How to On-Prem VMs Forward Events to Azure Sentinel?

You have 20 on-premises virtual machines that run Windows Server. You have an Azure subscription that contains a Microsoft Sentinel workspace named Workspace1. You need to collect events from the on-premises virtual machines end forward the events to Workspace1. The solution must ensure that you can define filters to minimize the volume of collected events. Which two components should you install on each virtual machine? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  1. the Azure Connected Machine agent
  2. the Azure VM Dependency agent extension for Windows
  3. the Azure Monitor agent Source Reference Answer
  4. the Log Analytics VM extension for Windows Source Reference Answer
  5. the Dependency agent

Community Votes

CD
50%
AC
50%

50% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the pairing of monitoring agents for direct Sentinel ingestion, while the common trap involves confusing legacy extension deployment with mandatory Azure Arc onboarding requirements.

This question evaluates hybrid log collection strategies for on-premises Windows servers forwarding telemetry to Azure Sentinel. Community discussion reveals a split between traditional workspace extensions and modern Azure Arc-dependent agent stacks.

Selecting the Azure Connected Machine agent and Azure Monitor agent (AC) due to modern hybrid best practices, which overlooks the exam’s reliance on direct Log Analytics extension compatibility.

Community Discussion (5 comments)

mrpoopybuthole 👍 1 Selected: CD
A is not needed, as Azure Arc is not needed for log collection. D is correct since we are connecting the VM to the Log Analytics workspace.
Krayzr 👍 1 Selected: AC
Azure Connected Machine agent: This agent is installed on each on-premises VM to onboard it to Azure Arc. For non-Azure machines, such as on-premises VMs, the Azure Monitor agent requires Azure Arc connectivity to function, making this a necessary first step. Azure Monitor agent: Once the VMs are connected via Azure Arc, this agent is deployed as an extension to collect events. It supports advanced filtering through DCRs, meeting the requirement to minimize event volume, and sends the filtered data to Workspace1.
ducklaorange 👍 1 Selected: AC
As they are on premise resource and we have no other information it's A&C. Source: have >10k endpoints in Azure Arc :)
BlackCat9588 👍 1 Selected: CD
I think it should be C & D. please let me know if I am wrong
NicolaF 👍 1
for me i C and D

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The Azure Monitor agent (Option C) replaces legacy collectors and supports advanced data filtering to reduce event volume before transmission. Paired with the Log Analytics VM extension (Option D), it establishes a secure channel directly to Workspace1 without requiring additional platform services. This combination satisfies the exam's requirement for minimizing collected events while ensuring reliable ingestion into Azure Sentinel.

Why the Other Options Are Wrong

Option A enables Azure Arc management but does not natively handle security event filtering or direct Sentinel routing in this context. Options B and E focus exclusively on application dependency mapping and network topology visualization, making them irrelevant for operational log collection. Consequently, these components fail to meet the core telemetry forwarding and filtering objectives outlined in the scenario.

Community Comment Notes

Candidates remain divided between CD and AC, reflecting real-world architectural shifts toward Azure Arc. Comment [2] and [3] correctly note that production environments typically require the Connected Machine agent to enable AMA deployment on non-Azure resources. Meanwhile, Comment [1] and [5] emphasize that the Log Analytics VM extension remains a valid exam pathway for direct workspace connectivity. This discrepancy highlights the importance of recognizing legacy versus modern hybrid monitoring patterns in certification contexts.

Official Reference

Exam Strategy

When reviewing hybrid monitoring questions, carefully distinguish between direct workspace extensions and Azure Arc-dependent agent deployments. Prioritize options that explicitly mention filter capabilities and direct Sentinel connectivity, as exam scenarios often test practical data reduction techniques over theoretical onboarding steps.

Related Analysis

You have a management group named MG1 that contains an Azure

S-Grade

Note: This question is part of a series of questions that pr

A-Grade

You have an Azure subscription. The subscription contains a

A-Grade

← Back to AZ-801 Study Guide