “New remediation task” window, click on “Applicable resource to remediate”.
\n

\n
• Select a “Scope” to remediate.
\n

Any servers that don’t have the AMA agent loaded should now appear under the “Name” column.

\n
• Click on “Remediate”.
\n

A remediation task should now commence.

Verify that the Windows AMA Agent Installation Remediation Worked

Wait about 5 minutes…

\n
• Browse to Azure Virtual machines.\n
  \n
  • Click on “Extensions + applications”
  \n
  \n
  • On the “Extensions” tab, verify that the “AzureMonitorWindows Agent” is installed.
  \n
  \n
  \n
\n
\n
• Select a VM that was to be remediated
\n
\n

Using Azure Policy to install the Windows Data Collection Rule

A policy must be made to link the DCR that was created earlier to the same scope as the assignment for the AMA agent.

\n
• Browse to the “Policy” blade, similar to before and select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Windows virtual machines”.
\n
\n

\n
• To the right of “Configure Windows virtual machines to be associated with a Data Collection Rule or a Data Collection Endpoint”
\n
\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter the “Assignment Name”.
\n
• Click “Next”.
\n

\n
• There is nothing to configure on the “Advanced” tab.
\n
• Click on “Next”.
\n

\n
• Open a new browser tab and browse to Azure Monitor.
\n
• Under “Settings”, select “Data Collection Rules”.
\n

\n
• From the work earlier in this process, select the DCR rule created.
\n

\n
• From the “Overview” blade, select the “JSON View”.
\n

\n
• Click on the “Copy” at the end of the Resource ID”.
\n

\n
• Switch back to the Policy browser tab.
\n
• On the “Parameters” tab, paste the “Resource Id” into the “Data Collection Rule Resource Id or Data Collection Endpoint Resource Id” entry box.
\n
• Select “Next”.
\n

\n
• On the “Remediation” tab, leave as default and click Next.
\n

\n
• On the “Non-compliance messages” tab, enter a message for out of compliance servers.
\n
• Click Next
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

The Policy assignments for any new servers will have the DCR applied against the scope as defined in the policy settings. For any current servers, a Remediation task will need to be run to upload the DCR to any existing servers in “Scope”.

Verify that the DCR Policy was Uploaded and Create a Remediation Task for Any Existing Windows Servers

\n
• Browse to Policy > Authoring / Assignments.
\n
\n
• Review the “Assignment name” column looking for the newly created Assignment.
\n
\n

For servers that already exist, a remediation task will need to be run to upload the DCR definition. The following steps will create a remediation task to upload the DCR definition any servers in the scope defined.

\n
• Click on the newly created Policy Assignment
\n

\n
• Click on “Create remediation task”.
\n

\n
• Click on the “Scope” within the “Applicable resources to remediate”.
\n

\n
• Select the scope to remediate and click “Select”.
\n

\n
• Click on “Remediate”.
\n

Give the system about 10 minutes to push the DCR and data to start flowing, then you can verify that data is being uploaded to the Log Analytics Workspace (LAW) defined in the DCR. Open up a new browser tab and browse to the Log Analytics Workspace defined in the DCR. 

Note: If the MMA agent is currently sending data, then query 2 below will be needed to ensure data is being sent by the AMA agent.

\n
• Click on “Logs”
\n
\n
• Run the query below.
\n
\n

Search “Server Name”
| summarize count () by $table

Data from multiple tables should now be found.

To further ensure the data is coming specifically from the AMA agent run the following query. The “Category” column contains the agent that uploaded the data to the LAW.

Heartbeat
| project Computer, Category

Creating a DCR for Linux Machines

\n
• Browse to the Azure “Monitor” blade and select “Data Collection Rules”.
\n

\n
• Select “Create.
\n
• Enter Rule Name.
\n
• Subscription.
\n
• Resource Group.
\n
• Region.
\n
\n
• This needs to be in the same location as the Log Analytics Workspace.
\n
\n
• Platform Type.
\n

\n
• Select “Next: Resources >”.
\n
• Click on the “Add resources”.
\n

\n
• Drill down through the subscription to find a resource. In this example I have selected a single host “Ubuntu-01”. The DCR rules created for this host will be used to apply against all the machines that fall within the Azure Policy.
\n
• Click “Apply”.
\n

\n
• Select “Next: Collect and deliver >”.
\n
• Select “+ Add data source”.
\n
• Select “Data source type”.
\n
\n
• In this example we will select “Linux syslog”.
\n
\n

At this point here is a key difference from the MMA agent. The data can now be filtered. For now, the example shown will choose the complete set of Event from a log file, but they could be filtered using an XPath definition.

Before we continue on, I just wanted to show that if the “Custom” definition of logs is selected, it can be noted that there are no logs being collected.

\n
• Review the level of logging to capture the logs for each “Facility”.
\n

\n
• Select the “Destination” tab.\n
  \n
  • Select “Destination type”, “Subscription” and “Account or namespace”.
  \n
  \n
\n
\n
• Click the “Add destination” button.
\n
\n

\n
• Select “Add data source”.
\n
• Select “Next: Review + Create >”.
\n

\n
• Select “Create”.
\n
• Select “Go to Resource”.
\n
• From the “Overview” blade, select the “JSON View”.
\n
• In a later step you will need to copy the “Resource ID”.
\n

Using Azure Policy to install the Linux Azure Monitoring Agent

Note: You must have system-assigned managed identity enabled on each virtual machine before you deploy the agent.

\n
• Open a new browser tab and browse to Azure Virtual machines.
\n
• Select a Linux vm that needs to have the AMA agent loaded on it.\n
  \n
  • Verify that the “Status” = “on”.
  \n
  \n
\n
\n
• Select “Settings/Identity”.
\n
• Ensure you are on the “System assigned” tab.
\n
\n

Repeat the above for any machines that you are unclear if the System assigned status is enabled.

\n
• Browse to Azure Policy.
\n

\n
• Select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Linux virtual machines to”.
\n
\n

\n
• Select “Configure Linux virtual machines to run Azure Monitor Agent with System-assigned managed identity-based authentication”.
\n

\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign policy”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter a name for “Assignment name”.
\n
• Select “Next”.
\n

\n
• There should be no “Advanced”, so click “Next.
\n

\n
• There should be no “Parameters”, so click Next.
\n

\n
• Select “Create a remediation task” and in the drop down box select “Configure Linux virtual machines to run Azure Monitor Agent using system-assigned managed identity”.
\n
• Select “System assigned managed identity”.
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter free form in the “Non-compliance message”, if you so choose.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Using Azure Policy to install the Linux Data Collection Rules

Now a policy will need to be created to assign the previously created DCR to the same scope as the assignment for the AMA agent.

\n
• Browse to the “Policy” blade, similar to before and select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Linux virtual machines”.
\n
\n

\n
• Select “Configure Linux virtual machines to be associated with a Data Collection Rule”.
\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter a name for “Assignment name”.
\n
• Select “Next”.
\n

\n
• There is nothing to do on the “Advanced” tab, click “Next”.
\n
• Browse back to the tab with the “Data Collection Rule.
\n
• Click on the “Copy” at the end of the Resource ID”.
\n

\n
• Switch back to the Policy browser tab.
\n
• Paste the “Resource Id” into the “Data Collection Rule Resource Id”.
\n
• Select “Next”.
\n

\n
• Select “Create a remediation task” and in the drop-down box select “Configure Linux virtual machines to be associated with a Data Collection Rule”.
\n
• Click “Create a Managed Identity”
\n
• Select “System assigned managed identity”.
\n
\n
• If you want to use a “User assigned managed identity” then a User Managed Identity will be required.
\n
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter free form in the “Non-compliance message”, if so chosen.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Verify Policy Assignments Have Been Completed

I would suggest taking a 5-minute break.

\n
• Browse to the Azure Policy “Compliance” blade.
\n
• Search for the Policies for Linux servers just created and click on both (one at a time), to verify the servers in scope have all had the policies applied.
\n

Installation of the AMA agent and Push of the DCR Definition on Azure ARC Hosts

Using Azure Policy to install the Windows Azure Monitoring Agent for Azure ARC

Note: Although the documentation doesn’t specifically call out that installing the agent on Windows 10/11 or later (Current documentation only states the MSI) is supported via Azure Policy, this is being amended to reflect that endpoint workstations are supported pushing the AMA agent via Azure policy.  #18

The assumption has been made that Azure ARC has been installed on the Windows and Linux servers that are to be managed in the following section. To verify is Azure ARC has been loaded on a server:

\n
• Browse to Azure > Azure Arc > Infrastructure / Machines
\n
\n
• Review the names of the servers that are to have the AMA agent/DCR definition pushed to them.
\n
\n

Installing the Windows AMA ARC Agent is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure windows ARC” and select “Configure Windows ARC-enabled machines to run Azure Monitor Agent”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Windows Azure Monitoring Agent”.

Using Azure Policy to install the Windows Data Collection Rule for Azure ARC 

Installing the Windows Data Collection Rule (DCR) is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure windows ARC” and select “Configure Windows ARC Machines to be associated with a Data Collection Rule”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Windows Data Collection Rule”.

Using Azure Policy to install the Linux Azure Monitoring Agent for Azure ARC

Installing the Linux AMA ARC Agent is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure Linux ARC” and select “Configure Linux ARC-enabled machines to run Azure Monitor Agent”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Linux Azure Monitoring Agent”.

Using Azure Policy to install the Linux Data Collection Rule for Azure ARC

Installing the Linux DCR definition  is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure Linux ARC” and select “Configure Linux ARC Machines to be associated with a Data Collection Rule”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Linux Data Collection Rule”.

Verify Agents Are Communicating with Azure

Querying the Heartbeat Table

To verify that an agent was connected to your Log Analytics Workspace You can verify whether or not the machines are reporting to Log Analytics with the use of Kusto and querying the Heartbeat table.

The table “Heartbeat” is regularly sent a signal (every minute) from each server monitored. By simply using KQL to see if a heartbeat exists that is coming from each server, you can quickly verify that the servers are able to send Azure data.

Heartbeat

| where Category =~ \"azure monitor agent\"

| distinct Computer

Find Out Which Agents are Loaded and Where

There is a workbook that is available within Azure Monitor that will provide the details for every agent that is connected to the subscriptions selected within the workbook. The workbook name is “AMA Migration Helper”.

\n
• Open up the Azure portal and browse to Azure Monitor
\n
\n
• Workbooks > Azure Monitor Essentials/AMA Migration Helper
\n
\n

\n
• Select the Subscription(s), Workspace(s) and TimeRange.
\n

\n
• The findings should now be available in one of the 6 tabs in this workbook.
\n
\n
• The full “Migration Status” can be found at the bottom of the blade.
\n
\n

Note in the example below it can be seen that both subscriptions have had all device migrated to the new AMA client.

\n
• Selecting the “Azure Virtual Machines” displays the number of servers found within Azure, for the selected location and time range.
\n

Walk through all the tabs to get a complete list of assets and their status.

AMA Data Sources and Locations

The location of where log files are sent to can be found in the table below. *7

OMS Gateway

Some people might worry that the OMS gateway will disappear when the MMA agent retires. This is a valid point, but Microsoft will continue to support the gateway until they have a replacement or choose to retire it.

The steps below will explain how to continue to use the gateway and end use of the MMA agent’s data capture.

