How to On-Prem VMs Forward Events to Azure Sentinel?

AZ-801 By islever Editorial Last updated

Short answer

CD the Azure Monitor agent the Log Analytics VM extension for Windows

Question

You have 20 on-premises virtual machines that run Windows Server. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. You need to collect events from the on-premises virtual machines end forward the events to Workspace1. The solution must ensure that you can define filters to minimize the volume of collected events. Which two components should you install on each virtual machine? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
  1. the Azure Connected Machine agent
  2. the Azure VM Dependency agent extension for Windows
  3. the Azure Monitor agent Correct Answer
  4. the Log Analytics VM extension for Windows Correct Answer
  5. the Dependency agent

Key Takeaways

Tests the pairing of monitoring agents for direct Sentinel ingestion, while the common trap involves confusing legacy extension deployment with mandatory Azure Arc onboarding requirements.

This question evaluates hybrid log collection strategies for on-premises Windows servers forwarding telemetry to Azure Sentinel. Community discussion reveals a split between traditional workspace extensions and modern Azure Arc-dependent agent stacks.

Common mistake: Selecting the Azure Connected Machine agent and Azure Monitor agent (AC) due to modern hybrid best practices, which overlooks the exam’s reliance on direct Log Analytics extension compatibility.

Expert Analysis

Why the Answer Is Correct

The Azure Monitor agent (Option C) replaces legacy collectors and supports advanced data filtering to reduce event volume before transmission. Paired with the Log Analytics VM extension (Option D), it establishes a secure channel directly to Workspace1 without requiring additional platform services. This combination satisfies the exam's requirement for minimizing collected events while ensuring reliable ingestion into Azure Sentinel.

Why the Other Options Are Wrong

Option A enables Azure Arc management but does not natively handle security event filtering or direct Sentinel routing in this context. Options B and E focus exclusively on application dependency mapping and network topology visualization, making them irrelevant for operational log collection. Consequently, these components fail to meet the core telemetry forwarding and filtering objectives outlined in the scenario.

Community Comment Notes

Candidates remain divided between CD and AC, reflecting real-world architectural shifts toward Azure Arc. Comment [2] and [3] correctly note that production environments typically require the Connected Machine agent to enable AMA deployment on non-Azure resources. Meanwhile, Comment [1] and [5] emphasize that the Log Analytics VM extension remains a valid exam pathway for direct workspace connectivity. This discrepancy highlights the importance of recognizing legacy versus modern hybrid monitoring patterns in certification contexts.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When reviewing hybrid monitoring questions, carefully distinguish between direct workspace extensions and Azure Arc-dependent agent deployments. Prioritize options that explicitly mention filter capabilities and direct Sentinel connectivity, as exam scenarios often test practical data reduction techniques over theoretical onboarding steps.

Community Votes

CD
50%
AC
50%

50% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Krayzr 👍 1
    Azure Connected Machine agent: This agent is installed on each on-premises VM to onboard it to Azure Arc. For non-Azure machines, such as on-premises VMs, the Azure Monitor agent requires Azure Arc connectivity to function, making this a necessary first step. Azure Monitor agent: Once the VMs are connected via Azure Arc, this agent is deployed as an extension to collect events. It supports advanced filtering through DCRs, meeting the requirement to minimize event volume, and sends the filtered data to Workspace1.
  2. mrpoopybuthole 👍 1
    A is not needed, as Azure Arc is not needed for log collection. D is correct since we are connecting the VM to the Log Analytics workspace.
  3. ducklaorange 👍 1
    As they are on premise resource and we have no other information it's A&C. Source: have >10k endpoints in Azure Arc :)
  4. BlackCat9588 👍 1
    I think it should be C & D. please let me know if I am wrong
  5. NicolaF 👍 1
    for me i C and D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

What should you do first to implement JIT VM access for VM1?

S-grade

Which Groups Grant Least Privilege to Add a Windows Server 2022 DC?

S-grade

Where Can You Enable Microsoft Defender for Servers in Azure?

S-grade

How to View Available Storage in a Storage Spaces Direct Pool?

S-grade

← Back to AZ-801 Study Guide