Monitor and protect VMs with Azure native services

Microsoft Azure native services let you monitor, manage, and protect your virtual machines (VMs) in a hybrid environment (Azure, Azure VMware Solution, and on-premises). In this article, you'll integrate Azure native services in your Azure VMware Solution private cloud. You'll also learn how to use the tools to manage your VMs throughout their lifecycle.

The Azure native services that you can integrate with Azure VMware Solution include:

  • Azure Arc extends Azure management to any infrastructure, including Azure VMware Solution, on-premises, or other cloud platforms. Azure Arc-enabled servers lets you manage your Windows and Linux physical servers and virtual machines hosted outside of Azure, on your corporate network, or another cloud provider. You can attach a Kubernetes cluster hosted in your Azure VMware Solution environment using Azure Arc enabled Kubernetes.

  • Azure Monitor collects, analyzes, and acts on telemetry from your cloud and on-premises environments. It requires no deployment. You can monitor guest operating system performance to discover and map application dependencies for Azure VMware Solution or on-premises VMs. Your Log Analytics workspace in Azure Monitor enables log collection and performance counter collection using the Log Analytics agent or extensions.

    With Azure Monitor, you can collect data from different sources to monitor and analyze and different types of data for analysis, visualization, and alerting. You can also create alert rules to identify issues in your environment, like high use of resources, missing patches, low disk space, and heartbeat of your VMs. You can set an automated response to detected events by sending an alert to IT Service Management (ITSM) tools. Alert detection notification can also be sent via email.

  • Microsoft Defender for Cloud strengthens data centers' security and provides advanced threat protection across hybrid workloads in the cloud or on-premises. It assesses Azure VMware Solution VMs' vulnerability, raises alerts as needed, and forwards them to Azure Monitor for resolution. For instance, it assesses missing operating system patches, security misconfigurations, and endpoint protection. You can also define security policies in Microsoft Defender for Cloud.

  • Azure Update Management manages operating system updates for your Windows and Linux machines in a hybrid environment in Azure Automation. It monitors patching compliance and forwards patching deviation alerts to Azure Monitor for remediation. Azure Update Management must connect to your Log Analytics workspace to use stored data to assess the status of updates on your VMs.

  • Log Analytics workspace stores log data. Each workspace has its own data repository and configuration to store data. You can monitor Azure VMware Solution VMs through the Log Analytics agent. Machines connected to the Log Analytics Workspace use the Log Analytics agent to collect data about changes to installed software, Microsoft services, Windows registry and files, and Linux daemons on monitored servers. When data is available, the agent sends it to Azure Monitor Logs for processing. Azure Monitor Logs applies logic to the received data, records it, and makes it available for analysis. Use the Azure Arc enabled servers VM extensions support to deploy Log Analytics agents on VMs.

Benefits

  • Azure native services can be used to manage your VMs in a hybrid environment (Azure, Azure VMware Solution, and on-premises).
  • Integrated monitoring and visibility of your Azure, Azure VMware Solution, and on-premises VMs.
  • With Azure Update Management in Azure Automation, you can manage operating system updates for both your Windows and Linux machines.
  • Microsoft Defender for Cloud provides advanced threat protection, including:
    • File integrity monitoring
    • Fileless security alerts
    • Operating system patch assessment
    • Security misconfigurations assessment
    • Endpoint protection assessment
  • Easily deploy the Log Analytics agent using Azure Arc enabled servers VM extension support for new and existing VMs.
  • Your Log Analytics workspace in Azure Monitor enables log collection and performance counter collection using the Log Analytics agent or extensions. Collect data and logs to a single point and present that data to different Azure native services.
  • Added benefits of Azure Monitor include:
    • Seamless monitoring
    • Better infrastructure visibility
    • Instant notifications
    • Automatic resolution
    • Cost efficiency

Topology

The diagram shows the integrated monitoring architecture for Azure VMware Solution VMs.

Diagram showing the integrated Azure monitoring architecture.

The Log Analytics agent enables collection of log data from Azure, Azure VMware Solution, and on-premises VMs. The log data is sent to Azure Monitor Logs and stored in a Log Analytics workspace. You can deploy the Log Analytics agent using Arc enabled servers VM extensions support for new and existing VMs.

Once the Log Analytics workspace collects the logs, you can configure the Log Analytics workspace with Defender for Cloud to assess the vulnerability status of Azure VMware Solution VMs and raise an alert for any critical vulnerability. For instance, it assesses missing operating system patches, security misconfigurations, and endpoint protection.