\n
• If the host that acts as a gateway is also collecting data with the MMA agent, make sure that the AMA agent is set up and a DCR definition has been sent to this host according to the information given earlier in this document.
\n
• Within the Azure portal browse to the Log Analytics Workspace.
\n
\n
• Select the Workspace to manage.
\n
\n
• Within each of the 5 tabs, remove any defined logs that are actively capturing data.
\n
\n
• Windows event logs.
\n
• Windows performance counters.
\n
• Linux performance counters.
\n
• Syslog
\n
• IIS Logs
\n
\n

After the Logs definition for each of the capture tabs is cleared, the MMA agent will stop sending data to the Log Analytics Workspace. The AMA agent will be unaffected by this change, as its capture definition is based on the DCR.

MMA Agent Removal

After you migrate your machines to the Azure Monitor Agent (AMA), you need to remove the Log Analytics Agent (also called the Microsoft Management Agent or MMA) to avoid duplication of logs. The Azure Tenant Security Solution (AzTS) MMA Discovery and Removal Utility can centrally remove the MMA extension from Azure virtual machines (VMs), Azure virtual machine scale sets, and Azure Arc servers from a tenant.  #18

I also have a blog posted on how to remove the MMA agent in bulk.  *17

AMA Migration helper

“AMA Migration Helper is a workbook-based Azure Monitor solution that helps you discover what to migrate and track progress as you move from Log Analytics Agent to Azure Monitor Agent. Use this single pane of glass view to expedite and track the status of your agent migration journey.

Do not remove the legacy agents if being used by other Azure solutions or services. Use the migration helper to discover which solutions/services you use today.” *13

References

\n
1. Log Analytics agent overview - Azure Monitor | Microsoft Docs
\n
2. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
3. Overview of the Azure monitoring agents - Azure Monitor | Microsoft Docs
\n
4. Data Collection Rules in Azure Monitor - Azure Monitor | Microsoft Docs
\n
5. Troubleshoot the Azure Monitor agent on Windows virtual machines and scale sets - Azure Monitor | Microsoft Docs
\n
6. Manage the Azure Monitor agent - Azure Monitor | Microsoft Docs
\n
7. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
8. Monitor data from virtual machines with Azure Monitor agent - Azure Monitor | Microsoft Docs
\n
9. Data collection transformations - Azure Monitor | Microsoft Docs 
\n
10. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
11. Azure Monitor FAQ - Azure Monitor | Microsoft Docs
\n
12. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
13. Tools for migrating to Azure Monitor Agent from legacy agents - Azure Monitor | Microsoft Docs
\n
14. XPath
\n
\n
1. Connect Microsoft Sentinel to Azure, Windows, and Microsoft services | Microsoft Docs
\n
\n
15. Tutorial - Editing Data Collection Rules - Azure Monitor | Microsoft Docs
\n
16. Tutorial - Send data to Azure Monitor Logs using REST API (Resource Manager templates) - Azure Monitor | Microsoft Docs
\n
17. Azure MMA Agent Bulk Removal - Microsoft Community Hub
\n
18. MMA Discovery and Removal Utility - Azure Monitor | Microsoft Learn
\n

<Updated 8/21/2024>

With the recent release of a new tool to help with the MMA Migration, I would suggest folks review:

MMA Discovery and Removal Utility - Azure Monitor | Microsoft Learn

I will leave this blog up in the event the above isn't what you are looking for

</Updated 8/21/2024>

I have another conversation about the sunset of the Microsoft Monitoring Agent (MMA). Back on November 13, 2023 I posted and article on how to do a bulk removal of the Azure MMA agent, but before you can remove the MMA agent you need to have the AMA agent ready to take over the work. Below are details to assist in this endeavor.  *17

Just as my miniature schnauzer, Raven, loves to explore the backyard, sniffing out new scents and chasing after squirrels, so too must we venture into the world of Azure’s new AMA agent. Raven’s curiosity and adaptability are traits we can admire and emulate as we navigate this transition. She doesn’t shy away from the unfamiliar; instead, she embraces it with a wagging tail and an eager spirit. Similarly, we should approach the migration from Azure’s MMA agent to the AMA agent with the same enthusiasm and readiness for discovery.

Think of the DCR as a specific set of instructions or a recipe that you use when baking Raven’s favorite dog treats. This recipe precisely dictates what ingredients should go into the mix. Similarly, the DCR in the Azure environment defines what log components should be sent to Azure. Just as you wouldn’t add anything not listed in Raven’s treat recipe, the AMA agent only sends the log components specified by the DCR.

Now, installing the AMA agent alongside the MMA agent is like giving Raven a new bone while she still has her old one. However, the key is to ensure that the new bone is presented before the old one is taken away. Raven, being the smart dog she is, immediately takes to the new bone, forgetting all about the old one. Similarly, once the DCR definition has been pushed to the server, the new AMA agent becomes active, and the old MMA agent becomes redundant. It’s a seamless transition, just like Raven’s shift of attention from the old bone to the new one. This way, we ensure a smooth transition while avoiding redundancy, making our migration process more efficient and tailored to our needs.

This is a large article, so I have added a content listing to help.

Contents

\n
• Transitioning to the Azure Monitor Agent (AMA) when you are using the Log Analytics Agent (MMA/OMS).
\n
• What is the MMA agent (Also known as OMS or Log Analytics agent)?
\n
• What is the AMA agent?
\n
• Coexistence with other agents
\n
• When should I consider using/migrating from MMA to AMA?
\n
• Agent Installation\n
  \n
  • Creating a DCR for Windows machines
  \n
  • Using Azure Policy to install the Windows Azure Monitoring Agent (AMA)
  \n
  • Verify that the AMA Agent Install Policy was Assigned and Create a Remediation Task for Any Existing Windows Servers
  \n
  • Verify that the Windows AMA Agent Installation Remediation Worked
  \n
  • Using Azure Policy to install the Windows Data Collection Rule
  \n
  • Verify that the DCR Policy was Uploaded and Create a Remediation Task for Any Existing Windows Servers
  \n
  • Creating a DCR for Linux Machines
  \n
  • Using Azure Policy to install the Linux Azure Monitoring Agent
  \n
  • Using Azure Policy to install the Linux Data Collection Rules
  \n
  • Verify Policy Assignments Have Been Completed
  \n
  \n
\n
• Installation of the AMA agent and Push of the DCR Definition on Azure ARC Hosts\n
  \n
  • Using Azure Policy to install the Windows Azure Monitoring Agent for Azure ARC
  \n
  • Using Azure Policy to install the Windows Data Collection Rule for Azure ARC
  \n
  • Using Azure Policy to install the Linux Azure Monitoring Agent for Azure ARC
  \n
  • Using Azure Policy to install the Linux Data Collection Rule for Azure ARC
  \n
  \n
\n
• Verify Agents Are Communicating with Azure\n
  \n
  • Querying the Heartbeat Table
  \n
  \n
\n
• Find Out Which Agents are Loaded and Where
\n
• AMA Data Sources and Locations
\n
• OMS Gateway
\n
• MMA Agent Removal
\n
• References
\n

