%3CLINGO-SUB%20id%3D%22lingo-sub-999379%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-999379%22%20slang%3D%22en-US%22%3E%3CP%3EAzure%20Arc%20was%20announced%20very%20recently%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fazure.microsoft.com%252Fen-gb%252Fupdates%252Fazure-arc-for-servers-in-public-preview%252F%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334801815%26amp%3Bsdata%3DbP%252F9u0VE7bVLbCGGUWD3H7lv4JlakWw5LDSj94kHofY%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fen-gb%2Fupdates%2Fazure-arc-for-servers-in-public-preview%2F%3C%2FA%3E%20and%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fazure.microsoft.com%252Fen-gb%252Fupdates%252Fazure-arc-for-servers-in-public-preview%252F%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334811812%26amp%3Bsdata%3DKg9BJf07ESkA5O1tf2OcAv%252FI8DR29%252B4Nyop5MpCLYlc%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fen-gb%2Fupdates%2Fazure-arc-for-servers-in-public-preview%2F%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EWhat%20is%20Azure%20Arc%20-%20this%20is%20the%20high-level%20summary%3A%3CBR%20%2F%3E%3CEM%3EAzure%20Arc%20extends%20Azure%20Resource%20Manager%20capabilities%20to%20Linux%20and%20Windows%20servers%2C%20as%20well%20as%20Kubernetes%20clusters%20on%20any%20infrastructure%20across%20on-premises%2C%20multi-cloud%2C%20and%20edge.%20With%20Azure%20Arc%2C%20customers%20can%20also%20run%20Azure%20data%20services%20anywhere%2C%20realizing%20the%20benefits%20of%20cloud%20innovation%2C%20including%20always%20up-to-date%20data%20capabilities%2C%20deployment%20in%20seconds%20(rather%20than%20hours)%2C%20and%20dynamic%20scalability%20on%20any%20infrastructure.%20Azure%20Arc%20for%20servers%20is%20currently%20in%20public%20preview.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%E2%80%9CAzure%20Arc%20for%20servers%20allows%20you%20to%20manage%20machines%20which%20are%20outside%20of%20Azure.%20When%20a%20non-Azure%20machine%20is%20connected%20to%20Azure%2C%20it%20becomes%20a%26nbsp%3B%3CSTRONG%3EConnected%20Machine%3C%2FSTRONG%3E%26nbsp%3Band%20is%20treated%20as%20a%20resource%20in%20Azure.%20Each%26nbsp%3B%3CSTRONG%3EConnected%20Machine%3C%2FSTRONG%3E%26nbsp%3Bhas%20a%20Resource%20ID%2C%20is%20managed%20as%20part%20of%20a%20Resource%20Group%20inside%20a%20subscription%2C%20and%20benefits%20from%20standard%20Azure%20constructs%20such%20as%20Azure%20Policy%20and%20tagging.%E2%80%9D%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3EThis%20means%20you%20see%20servers%20in%20your%20Azure%20portal%20(thanks%20to%20Julius%20Davies%20for%20adding%20these%20two%20for%20me!).%26nbsp%3B%20These%20are%20two%20on-premises%20machines%2C%20in%20the%20Microsoft%20reading%20Campus%20(UK).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156097i69FD6DCA4E9CE460%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_1.png%22%20title%3D%22clipboard_image_1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20see%20the%20same%20info%20in%20tools%20like%20Azure%20Resource%20Graph%20and%20the%20Sentinel%20Logs.%26nbsp%3B%20Azure%20Arc%20machines%20can%20be%20identified%20as%20they%20have%20a%20unique%20%3CSTRONG%3EResourceProvider%3C%2FSTRONG%3E%20value%20of%20%26nbsp%3B%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%E2%80%9CMicrosoft.HybridCompute%E2%80%9D.%26nbsp%3B%20This%20can%20help%20us%20detect%20these%20types%20of%20machines%20in%20the%20future.%20As%20this%20is%20a%20platform%20level%20feature%20we%20can%20use%20this%20in%20workbooks%20as%20I%20will%20show%20soon%2C%20but%20also%20in%20Incident%20or%20Hunting%20scenarios%2C%20you%20have%20access%20to%20the%20api%20or%20Logs%20(you%20do%20need%20the%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fservices-hub%252Fhealth%252Fmma-setup%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334811812%26amp%3Bsdata%3DXNh%252F5UnuUUuSra55Cq4IaFsjm3LeWPnYEZ1UIOKFkow%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMMA%3C%2FA%3E%20for%20Logs).%26nbsp%3B%20Let%20me%20show%20you%20two%20ways%20of%20seeing%20these%20servers%2C%20outside%20of%20the%20Azure%20Arc%20portal%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EAzure%20Resource%20Graph%20-%20example%20query%3C%2FSTRONG%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3Bresources%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3B%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.hybridcompute%2Fmachines%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156096i69C6338FBEFDB176%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EAzure%20Sentinel%20Logs%20-%20example%20query%3A%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHeartbeat%3C%2FP%3E%0A%3CP%3E%7C%20where%20ResourceProvider%20in%20(%22Microsoft.Compute%22%2C%22Microsoft.HybridCompute%22)%3C%2FP%3E%0A%3CP%3E%7C%20distinct%20Computer%2C%20ResourceProvider%3C%2FP%3E%0A%3CP%3E%7C%20summarize%20count()%20by%20ResourceProvider%2C%20Computer%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20might%20like%20to%20show%20this%20as%20a%20Pie%20Chart%2C%20and%20see%20how%20your%20usage%20of%20Arc%20grows%20over%20time%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156098i2FEF4B744D102B6A%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_3.png%22%20title%3D%22clipboard_image_3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EThe%20workbook%20explained%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E1.