You can configure the Log Analytics workspace with Microsoft Sentinel for alert detection, threat visibility, hunting, and threat response. In the preceding diagram, Defender for Cloud is connected to Microsoft Sentinel using the Defender for Cloud connector. Defender for Cloud forwards the environment vulnerability to Microsoft Sentinel to create an incident and map with other threats. You can also create the scheduled rules query to detect unwanted activity and convert it to the incidents.

Before you start

If you are new to Azure or unfamiliar with any of the services previously mentioned, review the following articles:

Enable Azure Update Management

Azure Update Management in Azure Automation manages operating system updates for your Windows and Linux machines in a hybrid environment. It monitors patching compliance and forwards patching deviation alerts to Azure Monitor for remediation. Azure Update Management must connect to your Log Analytics workspace to use stored data to assess the status of updates on your VMs.

  1. Before you can add Log Analytics Workspace to Azure Update Management, you first need to Create an Azure Automation account.

    Tip

    You can use an Azure Resource Manager (ARM) template to create an Automation account. Using an ARM template takes fewer steps compared to other deployment methods.

  2. Create a Log Analytics workspace in the Azure portal. If you prefer, you can also create a workspace via CLI, PowerShell, or Azure Resource Manager template.

  3. Enable Update Management from an Automation account. In the process, you'll link your Log Analytics workspace with your automation account.

  4. Once you've enabled Update Management, you can deploy updates on VMs and review the results.

Enable Microsoft Defender for Cloud

Assess the vulnerability of Azure VMware Solution VMs and raise alerts as needed. These security alerts can be forwarded to Azure Monitor for resolution. For more information, see Supported features for VMs.

Defender for Cloud offers many features, including:

  • File integrity monitoring
  • Fileless attack detection
  • Operating system patch assessment
  • Security misconfigurations assessment
  • Endpoint protection assessment

Note

Microsoft Defender for Cloud is a pre-configured tool that doesn't require deployment, but you'll need to enable it in the Azure portal.

  1. Add Azure VMware Solution VMs to Defender for Cloud.

  2. Enable Microsoft Defender for Cloud. Defender for Cloud assesses the VMs for potential security issues. It also provides security recommendations in the Overview tab.

  3. Define security policies in Defender for Cloud.

For more information, see Integrate Microsoft Defender for Cloud with Azure VMware Solution.

Onboard VMs to Azure Arc enabled servers

Extend Azure management to any infrastructure, including Azure VMware Solution, on-premises, or other cloud platforms. For information on enabling Azure Arc enabled servers for multiple Windows or Linux VMs, see Connect hybrid machines to Azure at scale.

Onboard hybrid Kubernetes clusters with Azure Arc-enabled Kubernetes

Attach a Kubernetes cluster hosted in your Azure VMware Solution environment using Azure Arc enabled Kubernetes. For more information, see Create an Azure Arc-enabled Kubernetes cluster.

Deploy the Log Analytics agent

Monitor Azure VMware Solution VMs through the Log Analytics agent. Machines connected to the Log Analytics workspace use the Log Analytics agent to collect data about changes to installed software, Microsoft services, Windows registry and files, and Linux daemons on monitored servers. When data is available, the agent sends it to Azure Monitor Logs for processing. Azure Monitor Logs applies logic to the received data, records it, and makes it available for analysis.

Deploy the Log Analytics agent by using Azure Arc-enabled servers VM extension support.

Enable Azure Monitor

Can collect data from different sources to monitor and analyze and different types of data for analysis, visualization, and alerting. You can also create alert rules to identify issues in your environment, like high use of resources, missing patches, low disk space, and heartbeat of your VMs. You can set an automated response to detected events by sending an alert to IT Service Management (ITSM) tools. Alert detection notification can also be sent via email.

Monitor guest operating system performance to discover and map application dependencies for Azure VMware Solution or on-premises VMs. Your Log Analytics workspace in Azure Monitor enables log collection and performance counter collection using the Log Analytics agent or extensions.

  1. Design your Azure Monitor Logs deployment

  2. Enable Azure Monitor for VMs overview

  3. Configure Log Analytics workspace for Azure Monitor for VMs.

  4. Create alert rules to identify issues in your environment:

Next steps

Now that you've covered Azure VMware Solution network and interconnectivity concepts, you may want to learn about integrating Microsoft Defender for Cloud with Azure VMware Solution.