Is "adding the Microsoft Monitoring Agent VM extension" different than "installing the Microsoft Monitoring Agent VM agent"?

Question

Related to Az-104, I encountered a certain question in one of the online tests:

You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

The solution is -

1. Create an Azure Log Analytics workspace and configure the data settings.
2. ???
3. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

For #2, I see two variations:

• Add the Microsoft Monitoring Agent VM extension to VM1
• Install the Microsoft Monitoring Agent VM agent to VM1

I wonder if there is a difference between the two or is only one of them correct or both. I have referenced the official docs and they are not clear enough - https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview and https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-monitor/agents/azure-monitor-agent-manage.md and https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client.

Answer 1

For Azure VMs and Arc servers the extension is the correct one. The agent is for Windows clients (not servers) that are not Azure VMs or Arc servers.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.