Transitioning to the Azure Monitor Agent (AMA) when you are using the Log Analytics Agent (MMA/OMS).

What is the MMA agent (Also known as OMS or Log Analytics agent)? *1

The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends collected data to your Log Analytics workspace in Azure Monitor. The Log Analytics agent also supports insights and other services in Azure Monitor such as VM insights, Microsoft Defender for Cloud, and Azure Automation.

The MMA collects ALL the data from the logs defined below, with limited ability to filter:

Regardless as to which O/S or installation method the installer will require the workspace ID and key for the Log Analytics workspace that the agent will connect to. This requirement is a key differentiator from the new AMA because the AMA does the installation for the customer.

What is the AMA agent? *2

The Azure Monitor agent (AMA) collects monitoring data from the guest operating system of Azure virtual machines and delivers it to Azure Monitor solutions, including Log Analytics and products such as Microsoft Sentinel. The Azure Monitor agent is meant to replace the Log Analytics agent (also known as MMA and OMS) for both Windows and Linux machines.

NOTE: The Log Analytics agent will be deprecated on August 31, 2024, so if you are using the MMA/OMS agent, it’s a good idea to start planning your migration to AMA well ahead of time.

Eventually, the Azure Monitor agent will replace the following legacy monitoring agents that are currently used by Azure Monitor.

\n
• Log Analytics agent: Sends data to a Log Analytics workspace and supports VM insights and monitoring solutions.
\n
• Telegraf agent: Sends data to Azure Monitor Metrics (Linux only)
\n
• Diagnostics extension: Sends data to Azure Monitor Metrics (Windows only), Azure Event Hubs, and Azure Storage.
\n

In addition to consolidating this functionality into a single agent, the Azure Monitor agent provides the following benefits over the existing agents:

\n
• Cost savings\n
  \n
  • Granular targeting via Data Collection Rules to collect specific data types from specific machines, as compared to the \"all or nothing\" mode that the MMA supports.
  \n
  \n
\n
• Security and performance\n
  \n
  • For authentication and security, it uses Managed Identity (for virtual machines) and AAD device tokens (for clients)
  \n
  • This agent performs better at higher EPS compared to legacy agents.
  \n
  \n
\n
• Simplified management of data collection
\n
• Management of dependent solutions or services
\n

Coexistence with other agents

The Azure Monitor agent can coexist (run side by side on the same machine) with the legacy Log Analytics agents so that you can continue to use their existing functionality during evaluation or migration. For this reason, you can begin transition even with limitations, but you must review the following points carefully:  *12

\n
• Be careful in collecting duplicate data because it could skew query results and affect downstream features like alerts, dashboards, or workbooks. For example, VM insights uses the Log Analytics agent to send performance data to a Log Analytics workspace. You might also have configured the workspace to collect Windows events and Syslog events from agents.
\n
• If you install the Azure Monitor agent and create a data collection rule for these same events and performance data, it will result in duplicate data. As a result, ensure you're not collecting the same data from both agents. If you are, ensure they're collecting from different machines or going to separate destinations.
\n
• Besides data duplication, this scenario would also generate more charges for data ingestion and retention.
\n
• Running two telemetry agents on the same machine would result in double the resource consumption, including but not limited to CPU, memory, storage space, and network bandwidth. In general, we only recommend this for short periods of time when cutting over from the MMA/OMS agents to AMA and to validate that the same data is being collected but not for extended periods. 
\n

When should I consider using/migrating from MMA to AMA?

AMA is feature complete with MMA with reference to Windows Server. For the most up to date details please see *3 in the References section.

Agent Installation

The first set of steps will be to apply an Azure policy to deploy both the AMA agent and the Data Collection Rules. The use of Azure policy is no different, in their use, than other Azure policies you may have built and applied.

What are Data Collection Rules, you might ask?

“Data Collection Rules (DCRs) define the data collection process in Azure Monitor. DCRs specify what data should be collected, how to transform that data, and where to send that data. DCRs will be created and managed by Azure Monitor to collect a specific set of data to enable insights and visualizations. You may also create your own DCRs to define the set of data required for other scenarios.”  *4

Data Collection Rules (DCRs) in Azure Monitor are sets of instructions that support data collection. They provide a consistent and centralized way to define and customize different data collection scenarios. Depending on the scenario, DCRs specify details such as what data should be collected, how to transform that data, and where to send it. They are stored in Azure so that you can centrally manage them. Different components of a data collection workflow will access the DCR for particular information that it requires. In some cases, you can use the Azure portal to configure data collection, and Azure Monitor will create and manage the DCR for you. Other scenarios will require you to create your own DCR.

Note: If the Azure Monitor Agent (AMA) isn’t already installed, pushing a Data Collection Rule (DCR) to a host server in the Azure environment can trigger an automatic installation of the AMA. The AMA agent then becomes active and starts working according to the instructions provided by the DCR, ensuring an efficient data collection process. However, it’s important to note that this is not the recommended approach. Best practices suggest a more controlled deployment and configuration of the AMA to suit the specific needs of your environment.

