Configure a policy to pull software data of multiple VMs

Configure an Azure policy to use a single workspace for pulling the software data of multiple virtual machines (VMs) in different subscriptions.

Antes de Iniciar

• Ensure that you’ve configured the Service Graph Connector for Microsoft Azure. For more information, see Configure Service Graph Connector for Microsoft Azure using the guided setup.
• Ensure that you have the Resource Policy Contributor and User Access Administrator roles. For more information, see, What is Azure Policy? on the Azure documentation site.

Role required: Resource Policy Contributor and User Access Administrator of the Azure directory

Por Que e Quando Desempenhar Esta Tarefa

Workspaces are associated with single subscriptions only. So, rather than configuring a subscription every time for pulling software data using the connector, you can add VMs from various subscriptions to a single workspace by using the following Azure policies:

• For Windows-based VMs: LogAnalyticsExtension_Windows_VM_Deploy.json
• For Linux-based VMs: LogAnalyticsExtension_Linux_VM_Deploy.json

For more information, see Azure policy definitions on the GitHub repository.

Nota:

This configuration is optional and is done after you’ve configured the Service Graph Connector for Microsoft Azure.

Procedimento

1. Sign in to the Azure portal.
2. Navigate to Subscriptions and then select Manage policies.
3. From the left menu, select Settings > Policies.
4. On the Policy page, select Assign policy.
5. In the Policy definition field of the Basics tab, select the ellipsis icon (...).
6. In the Available Definitions side panel, search for the policy based on your machine type.
   • For Windows-based VMs, select Deploy - Configure Log Analytics extension to be enabled on Windows virtual machines policy.
   • For Linux-based VMs, select Deploy - Configure Log Analytics extension to be enabled on Windows virtual machines policy.
7. Select Add.
8. Select the Parameters tab.
9. In the Log Analytics workspace field of the Parameters tab, select the ellipsis icon (...).
10. From the Subscription and workspaces lists of the Log Analytics workspace side panel, select a subscription and the workspace to connect the multiple VMs with different subscriptions.
11. Select Review + create on the Assign policy page.
12. Review the selected options and then select Create.
    The assignment of the policy could take some time.

    Nota:

    The policy enables the role assignments to the VMs of that subscription by installing the extension in the VMs.
13. Repeat steps 10 to 12 for each subscription to be associated with the workspace.
14. Create a remediation task for the policy to complete the compliance process of the existing VMs associated with the subscriptions.
    For more information, see Create a remediation task in the Azure documentation.
15. Add the VMs to the inventory in the linked automation account.

    For more information, see Enable Change Tracking and Inventory from an Automation account in the Azure documentation.