%20Download%20the%20workbook%20from%20here%3A%26nbsp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2Fmaster%2FWorkbooks%2FSecurityStatus.json%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Fblob%2Fmaster%2FWorkbooks%2FSecurityStatus.json%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E2.%20See%20here%20for%20import%20instructions%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FHow-to-use-Azure-Sentinel-to-follow-a-Users-travel-and-map-their%2Fba-p%2F981716%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FHow-to-use-Azure-Sentinel-to-follow-a-Users-travel-and-map-their%2Fba-p%2F981716%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20have%20created%20some%20options%20for%20you%20to%20select%3B%26nbsp%3B%20%3CSTRONG%3ESubscriptions%3C%2FSTRONG%3E%2C%20%3CSTRONG%3EWorkspaces%3C%2FSTRONG%3E%2C%20%3CSTRONG%3ETime%3C%2FSTRONG%3E%20and%20a%20%3CSTRONG%3EComputer%3C%2FSTRONG%3E.%26nbsp%3B%20This%20will%20also%20work%20with%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fazure.microsoft.com%252Fen-gb%252Fservices%252Fazure-lighthouse%252F%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334821804%26amp%3Bsdata%3DGL%252FddJgftT3uVC74ZPM2ukN8CBZ5kYdTRJQIYYa4rCk%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Lighthouse%3C%2FA%3E%20so%20works%20for%20an%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fen-us%252Fsecurity%252Fpartnerships%252Ffind-a-partner%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334831802%26amp%3Bsdata%3D3lhBcgKW2UD%252F9L4Lin6wVDrd6TaVzG%252BPwuhwGos74%252FE%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMSSP%3C%2FA%3E%20or%20if%20you%20have%20multiple%20Azure%20Directories%20in%20your%20organisation.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156099i2C58B8757BE9A33E%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_4.png%22%20title%3D%22clipboard_image_4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%20let%E2%80%99s%20now%20choose%20a%20%3CSTRONG%3EComputer%3C%2FSTRONG%3E%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20see%20this%20report.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156101i00F1AF7EC0082C97%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_5.png%22%20title%3D%22clipboard_image_5.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EFor%20this%20I%E2%80%99m%20using%20a%20%3CSTRONG%3EAzure%20Resource%20Graph%3C%2FSTRONG%3E%20Query%2C%20looking%20at%20the%20%E2%80%9Csecurityresources%E2%80%9D%20information%20-%20see%20lines%201%20%26amp%3B%202%20below.%26nbsp%3B%20More%20resources%20can%20be%20found%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fazure%252Fgovernance%252Fresource-graph%252Fconcepts%252Fexplore-resources%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334831802%26amp%3Bsdata%3DWHmf9mt6DQMxEmTeDrfy1pudUpRX4k7mRq7vppRT7uQ%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fgovernance%2Fresource-graph%2Fconcepts%2Fexplore-resources%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3Esecurityresources%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.security%2Fsecuritystatuses%22%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Bname%26nbsp%3B%3D~%26nbsp%3B'%7BComputer%7D'%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3Bp%3Darray_length(properties.resourceDetails)%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bmvexpand%26nbsp%3Bprop%3Dproperties.resourceDetails%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bparse%26nbsp%3Bid%26nbsp%3Bwith%26nbsp%3B*%22%2Fproviders%2F%22%26nbsp%3Bres%26nbsp%3B%22%2Fmachines%2F%22%26nbsp%3B*%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3Btype%26nbsp%3B%3D%26nbsp%3Biif%26nbsp%3B(res%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.hybridcompute%22%2C%26nbsp%3B%22HybridCompute-Arc%22%2C%22AzureCompute%22)%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3BComputerName%26nbsp%3B%3D%26nbsp%3Bname%2C%26nbsp%3BResource%3D%26nbsp%3Bprop.name%2C%26nbsp%3BStatus%26nbsp%3B%3D%26nbsp%3Bprop.value%2C%26nbsp%3Btype%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThis%20works%20by%20looking%20at%20%3CSTRONG%3Esecurityresources%3C%2FSTRONG%3E%2C%20then%20getting%20the%20computer%20name%20from%20our%20drop%20down%20(line%20%233)%2C%20I%20then%20get%20some%20of%20the%20property%20fields%20(you%20may%20need%20more%2Fless).%20I%20also%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Fdocs.microsoft.com%252Fen-us%252Fazure%252Fkusto%252Fquery%252Fparseoperator%26amp%3Bdata%3D02%257C01%257CClive.Watson%2540microsoft.com%257C612b70ece4204a250f4908d76688a270%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637090609334841793%26amp%3Bsdata%3DMv8iI0aaR21t6eLIZMDP842%252B7905eKBl5D2tpPpVeI4%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Eparse%3C%2FA%3E%20the%20ResourceID%20column%20to%20get%20the%20Resource%20Provider%20Name%2C%20%3CSTRONG%3Eif%3C%2FSTRONG%3E%20its%20%E2%80%9Cmicrosoft.hybridcompute%E2%80%9D%20then%20I%20display%20that%20its%20%3CSTRONG%3EAzure%20Arc%20%3C%2FSTRONG%3Ein%20the%3CSTRONG%3E%20type%20%3C%2FSTRONG%3Ecolumn%2C%20else%20it%20must%20be%20%3CSTRONG%3EAzureCompute%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EIf%20we%20swap%20the%20drop-down%20to%20a%20computer%20that%20is%20managed%20by%20Azure%20Arc%20we%20see%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156100iE69BD8864632BDBB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_6.png%22%20title%3D%22clipboard_image_6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENow%2C%20you%20will%20see%20the%20%E2%80%9Ctype%E2%80%9D%20column%20detects%20it%2C%20but%20there%20isn%E2%80%99t%20yet%20a%20lot%20of%20other%20information%20about%20this%20Azure%20Arc%20machine%2C%20hopefully%20this%20will%20improve%20in%20time.%26nbsp%3B%20However%20in%20my%20case%2C%20this%20machine%20is%20also%20in%20Azure%20Security%20Center%20so%20in%20my%201%3CSUP%3Est%3C%2FSUP%3E%26nbsp%3B%20Chart%20of%20the%20workbook%20you%20see%2C%20its%20ASC%20Security%20Event%20status%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156102i4506838CC534CA98%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_7.png%22%20title%3D%22clipboard_image_7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3ENote%3A%20there%20are%20a%202%3CSUP%3End%3C%2FSUP%3E%20and%203%3CSUP%3Erd%3C%2FSUP%3E%20Chart%20area%20for%20CEF%20and%20Syslog%20(not%20shown%2C%20but%20you%20can%20open%20the%20workbook%20to%20see%20them).%26nbsp%3B%20I%20also%20check%20and%20provide%20a%20map%20if%20the%20computer%20chosen%20has%20any%20MaliciousIP%20data%20(see%20previous%20posts%20for%20that).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EAzure%20Arc%20area%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20also%20created%20a%20dedicated%20area%20in%20the%20workbook%20for%20Azure%20Arc.%26nbsp%3B%20This%20is%20a%20display%20area%20where%20I%20show%20any%20Azure%20Arc%20machines%20(using%20ARG)%3B%20using%20the%20basic%20query%20of%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3Bresources%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3B%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.hybridcompute%2Fmachines%22%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156103i4727003A765D6390%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_8.png%22%20title%3D%22clipboard_image_8.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20update%20this%20query%20a%20bit%20yourself%20(edit%20the%20workbook)%2C%20maybe%20to%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3Bresources%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bwhere%26nbsp%3Btype%26nbsp%3B%3D%3D%26nbsp%3B%22microsoft.hybridcompute%2Fmachines%22%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bextend%26nbsp%3Bp%3Darray_length(properties.provisioningState)%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bmvexpand%26nbsp%3Bprop%3Dproperties.provisioningState%3C%2FP%3E%0A%3CP%3E%7C%26nbsp%3Bproject%26nbsp%3Bid%2C%26nbsp%3BComputerName%26nbsp%3B%3D%26nbsp%3Bname%2C%26nbsp%3BResource%3D%26nbsp%3Bprop.name%2C%26nbsp%3BStatus%26nbsp%3B%3D%26nbsp%3Bproperties.status%2C%26nbsp%3BState%3Dprop%2C%26nbsp%3Blocation%2C%26nbsp%3BresourceGroup%2C%26nbsp%3Btype%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156104i7EC1A0C234B42023%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_9.png%22%20title%3D%22clipboard_image_9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-999379%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20this%20article%20lets%20see%20how%20Azure%20Arc%20integrates%20its%20data%20into%20Azure%20Sentinel%20and%20how%20we%20can%20visualise%20that%20data%20in%20an%20accompanying%20security%20workbook%20alongside%20other%20Azure%20Compute%20resources.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F156095iFD8AF316E47D4CF1%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-999379%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Sentinel%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352714%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352714%22%20slang%3D%22en-US%22%3E%3CP%3EJust%20came%20across%20this%20while%20researching%20Azure%20Arc.%26nbsp%3B%20%26nbsp%3BWould%20we%20be%20able%20to%20use%20Azure%20Arc%20to%20push%20the%20Microsoft%20Management%20Agents%20to%20all%20the%20servers%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352751%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352751%22%20slang%3D%22en-US%22%3E%3CP%3EIt's%20sort%20of%20the%20other%20way%2C%20Arc%20uses%20the%20same%20Agent%20so%20it%20could%20already%20be%20on%20the%20machine%20for%20Arc%20to%20use%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-arc%2Fservers%2Foverview%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-arc%2Fservers%2Foverview%3C%2FA%3E%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3CEM%3ETo%20deliver%20this%20experience%20with%20your%20hybrid%20machines%20hosted%20outside%20of%20Azure%2C%20the%20Azure%20Connected%20Machine%20agent%20needs%20to%20be%20installed%20on%20each%20machine%20that%20you%20plan%20on%20connecting%20to%20Azure.%20T%3CSTRONG%3Ehis%20agent%20does%20not%20deliver%20any%20other%20functionality%3C%2FSTRONG%3E%2C%20and%20it%20%3CSTRONG%3Edoesn't%3C%2FSTRONG%3E%20replace%20the%20Azure%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Flog-analytics-agent%22%20data-linktype%3D%22relative-path%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3ELog%20Analytics%20agent%3C%2FA%3E.%20%3CSTRONG%3EThe%20Log%20Analytics%20agent%20for%20Windows%20and%20Linux%20is%20required%20when%20you%20want%20to%20proactively%20monitor%20the%20OS%20and%20workloads%20running%20on%20the%20machine%2C%20manage%20it%20using%20Automation%20runbooks%20or%20solutions%20like%20Update%20Management%2C%20or%20use%20other%20Azure%20services%20like%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsecurity-center%2Fsecurity-center-intro%22%20data-linktype%3D%22relative-path%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAzure%20Security%20Center%3C%2FA%3E.%3C%2FSTRONG%3E%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-arc%2Fservers%2Foverview%23connected-machine-agent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-arc%2Fservers%2Foverview%23connected-machine-agent%3C%2FA%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352766%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352766%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20answer.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20am%20reading%20the%20second%20paragraph%20correctly%20it%20sounds%20like%20you%20would%20need%20BOTH%20the%20Azure%20Connected%20Machine%20agent%20AND%20the%20Log%20Analytics%20agent%20if%20you%20want%20to%20get%20all%20the%20information.%26nbsp%3B%20Hopefully%20those%20will%20be%20combined%20at%20some%20point%20to%20make%20life%20easier.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352787%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352787%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20not%20aware%20of%20any%20plans%20like%20that%2C%20so%20wont%20comment.%26nbsp%3B%20However%20you%20only%20need%20the%20connected%20agent%20for%20Arc%2C%20but%20can%20also%20use%20the%20MMA%20%22%3CEM%3E%3CSTRONG%3Ewhen%20you%20want%20to%20proactively%20monitor%20the%20OS%20and%20workloads%20running%20on%20the%20machine%2C%3C%2FSTRONG%3E%3C%2FEM%3E%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1352808%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1352808%22%20slang%3D%22en-US%22%3E%3CP%3EOK.%26nbsp%3B%20Thanks%20again.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1391477%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1391477%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20Azure%20Arc%20agent%20is%20going%20to%20release%20an%20update%20in%20the%20next%20week%20or%20so%2C%20which%20will%20support%20extension%20deployment%20through%20Azure%20Arc%2C%20which%20means%20user%20would%20be%20able%20to%20use%20Policy%20or%20ARM%20template%20to%20deploy%20MMA%20extensions%20to%20the%20Arc%20machines.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1493635%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20Azure%20Arc%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1493635%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3BI%20just%20created%20a%20post%20explaining%20how%20you%20could%20use%20Azure%20Arc%20to%20push%20the%20MMA%20agent%20to%20all%20VMs%2Fservers%20using%20Azure%20Policies%20and%20remediation%20tasks%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fautomating-the-onboarding-on-premises-aws-and-gcp-vms-on%2Fba-p%2F1488267%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fautomating-the-onboarding-on-premises-aws-and-gcp-vms-on%2Fba-p%2F1488267%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIt%20uses%20the%20extension%20management%20feature%20that%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F57273%22%20target%3D%22_blank%22%3E%40Jian%20(Jane)%20Yan%3C%2FA%3E%26nbsp%3Bmentioned.%20You%20can%20also%20take%20a%20look%20at%20the%20automation%20we%20have%20for%20this%20scenario%20as%20part%20of%20the%20Azure%20Arc%20jumpstart%20repo%3A%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Flikamrat%2Fazure_arc%2Fblob%2Fmaster%2Fazure_arc_servers_jumpstart%2Fdocs%2Farc_policies_mma.md%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2Flikamrat%2Fazure_arc%2Fblob%2Fmaster%2Fazure_arc_servers_jumpstart%2Fdocs%2Farc_policies_mma.md%3C%2FA%3E%20Hope%20it%20helps!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Azure Arc was announced very recently https://azure.microsoft.com/en-gb/updates/azure-arc-for-servers-in-public-preview/ and https://azure.microsoft.com/en-gb/updates/azure-arc-for-servers-in-public-preview/