Creating a DCR for Windows machines

\n
• Browse to the Azure “Monitor” blade and select “Data Collection Rules”.
\n

\n
• Select “Create.
\n
• Enter Rule Name.
\n
• Subscription.
\n
• Resource Group.
\n
• Region.
\n
\n
• This needs to be in the same location as the Log Analytics Workspace.
\n
\n
• Platform Type.
\n

\n
• Select “Next: Resources >”.
\n
• Click on the “Add resources”.
\n
• Drill down through the subscription to find a resource. In this example I have selected a Resource Group (RG). The DCR rule created for this RG will be used to apply against all the machines that fall within the scope of the Resource Group.
\n
• Click “Apply”.
\n

\n
• Select “Next: Collect and deliver >”
\n
• Select “+ Add data source”.
\n
• Select “Data source type”.
\n
\n
• In this example we will select “Windows Event Logs”.
\n
\n

At this point here is a key difference from the MMA agent. The data can now be filtered. For now the example shown will choose the complete set of Events from a log file, but they could be filtered using an XPath definition.

Before we continue on, I just wanted to show that if the “Custom” definition of logs is selected, it can be noted that there is no logs being collected. After we select the logs to collect, we will look at the “Custom” again to see the XPath generated by the system.

\n
• Choose custom.
\n

\n
• Choose Basic\n
  \n
  • The “Information” type was selected to help gather more events but in reality, both “Information” and “Verbose” probably wouldn’t be selected.
  \n
  \n
\n
\n
• Select all but “Verbose” as seen in the screen grab below.
\n
\n

Once these have all been selected, click on “Custom” to see what the XPath filter looks like for this selection.

\n
• Select “Next: Destination”.
\n
• Select “+ Add destination”.
\n
\n
• Destination type = “Azure Monitor Logs »
\n
• Suscription = 999999999999999999999999999
\n
• Account or namespace = xxxxxxxxxxxxxxxxxxxxxxxxx
\n
\n

Note the 9's and X's are place holders for the user to populate with your specific tenant.

Limit event log data collection from VM’s via XPath Filters.  *5

\n
• Select “Add data source”.
\n

\n
• Select “Review + create”.
\n

\n
• Select “Create”.
\n

As can be seen, the new DCR has been created. This new DCR is the exact same definition as “Paul-Test” so from this point forward all examples will use “Paul-Test” since there has already been a deployment using this DCR.

\n
• Select the DCR to be used for the Azure policy.
\n

\n
• Select “JSON view”
\n

When the DCR rules “Resource ID” is needed, the “Copy to Clipboard” is all that will be needed.

\n
• Cancel out of here.
\n

Using Azure Policy to install the Windows Azure Monitoring Agent

Note: Although the documentation doesn’t specifically call out that installing the agent on Windows 10/11 or later (Current documentation only states the MSI) is supported via Azure Policy, this is being amended to reflect that endpoint workstations are supported pushing the AMA agent via Azure policy.  #18

\n
• Browse to the Azure Policy blade.
\n
• Select Definitions.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Windows virtual machines”.
\n
\n

\n
• Select “Configure Windows virtual machines to run Azure Monitor Agent using system-assigned managed identity”.
\n

Note: You must have system-assigned managed identity enabled on each virtual machine before you deploy the agent.

To check to see if the virtual machine is configured for system assigned Identity:

\n
• Open up a new browser tab and browse to Azure Virtual Machines.\n
  \n
  • “System assigned” tab.
  \n
  \n
\n
\n
• Settings > Identity.
\n
\n
• Verify that the “Status” is set to “Enabled”.
\n

\n
• The new tab can be closed.
\n

\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Select “Next”.
\n

\n
• There is nothing to be Configured in “Advanced”, so click “Next”.
\n

\n
• There should be no “Parameters”, so click “Next.
\n

If there are any resources that already exist a remediation task can be created once this “Policy Definition” has been completed. Ensure the following have been completed:

Note: If you’re deploying a large number of Azure Monitor Agents (AMA), it’s better to use user-assigned managed identities. These identities are more flexible and can handle more volume compared to system-assigned identities. You can create them once and use them across many virtual machines, which is helpful for big deployments. Remember, each method has its own advantages, so choose based on what your setup needs.

\n
• The “Create a Managed Identity” is selected.
\n
• Select “System assigned managed identity”.
\n
\n
• If you want to use a “User assigned managed identity” then the policy needs to be “Configure Windows virtual machines to run Azure Monitor Agent using user-assigned managed identity”.
\n
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter any details required in the “Non-compliance message”.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Verify that the AMA Agent Install Policy was Assigned and Create a Remediation Task for Any Existing Windows Servers

\n
• Browse to Policy > Authoring / Assignments.
\n
\n
• Review the “Assignment name” column looking for the newly created Assignment.
\n
\n

For servers that already exist, a remediation task will need to be run to install the AMA agent. The following steps will create a remediation task to install the AMA agent on any servers in the scope defined.

\n
• Click on the newly created Policy Assignment
\n

\n
• On the “New remediation task” window, click on “Applicable resource to remediate”.
\n

\n
• Select a “Scope” to remediate.
\n

Any servers that don’t have the AMA agent loaded should now appear under the “Name” column.

\n
• Click on “Remediate”.
\n

A remediation task should now commence.

Verify that the Windows AMA Agent Installation Remediation Worked

Wait about 5 minutes…

\n
• Browse to Azure Virtual machines.\n
  \n
  • Click on “Extensions + applications”
  \n
  \n
  • On the “Extensions” tab, verify that the “AzureMonitorWindows Agent” is installed.
  \n
  \n
  \n
\n
\n
• Select a VM that was to be remediated
\n
\n

Using Azure Policy to install the Windows Data Collection Rule

A policy must be made to link the DCR that was created earlier to the same scope as the assignment for the AMA agent.

\n
• Browse to the “Policy” blade, similar to before and select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Windows virtual machines”.
\n
\n

\n
• To the right of “Configure Windows virtual machines to be associated with a Data Collection Rule or a Data Collection Endpoint”
\n
\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter the “Assignment Name”.
\n
• Click “Next”.
\n

\n
• There is nothing to configure on the “Advanced” tab.
\n
• Click on “Next”.
\n

\n
• Open a new browser tab and browse to Azure Monitor.
\n
• Under “Settings”, select “Data Collection Rules”.
\n

\n
• From the work earlier in this process, select the DCR rule created.
\n

\n
• From the “Overview” blade, select the “JSON View”.
\n

\n
• Click on the “Copy” at the end of the Resource ID”.
\n

\n
• Switch back to the Policy browser tab.
\n
• On the “Parameters” tab, paste the “Resource Id” into the “Data Collection Rule Resource Id or Data Collection Endpoint Resource Id” entry box.
\n
• Select “Next”.
\n

\n
• On the “Remediation” tab, leave as default and click Next.
\n

\n
• On the “Non-compliance messages” tab, enter a message for out of compliance servers.
\n
• Click Next
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

The Policy assignments for any new servers will have the DCR applied against the scope as defined in the policy settings. For any current servers, a Remediation task will need to be run to upload the DCR to any existing servers in “Scope”.

Verify that the DCR Policy was Uploaded and Create a Remediation Task for Any Existing Windows Servers

\n
• Browse to Policy > Authoring / Assignments.
\n
\n
• Review the “Assignment name” column looking for the newly created Assignment.
\n
\n

For servers that already exist, a remediation task will need to be run to upload the DCR definition. The following steps will create a remediation task to upload the DCR definition any servers in the scope defined.

\n
• Click on the newly created Policy Assignment
\n

\n
• Click on “Create remediation task”.
\n

\n
• Click on the “Scope” within the “Applicable resources to remediate”.
\n

\n
• Select the scope to remediate and click “Select”.
\n

\n
• Click on “Remediate”.
\n

Give the system about 10 minutes to push the DCR and data to start flowing, then you can verify that data is being uploaded to the Log Analytics Workspace (LAW) defined in the DCR. Open up a new browser tab and browse to the Log Analytics Workspace defined in the DCR. 

Note: If the MMA agent is currently sending data, then query 2 below will be needed to ensure data is being sent by the AMA agent.

\n
• Click on “Logs”
\n
\n
• Run the query below.
\n
\n

Search “Server Name”
| summarize count () by $table

Data from multiple tables should now be found.

To further ensure the data is coming specifically from the AMA agent run the following query. The “Category” column contains the agent that uploaded the data to the LAW.

Heartbeat
| project Computer, Category

Creating a DCR for Linux Machines

\n
• Browse to the Azure “Monitor” blade and select “Data Collection Rules”.
\n

\n
• Select “Create.
\n
• Enter Rule Name.
\n
• Subscription.
\n
• Resource Group.
\n
• Region.
\n
\n
• This needs to be in the same location as the Log Analytics Workspace.
\n
\n
• Platform Type.
\n

\n
• Select “Next: Resources >”.
\n
• Click on the “Add resources”.
\n

\n
• Drill down through the subscription to find a resource. In this example I have selected a single host “Ubuntu-01”. The DCR rules created for this host will be used to apply against all the machines that fall within the Azure Policy.
\n
• Click “Apply”.
\n

\n
• Select “Next: Collect and deliver >”.
\n
• Select “+ Add data source”.
\n
• Select “Data source type”.
\n
\n
• In this example we will select “Linux syslog”.
\n
\n

At this point here is a key difference from the MMA agent. The data can now be filtered. For now, the example shown will choose the complete set of Event from a log file, but they could be filtered using an XPath definition.

Before we continue on, I just wanted to show that if the “Custom” definition of logs is selected, it can be noted that there are no logs being collected.

\n
• Review the level of logging to capture the logs for each “Facility”.
\n

\n
• Select the “Destination” tab.\n
  \n
  • Select “Destination type”, “Subscription” and “Account or namespace”.
  \n
  \n
\n
\n
• Click the “Add destination” button.
\n
\n

\n
• Select “Add data source”.
\n
• Select “Next: Review + Create >”.
\n

\n
• Select “Create”.
\n
• Select “Go to Resource”.
\n
• From the “Overview” blade, select the “JSON View”.
\n
• In a later step you will need to copy the “Resource ID”.
\n

Using Azure Policy to install the Linux Azure Monitoring Agent

Note: You must have system-assigned managed identity enabled on each virtual machine before you deploy the agent.

\n
• Open a new browser tab and browse to Azure Virtual machines.
\n
• Select a Linux vm that needs to have the AMA agent loaded on it.\n
  \n
  • Verify that the “Status” = “on”.
  \n
  \n
\n
\n
• Select “Settings/Identity”.
\n
• Ensure you are on the “System assigned” tab.
\n
\n

Repeat the above for any machines that you are unclear if the System assigned status is enabled.

\n
• Browse to Azure Policy.
\n

\n
• Select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Linux virtual machines to”.
\n
\n

\n
• Select “Configure Linux virtual machines to run Azure Monitor Agent with System-assigned managed identity-based authentication”.
\n

\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign policy”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter a name for “Assignment name”.
\n
• Select “Next”.
\n

\n
• There should be no “Advanced”, so click “Next.
\n

\n
• There should be no “Parameters”, so click Next.
\n

\n
• Select “Create a remediation task” and in the drop down box select “Configure Linux virtual machines to run Azure Monitor Agent using system-assigned managed identity”.
\n
• Select “System assigned managed identity”.
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter free form in the “Non-compliance message”, if you so choose.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Using Azure Policy to install the Linux Data Collection Rules

Now a policy will need to be created to assign the previously created DCR to the same scope as the assignment for the AMA agent.

