You have a Microsoft Azure subscription that contains an Azure Log Analytics workspace.
You deploy a new computer named Computer1 that runs Windows 10. Computer1 is in a workgroup.
You need to ensure that you can use Log Analytics to query events from Computer1.
What should you do on Computer1?
To ensure that you can use Log Analytics to query events from Computer1, you should install the Azure Monitor Agent. This agent is responsible for collecting monitoring data from the operating system and workloads of the computer and then sending it to your Azure Log Analytics workspace, where you can analyze and query the data. Other actions such as joining Azure AD, configuring Windows Defender Firewall, or creating an event subscription are not directly related to enabling the collection and querying of events through Azure Log Analytics.
No, the Azure Monitor Agent cannot be installed on a Windows 10 computer that isn't Azure AD joined. The Azure Monitor Agent uses Azure AD authentication to connect to the Log Analytics workspace, and Azure AD authentication requires the computer to be joined to Azure AD. If you want to collect data from a Windows 10 computer that isn't Azure AD joined, you can use the Microsoft Monitoring Agent (MMA). The MMA is a legacy agent that does not require the computer to be joined to Azure AD. However, the MMA is not as feature-rich as the Azure Monitor Agent, and it is not supported as long. In general, it is recommended to join all Windows 10 computers to Azure AD. This makes it easier to manage and secure the computers, and it enables you to use a variety of Azure services, such as Microsoft Intune and Azure Conditional Access.
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites The machine must be domain joined to a Microsoft Entra tenant (AADj or Hybrid AADj machines)
I think A as well The machine must be domain joined to a Microsoft Entra tenant (AADj or Hybrid AADj machines), which enables the agent to fetch Microsoft Entra device tokens used to authenticate and fetch data collection rules from Azure. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites
The Azure Monitor Agent can be used to query events on a computer that is not joined to Azure AD. Joining Azure AD offers additional benefits like centralized management and conditional access, but it's not necessary for basic event collection. Here's what you need to know for each method: Using the Azure Monitor Agent: Install the Azure Monitor Agent on the computer that is not joined to Azure AD. Configure the agent to connect to your Log Analytics workspace using a Workspace Access Key instead of Azure AD authentication. Define data collection rules to specify which events you want to collect. The agent will collect and send the chosen events to your Log Analytics workspace where you can query them.
I would choose answer D, install Azure monitor Agent
is the right one. I initially thought I can just download the Azure Monitor Agent MSI. But then, I saw this https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#:~:text=Not%20Microsoft%20Entra,try%20installation%20again. "join the device with a Microsoft Entra tenant"
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client
Computer1 is non-Azure. To install the agent on physical servers and virtual machines hosted outside of Azure (that is, on-premises) or in other clouds, you must install the Azure Arc Connected Machine agent first, at no added cost. The Azure Arc Connected Machine agent wasnt options, so only right answer would be A Join Azure AD https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal#prerequisites
To ensure that you can use Log Analytics to query events from Computer1, you should Install the Azure Monitor Agent (Option D) on Computer1. D. Install the Azure Monitor Agent
The question states , “You need to ensure that you can use Log Analytics to query events from Computer1.” And not what needs to be done first. What do you need to get the log analytics to work.
D is must, A can be done later
A is correct. with the old agent joning the domain/ aad is not needed.
To ensure that you can use Log Analytics to query events from a Windows 10 computer that is in a workgroup, you should: D. Install the Azure Monitor Agent. Installing the Azure Monitor Agent on Computer1 is necessary for it to communicate and send data to the Azure Log Analytics workspace. This agent collects monitoring data from the operating system and workloads of the computer, then sends it to the workspace where you can analyze and query the data. Joining Azure AD, configuring Windows Defender Firewall, or creating an event subscription are not directly related to enabling the collection and querying of events through Azure Log Analytics.
Must be domain joined. Ref: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites
D. Install the Azure Monitor Agent https://learn.microsoft.com/en-us/azure/azure-monitor/logs/queries?tabs=groupby#permissions-required
think its D - https://www.mdmandgpanswers.com/blogs/view-blog/windows-10-and-server-event-logs-to-azure-log-analytics-walkthru
D seems correct