What is Azure Arc - this is the high-level summary:
Azure Arc extends Azure Resource Manager capabilities to Linux and Windows servers, as well as Kubernetes clusters on any infrastructure across on-premises, multi-cloud, and edge. With Azure Arc, customers can also run Azure data services anywhere, realizing the benefits of cloud innovation, including always up-to-date data capabilities, deployment in seconds (rather than hours), and dynamic scalability on any infrastructure. Azure Arc for servers is currently in public preview.

“Azure Arc for servers allows you to manage machines which are outside of Azure. When a non-Azure machine is connected to Azure, it becomes a Connected Machine and is treated as a resource in Azure. Each Connected Machine has a Resource ID, is managed as part of a Resource Group inside a subscription, and benefits from standard Azure constructs such as Azure Policy and tagging.”

 

This means you see servers in your Azure portal (thanks to Julius Davies for adding these two for me!).  These are two on-premises machines, in the Microsoft reading Campus (UK).

 

clipboard_image_1.png

 

You can see the same info in tools like Azure Resource Graph and the Sentinel Logs.  Azure Arc machines can be identified as they have a unique ResourceProvider value of   

“Microsoft.HybridCompute”.  This can help us detect these types of machines in the future. As this is a platform level feature we can use this in workbooks as I will show soon, but also in Incident or Hunting scenarios, you have access to the api or Logs (you do need the MMA for Logs).  Let me show you two ways of seeing these servers, outside of the Azure Arc portal:

 

Azure Resource Graph - example query:

 

 resources

|  where type == "microsoft.hybridcompute/machines"

 

clipboard_image_2.png

 

Azure Sentinel Logs - example query:

 

Heartbeat

| where ResourceProvider in ("Microsoft.Compute","Microsoft.HybridCompute")

| distinct Computer, ResourceProvider

| summarize count() by ResourceProvider, Computer

 

You might like to show this as a Pie Chart, and see how your usage of Arc grows over time?

 

clipboard_image_3.png

 

The workbook explained:

 

1. Download the workbook from here:  https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/SecurityStatus.json

2. See here for import instructions: https://techcommunity.microsoft.com/t5/Azure-Sentinel/How-to-use-Azure-Sentinel-to-follow-a-Users-tr...

 

 

I have created some options for you to select;  Subscriptions, Workspaces, Time and a Computer.  This will also work with Azure Lighthouse so works for an MSSP or if you have multiple Azure Directories in your organisation.