\n
• Browse to the “Policy” blade, similar to before and select “Definitions”.
\n

\n
• Click on the “Search” box.
\n
\n
• Enter “Configure Linux virtual machines”.
\n
\n

\n
• Select “Configure Linux virtual machines to be associated with a Data Collection Rule”.
\n
• Click on the ellipse (the three dots at the end of the Name) and select “Assign”.
\n

\n
• Enter the correct “Scope”.
\n
• Enter any “Exclusions”, if needed.
\n
• Enter a name for “Assignment name”.
\n
• Select “Next”.
\n

\n
• There is nothing to do on the “Advanced” tab, click “Next”.
\n
• Browse back to the tab with the “Data Collection Rule.
\n
• Click on the “Copy” at the end of the Resource ID”.
\n

\n
• Switch back to the Policy browser tab.
\n
• Paste the “Resource Id” into the “Data Collection Rule Resource Id”.
\n
• Select “Next”.
\n

\n
• Select “Create a remediation task” and in the drop-down box select “Configure Linux virtual machines to be associated with a Data Collection Rule”.
\n
• Click “Create a Managed Identity”
\n
• Select “System assigned managed identity”.
\n
\n
• If you want to use a “User assigned managed identity” then a User Managed Identity will be required.
\n
\n
• Select the location to where the system assigned identity should reside.
\n
• Select “Next”.
\n

\n
• Enter free form in the “Non-compliance message”, if so chosen.
\n
• Select “Next”.
\n

\n
• The policy definition should look similar to below.
\n
• Select “Create”.
\n

Verify Policy Assignments Have Been Completed

I would suggest taking a 5-minute break.

\n
• Browse to the Azure Policy “Compliance” blade.
\n
• Search for the Policies for Linux servers just created and click on both (one at a time), to verify the servers in scope have all had the policies applied.
\n

Installation of the AMA agent and Push of the DCR Definition on Azure ARC Hosts

Using Azure Policy to install the Windows Azure Monitoring Agent for Azure ARC

Note: Although the documentation doesn’t specifically call out that installing the agent on Windows 10/11 or later (Current documentation only states the MSI) is supported via Azure Policy, this is being amended to reflect that endpoint workstations are supported pushing the AMA agent via Azure policy.  #18

The assumption has been made that Azure ARC has been installed on the Windows and Linux servers that are to be managed in the following section. To verify is Azure ARC has been loaded on a server:

\n
• Browse to Azure > Azure Arc > Infrastructure / Machines
\n
\n
• Review the names of the servers that are to have the AMA agent/DCR definition pushed to them.
\n
\n

Installing the Windows AMA ARC Agent is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure windows ARC” and select “Configure Windows ARC-enabled machines to run Azure Monitor Agent”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Windows Azure Monitoring Agent”.

Using Azure Policy to install the Windows Data Collection Rule for Azure ARC 

Installing the Windows Data Collection Rule (DCR) is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure windows ARC” and select “Configure Windows ARC Machines to be associated with a Data Collection Rule”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Windows Data Collection Rule”.

Using Azure Policy to install the Linux Azure Monitoring Agent for Azure ARC

Installing the Linux AMA ARC Agent is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure Linux ARC” and select “Configure Linux ARC-enabled machines to run Azure Monitor Agent”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Linux Azure Monitoring Agent”.

Using Azure Policy to install the Linux Data Collection Rule for Azure ARC

Installing the Linux DCR definition  is almost the same with the exception of the policy name. In the Policy “Search” enter “Configure Linux ARC” and select “Configure Linux ARC Machines to be associated with a Data Collection Rule”. 

From this point forward, please follow the instructions defined in “Using Azure Policy to install the Linux Data Collection Rule”.

Verify Agents Are Communicating with Azure

Querying the Heartbeat Table

To verify that an agent was connected to your Log Analytics Workspace You can verify whether or not the machines are reporting to Log Analytics with the use of Kusto and querying the Heartbeat table.

The table “Heartbeat” is regularly sent a signal (every minute) from each server monitored. By simply using KQL to see if a heartbeat exists that is coming from each server, you can quickly verify that the servers are able to send Azure data.

Heartbeat

| where Category =~ \"azure monitor agent\"

| distinct Computer

Find Out Which Agents are Loaded and Where

There is a workbook that is available within Azure Monitor that will provide the details for every agent that is connected to the subscriptions selected within the workbook. The workbook name is “AMA Migration Helper”.

\n
• Open up the Azure portal and browse to Azure Monitor
\n
\n
• Workbooks > Azure Monitor Essentials/AMA Migration Helper
\n
\n

\n
• Select the Subscription(s), Workspace(s) and TimeRange.
\n

\n
• The findings should now be available in one of the 6 tabs in this workbook.
\n
\n
• The full “Migration Status” can be found at the bottom of the blade.
\n
\n

Note in the example below it can be seen that both subscriptions have had all device migrated to the new AMA client.

\n
• Selecting the “Azure Virtual Machines” displays the number of servers found within Azure, for the selected location and time range.
\n

Walk through all the tabs to get a complete list of assets and their status.

AMA Data Sources and Locations

The location of where log files are sent to can be found in the table below. *7

OMS Gateway

Some people might worry that the OMS gateway will disappear when the MMA agent retires. This is a valid point, but Microsoft will continue to support the gateway until they have a replacement or choose to retire it.

The steps below will explain how to continue to use the gateway and end use of the MMA agent’s data capture.

\n
• If the host that acts as a gateway is also collecting data with the MMA agent, make sure that the AMA agent is set up and a DCR definition has been sent to this host according to the information given earlier in this document.
\n
• Within the Azure portal browse to the Log Analytics Workspace.
\n
\n
• Select the Workspace to manage.
\n
\n
• Within each of the 5 tabs, remove any defined logs that are actively capturing data.
\n
\n
• Windows event logs.
\n
• Windows performance counters.
\n
• Linux performance counters.
\n
• Syslog
\n
• IIS Logs
\n
\n

After the Logs definition for each of the capture tabs is cleared, the MMA agent will stop sending data to the Log Analytics Workspace. The AMA agent will be unaffected by this change, as its capture definition is based on the DCR.

