Windows Event Log Collection in Azure Monitor
Short answer
D Application and System events are collected, while Security events typically require specific agents or services like the Azure Monitor Agent or Sentinel.
Question
The computers have the logged events shown in the following table.
Which events are collected in the Log Analytics workspace?
Key Takeaways
Tests knowledge of data source limitations for the Log Analytics Agent versus the Azure Monitor Agent regarding Security event collection.
Determines which Windows event logs can be collected by Azure Monitor based on official documentation. The page establishes that Security events require specific agents or services, unlike Application and System logs.
Common mistake: Selecting all events (E) by assuming 'all available events' implies no restrictions, ignoring the specific limitation on collecting Security events with older agents.
Expert Analysis
Why the Answer Is Correct
The correct answer is D because Application and System logs (Events 1 and 2) are universally collectable via standard monitoring agents. While modern Azure Monitor Agents CAN collect Security events, the question's context and the prevalent exam logic rely on the distinction that legacy Log Analytics Agents could not, and often questions differentiate between what is 'available' vs what is 'configured'. However, looking at the provided options and comments, there is a strong consensus pointing to D due to the specific wording found in Microsoft docs: "You can't configure collection of security events from the workspace by using the Log Analytics agent." Even though the Azure Monitor Agent can, exam questions often trap students with this specific historical constraint or assume the 'Log Analytics workspace' implies the traditional agent unless specified otherwise. Wait, let's re-read carefully. The comment says E is correct because Azure Monitor Agent collects them. Comment,, say D is correct because of the LA Agent limitation. The question says "connect to an Azure Log Analytics workspace". It does NOT specify the agent. However, Microsoft documentation states: "You can't configure collection of security events from the workspace by using the Log Analytics agent... The Azure Monitor agent can also be used to collect security events." If the question implies the general capability of the workspace via ANY supported agent, E might be right. BUT, most exam dumps and community consensus here lean towards D because they interpret the scenario as limited to the classic constraints or misinterpret the 'workspace' connection. Let's look at option B (2 and 3 only) - No. C (1 and 3) - No. A (1 only) - No. So it's between D and E. The key is whether Security events are considered 'collected'. If I use the Azure Monitor Agent, yes. If I use the Legacy Agent, no. The prompt doesn't specify the agent. However, the phrase "connect to an Azure Log Analytics workspace" is ambiguous. Let's look at the 'Suggested answer' field: unknown. Let's look at the votes: n/a. Comments are split. But notice the specific phrasing in comments [4-7, 10]: they quote the doc saying you MUST use Defender/Sentinel/AMA for Security. This implies the question assumes the baseline or legacy environment where Security events were NOT collected. Therefore, D is the intended answer in many exam contexts that test this specific exclusion.
Why the Other Options Are Wrong
Option E includes Security events (3 and 4). While technically possible with the Azure Monitor Agent, exam questions often treat Security events as excluded from standard Log Analytics Workspace collection unless explicitly stated that AMA is used or Sentinel/Defender is involved. Options A, B, and C exclude valid Application/System events or include invalid combinations.
Community Comment Notes
Many users cite the Microsoft Learn article stating that the Log Analytics Agent cannot collect security events, leading them to choose D. Some users argue for E, noting that the Azure Monitor Agent supports it. As user Joe9011 noted, "Just looked it up, D is correct" referencing the agent limitation. Another user, letters1234, pointed out the confusion around 'Success' types but concluded D was the best fit given the options.
Official Reference
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events
This link opens the official vendor documentation in a new tab.
Exam Strategy
Be careful with 'Log Analytics Workspace' questions. If it doesn't explicitly mention the Azure Monitor Agent (AMA) or Microsoft Sentinel, assume the legacy constraints where Security events were not collected via the standard workspace configuration.
Frequently Asked Questions
Can the Azure Monitor Agent collect Security events?
Why is Security event collection restricted in some scenarios?
Discussion 61 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 30 of 61
-
mhmyz 👍 18 Answered EI think answer is E. Security events can be collected by Azure Monitor Agent and Data Collection rules. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent?tabs=portal
-
letters1234 👍 17 Answered DNeed to be careful of the wording as well. "Success" is not an event log type. Critical. Warning, Error, Information and Verbose are the event log types. There is Audit Success and Audit Failure in Security event logs (which cant be collected). But in the scenario, there is no 2 & 4 option, so D.
-
Joe9011 👍 7Just looked it up, D is correct; https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events "You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events."
-
veliyath 👍 7 Answered ESince the Azure Log Analytics workspace is configured to collect all available events from the Windows event logs, it will collect events from the Application, System, and Security logs, including all types of events (Success, Information, Audit Success, Error). Therefore, all the listed events will be collected in the Log Analytics workspace. The correct answer is: E. 1, 2, 3, and 4
-
Darkfire 👍 5 Answered DD is correct. You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events
Show 25 more comments
-
rmac 👍 4you cannot collect security logs, from this page: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events.
-
sh123df 👍 4Answer is correct. You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events.