 

clipboard_image_4.png

 

 

So let’s now choose a Computer:

 

We see this report.

 

clipboard_image_5.png

For this I’m using a Azure Resource Graph Query, looking at the “securityresources” information - see lines 1 & 2 below.  More resources can be found here: https://docs.microsoft.com/en-us/azure/governance/resource-graph/concepts/explore-resources

 

securityresources

| where type == "microsoft.security/securitystatuses"

| where name =~ '{Computer}'

| extend p=array_length(properties.resourceDetails) 

| mvexpand prop=properties.resourceDetails

| parse id with *"/providers/" res "/machines/" *

| extend type = iif (res == "microsoft.hybridcompute", "HybridCompute-Arc","AzureCompute") 

| project ComputerName = name, Resource= prop.name, Status = prop.value, type

 

This works by looking at securityresources, then getting the computer name from our drop down (line #3), I then get some of the property fields (you may need more/less). I also parse the ResourceID column to get the Resource Provider Name, if its “microsoft.hybridcompute” then I display that its Azure Arc in the type column, else it must be AzureCompute

 

If we swap the drop-down to a computer that is managed by Azure Arc we see

 

clipboard_image_6.png

 

Now, you will see the “type” column detects it, but there isn’t yet a lot of other information about this Azure Arc machine, hopefully this will improve in time.  However in my case, this machine is also in Azure Security Center so in my 1st  Chart of the workbook you see, its ASC Security Event status:

 

clipboard_image_7.png

Note: there are a 2nd and 3rd Chart area for CEF and Syslog (not shown, but you can open the workbook to see them).  I also check and provide a map if the computer chosen has any MaliciousIP data (see previous posts for that).

 

 

Azure Arc area:

 

I also created a dedicated area in the workbook for Azure Arc.  This is a display area where I show any Azure Arc machines (using ARG); using the basic query of:

 

 resources

|  where type == "microsoft.hybridcompute/machines"

 

 

 

clipboard_image_8.png

You can update this query a bit yourself (edit the workbook), maybe to this:

 

 resources

| where type == "microsoft.hybridcompute/machines"

| extend p=array_length(properties.provisioningState) 

| mvexpand prop=properties.provisioningState

| project id, ComputerName = name, Resource= prop.name, Status = properties.status, State=prop, location, resourceGroup, type

clipboard_image_9.png

 

 

 

7 Comments
Super Contributor

Just came across this while researching Azure Arc.   Would we be able to use Azure Arc to push the Microsoft Management Agents to all the servers?

Microsoft

It's sort of the other way, Arc uses the same Agent so it could already be on the machine for Arc to use https://docs.microsoft.com/en-us/azure/azure-arc/servers/overview 

To deliver this experience with your hybrid machines hosted outside of Azure, the Azure Connected Machine agent needs to be installed on each machine that you plan on connecting to Azure. This agent does not deliver any other functionality, and it doesn't replace the Azure Log Analytics agent. The Log Analytics agent for Windows and Linux is required when you want to proactively monitor the OS and workloads running on the machine, manage it using Automation runbooks or solutions like Update Management, or use other Azure services like Azure Security Center.

 

https://docs.microsoft.com/en-us/azure/azure-arc/servers/overview#connected-machine-agent

Super Contributor

Thanks for the answer.

 

If I am reading the second paragraph correctly it sounds like you would need BOTH the Azure Connected Machine agent AND the Log Analytics agent if you want to get all the information.  Hopefully those will be combined at some point to make life easier.

Microsoft

I am not aware of any plans like that, so wont comment.  However you only need the connected agent for Arc, but can also use the MMA "when you want to proactively monitor the OS and workloads running on the machine,"

Super Contributor

OK.  Thanks again.

Microsoft

The Azure Arc agent is going to release an update in the next week or so, which will support extension deployment through Azure Arc, which means user would be able to use Policy or ARM template to deploy MMA extensions to the Arc machines.

Microsoft

Hi @Gary Bushey I just created a post explaining how you could use Azure Arc to push the MMA agent to all VMs/servers using Azure Policies and remediation tasks: https://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-onboarding-on-premises-aws-and-... 

 

It uses the extension management feature that @Jian (Jane) Yan mentioned. You can also take a look at the automation we have for this scenario as part of the Azure Arc jumpstart repo: https://github.com/likamrat/azure_arc/blob/master/azure_arc_servers_jumpstart/docs/arc_policies_mma.... Hope it helps!