MMA Agent Removal

After you migrate your machines to the Azure Monitor Agent (AMA), you need to remove the Log Analytics Agent (also called the Microsoft Management Agent or MMA) to avoid duplication of logs. The Azure Tenant Security Solution (AzTS) MMA Discovery and Removal Utility can centrally remove the MMA extension from Azure virtual machines (VMs), Azure virtual machine scale sets, and Azure Arc servers from a tenant.  #18

I also have a blog posted on how to remove the MMA agent in bulk.  *17

AMA Migration helper

“AMA Migration Helper is a workbook-based Azure Monitor solution that helps you discover what to migrate and track progress as you move from Log Analytics Agent to Azure Monitor Agent. Use this single pane of glass view to expedite and track the status of your agent migration journey.

Do not remove the legacy agents if being used by other Azure solutions or services. Use the migration helper to discover which solutions/services you use today.” *13

References

\n
1. Log Analytics agent overview - Azure Monitor | Microsoft Docs
\n
2. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
3. Overview of the Azure monitoring agents - Azure Monitor | Microsoft Docs
\n
4. Data Collection Rules in Azure Monitor - Azure Monitor | Microsoft Docs
\n
5. Troubleshoot the Azure Monitor agent on Windows virtual machines and scale sets - Azure Monitor | Microsoft Docs
\n
6. Manage the Azure Monitor agent - Azure Monitor | Microsoft Docs
\n
7. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
8. Monitor data from virtual machines with Azure Monitor agent - Azure Monitor | Microsoft Docs
\n
9. Data collection transformations - Azure Monitor | Microsoft Docs 
\n
10. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
11. Azure Monitor FAQ - Azure Monitor | Microsoft Docs
\n
12. Azure Monitor agent overview - Azure Monitor | Microsoft Docs
\n
13. Tools for migrating to Azure Monitor Agent from legacy agents - Azure Monitor | Microsoft Docs
\n
14. XPath
\n
\n
1. Connect Microsoft Sentinel to Azure, Windows, and Microsoft services | Microsoft Docs
\n
\n
15. Tutorial - Editing Data Collection Rules - Azure Monitor | Microsoft Docs
\n
16. Tutorial - Send data to Azure Monitor Logs using REST API (Resource Manager templates) - Azure Monitor | Microsoft Docs
\n
17. Azure MMA Agent Bulk Removal - Microsoft Community Hub
\n
18. MMA Discovery and Removal Utility - Azure Monitor | Microsoft Learn
\n

I have another conversation about the sunset of the Microsoft Monitoring Agent (MMA). Back on November 13, 2023 I posted and article on how to do a bulk removal of the Azure MMA agent, but before you can remove the MMA agent you need to have the AMA agent ready to take over the work. Below are details to assist in this endeavor.

Thank you for your reply Paul, that's great to hear!

Karl_Wester-Ebbinghaus - The changes for automanage and Windows Admin Center will be coming out over the next few months. 

Important to note, while the above post describes enabling AMA with a DCR for Windows Event Logs, the process is quite different for VM Insights.

To use policy to deploy VM Insights with the AMA agent, you first need to Enable monitoring on the first VM in a subscription, in order for VM Insights to create the DCR with the correct stream for VM Insights. If you create the DCR manually and try to add using Azure Policy the VM Insights will not stream to the Log Analytics Workspace, and your CPU, RAM etc will not show in the monitoring graphs. 

When I tried this scenario in my lab, I enabled VM Insights in Azure Monitor on one VM, then used the Resource ID of the DCR just like Paul did to configure the Azure Policy. Once configured, all future VMs were assigned to the DCR and VM Insights were captured.

As stated before, you cannot create the DCR manually, you also cannot change the DCR or add Windows Event logs to it. You must create a second DCR with the Windows Logs, and assign the VMs to it. There is a Many-to-one relationship for DCRs to VMs.

I also found when enabling VM Insights through monitoring that it didn't like using a Log Analytics Workspace in a different subscription. When enabling, the wheel keeps spinning, nothing gets configured and it doesn't appear to timeout either.

https://learn.microsoft.com/en-us/azure/azure-monitor/vm/vminsights-enable-overview#data-collection-rule

Thank you paulberg for Sharing this Awesome Blogpost with the Community 

paulberg that's an outstanding tutorial, Admins would seek for on learn.microsoft.com. Thank you so much for putting this together!

With this in mind, is there an ETA when Microsoft will stop using the MMA? 

There are different areas that still would be using MMA if you start fresh using Arc-Enabled Server services, so basically make such a transition needed, despite the end of support announcement. 

Here are some to name as of January 2024:

- Azure Portal > enable Automanage

- Windows Admin Center > enable Azure Update Management as AzUM isn't implemented in the extension. We may expect a change before the next release of WAC end of this year. 

These are two pitfalls, there could be more. 

What can we do, or expect that Azure Portal and WAC of Microsoft will transition, using AMA right away and stop propagating MMA before the end of support? 

Thank you for time and reaching out.

No. If you have a large number of hosts, it would be better to use a user assigned account. Imagine thousands of devices each using a unique system Id. This was just in my lab. I will try and go back and call that out.

Manage Azure Monitor Agent - Azure Monitor | Microsoft Learn

Is this correct?

\"You must have system-assigned managed identity enabled on each virtual machine before you deploy the agent.\"

I thought this choice governs whether the Policy gets assigned a system-assigned identity, or whether the Policy uses the user-assigned identity that you specify. The system-assigned identity is assigned a role at the scope you are applying the policy to. If you use a user-assigned identity, I think it has to have a pre-assigned role where the policy is being applied to. I don't think you need system-assigned identity enabled on all of the VM's you are installing the MMA on.

This is absolutely amazing, thank you.