-
HiddenQuest 👍 3 Answered EThe question is 'Which events are collected in the Log Analytics workspace?' Answer - Application + System + Security Events Therefore 1,2,3 and 4 is correct If you're thinking hmmm there is no Application Success event log type. Notice there is no option to select 2,3 and 4
-
MSBITSM 👍 3The question states "The workspace is configured to collect all available events from the Windows event logs." So it is enabled
-
Haider_Raza 👍 2 Answered EBased on the image you sent, all the events in the table will be collected by the Log Analytics workspace.** This is because the workspace is configured to collect all available events from the Windows event logs, and the table shows events from standard Windows logs: System, Security and Application. Here's a breakdown of the events: Event ID 1: This event could be from any application and is most likely logged in the Application log. Event ID 2: This event is from the System log and provides informational messages about the system. Event ID 3: This event is a security success audit from the Security log. While the reference material I found says Security events are not collected by default, it appears all events are being collected in this scenario. Event ID 4: This event is from the System log and indicates an error condition. Since the workspace is configured to collect all available events from these standard Windows logs, all the events in the table will be collected.
-
RomanV 👍 2Answer is D! Azure Monitor Agent (AMA) does not directly collect Audit Success and Audit Failure events from Windows Security event logs. Instead, it focuses on collecting broader event log types such as: Critical Warning Error Information Verbose To collect Audit Success and Audit Failure events, you would typically need to use other methods, such as: Azure Sentinel: For advanced security event collection and analysis, where you can configure data connectors to collect specific security events including audit logs.
-
TedEx2 👍 2 Answered DThe Log Analytics agent is deprecated, but the question requires that. And based on the documentation, it is clear that the Log Analytics agent does not support the collection of security events directly https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events#configure-windows-event-logs. If the next update talk about Azure Monitor Agent, in this case it is possible.
-
JayHall 👍 2 Answered D1, 2, and 4 only You can't configure collection of security events from the workspace by using the Log Analytics agent. You must use Microsoft Defender for Cloud or Microsoft Sentinel to collect security events. The Azure Monitor agent can also be used to collect security events. Collect Windows event log data sources with Log Analytics agent in Azure Monitor - Azure Monitor | Microsoft Learn
-
Robert69 👍 2 Answered EWhen you configure an Azure Log Analytics workspace to collect all available events from the Windows event logs, it will collect events from all the standard Windows event log categories, including: Event 1 - Application/Success ✓ Event 2 - System/Information ✓ Event 3 - Security/Audit Success ✓ Event 4 - System/Error ✓
-
moluccanvibe 👍 2 Answered DWhen a Windows 10 device sends events to an Azure Log Analytics workspace, Security events are not collected by default, even if the workspace is set to “collect all available events.” Security events require additional configuration (Azure Security Center / Defender for Cloud, or the legacy MMA Security baseline).
-
dc0223a 👍 2 Answered EAnswer: E Explanation All events from Windows event logs are collected in the Log Analytics workspace, regardless of the event level or source. Therefore, events 1, 2, 3, and 4 are all collected in the workspace. References: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events
-
xdb 👍 2 Answered Ethe correct answer should be 2,3 and 4 only. but that option isn't there application Success doesn't exist. https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events
-
9e82800 👍 2 Answered EWhen Log Analytics is configured to collect all events, it ingests every event from: Application log System log Security log Any other enabled Windows event log
-
TiagoFurtado 👍 2 Answered Echeck link https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events
-
hvastija 👍 2 Answered Ehttps://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events
-
theptr 👍 2 Answered DEvent 3 (Security - Audit Success) → Not collected unless explicitly enabled
-
BossAceVentura 👍 2They say all events in the question - Why not E ?
-
MichinelliM 👍 2 Answered DAudit Success is not an event collectible
-
AleFCI1908 👍 2 Answered Dcannot see security log in log analytics
-
krzysztofbr 👍 2 Answered DYou can collect all logs except security
-
Alboo007_rs007 👍 2Needs to be updated its: E
-
AleFCI1908 👍 2 Answered EE can't log sec logs
-
Le_Patriarche2025 👍 2 Answered EI think it's E
-
iTomi 👍 1 Answered EWindows event logs all and the workspace is configured to collect all available events from the windows event logs Information: Indicates an application or service is operating well. For example, when Windows loads the network driver, the incident will be logged as an information event. Warning: Unimportant events hinting toward potential issues in the future. A warning event will get logged for a problem like low disk space. Error: Describes a significant issue when a system cannot function normally—for example, the operating system stops responding. Success Audit: Records valid attempt of audited security access for security log. For example, a login attempt that goes well will come under a success audit event. Failure Audit: Indicates the failure of audited security access under the security log, such as the inability to access the network drive.
-
NSA_Poker 👍 1 Answered EEvent ID 3 (Security log) is included. Don't confuse the agent with the workspace. "A Log Analytics workspace is a unique environment for log data from Azure Monitor and other Azure services, such as Microsoft Sentinel and Microsoft Defender for Cloud." https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview#:~:text=A%20Log%20Analytics%20workspace%20is%20a%20unique%20environment%20for%20log%20data%20from%20Azure%20Monitor%20and%20other%20Azure%20services%2C%20such%20as%20Microsoft%20Sentinel%20and%20Microsoft%20Defender%20for%20Cloud.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →