Edit

What is Azure Change Tracking and Inventory?

Azure Change Tracking and Inventory (CTI) is an Azure service that improves auditing and governance for in-guest operations by monitoring configuration changes and providing detailed inventory logs across servers in Azure, on-premises, and other cloud environments. It helps you detect configuration drift and maintain visibility into system assets.

Important

Use Change Tracking and Inventory with the Change Tracking extension version 2.20.0.0 or later.

The service provides two core capabilities: change tracking and inventory.

Change tracking

  • Monitors configuration changes, including file modifications, registry keys, software installations, and Windows services or Linux daemons.
  • Provides detailed logs of what changed and when to quickly detect configuration drift or unauthorized changes.
  • Change tracking metadata is ingested into the ConfigurationChange table in the connected Log Analytics workspace. For more information, see ConfigurationChange.

Note

Change Tracking and Inventory logs data for both system-level and user-level applications. System-level data is always logged, but user-level applications appear only when a user signs in to a machine. When the user signs out, those applications are marked as Removed.

Inventory

  • Collects and maintains an updated inventory of installed software, operating system details, and other machine configuration data in connected Log Analytics workspaces.
  • Provides an overview of system assets to support compliance, audits, and proactive maintenance.
  • Ingests inventory metadata into the ConfigurationData table in the connected Log Analytics workspace. For more information, see ConfigurationData.

For more information about the enhanced discovery and onboarding experience in Change Tracking and Inventory for managing in-guest actions, see the Microsoft Community Hub blog.

Key benefits of Azure Change Tracking and Inventory

  • Compatibility with Azure Monitor Agent (AMA): It's compatible with the Azure Monitor Agent (AMA), which enhances security and reliability and facilitates a multihoming experience for data storage.
  • Compatibility with the Change Tracking extension: It's compatible with the Change Tracking extension deployed through Azure Policy on the client's virtual machine (VM). After you switch to AMA, the Change Tracking extension sends software, files, and registry data to AMA.
  • Multihoming support with Azure Monitor Logs: It standardizes management from one central workspace. You can transition from Azure Monitor Logs to AMA so that all VMs point to a single workspace for data collection and maintenance.
  • Data collection rule (DCR) management: It uses data collection rules (DCRs) to configure or customize various aspects of data collection. A DCR is an Azure Monitor configuration that defines what monitoring data is collected, from which machines, and where it is sent. For example, you can change the file collection frequency.

For information on supported operating systems, see Support matrix and regions for Change Tracking and Inventory.

Enable Azure Change Tracking and Inventory

You can enable Change Tracking and Inventory in the following ways:

What Change Tracking and Inventory tracks

Azure Change Tracking and Inventory tracks changes to files, file content, registry keys, software, Windows services, and Linux daemons.

Track file changes

To track file changes on Windows and Linux, Change Tracking and Inventory uses SHA256 hashes of the files and compares them with the hashes collected during the previous inventory scan to detect file changes.

Track file content changes

By using Change Tracking and Inventory, you can view the contents of Windows and Linux files. For each file change, Change Tracking and Inventory stores file content in an Azure Storage account. When you track a file, you can view and compare file contents before and after a change. You can view content inline or side by side. For more information, see Tutorial: Change a workspace and configure data collection rule.

Screenshot of viewing changes in a Windows or Linux file.

Track registry keys

Change Tracking and Inventory monitors changes to Windows registry keys. Monitoring registry keys can help identify configuration changes and extensibility points where non-Microsoft code can activate. The following table lists preconfigured (but not enabled) registry keys. To track these keys, you must enable each key.

Note

A registry key is a container in the Windows Registry that works like a folder in a file system. It organizes configuration settings and data for hardware, software, and users. The keys contain registry values, like files, and subkeys.

Registry key Purpose
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup Monitors scripts that run at startup.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown Monitors scripts that run at shutdown.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run Monitors keys that are loaded before the user signs in to the Windows account. The key is used for 32-bit applications running on 64-bit computers.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components Monitors changes to application settings.
HKEY_LOCAL_MACHINE\Software\Classes\Directory\ShellEx\ContextMenuHandlers Monitors context menu handlers that hook directly into Windows Explorer and usually run in-process with explorer.exe.
HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers Monitors copy hook handlers that hook directly into Windows Explorer and usually run in-process with explorer.exe.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers Monitors for icon overlay handler registration.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers Monitors for icon overlay handler registration for 32-bit applications running on 64-bit computers.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects Monitors for new browser helper object plugins for Internet Explorer. Used to access the Document Object Model (DOM) of the current pane and to control navigation.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects Monitors for new browser helper object plugins for Internet Explorer. Used to access the DOM of the current pane and to control navigation for 32-bit applications running on 64-bit computers.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions Monitors for new Internet Explorer extensions, such as custom tool menus and custom toolbar buttons.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions Monitors for new Internet Explorer extensions, such as custom tool menus and custom toolbar buttons for 32-bit applications running on 64-bit computers.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Drivers32 Monitors 32-bit drivers associated with wavemapper, wave1 and wave2, msacm.imaadpcm, .msadpcm, .msgsm610, and vidc. Similar to the [drivers] section in the system.ini file.
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 Monitors 32-bit drivers associated with wavemapper, wave1 and wave2, msacm.imaadpcm, .msadpcm, .msgsm610, and vidc for 32-bit applications running on 64-bit computers. Similar to the [drivers] section in the system.ini file.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDlls Monitors the list of known or commonly used system DLLs. Monitoring prevents people from exploiting weak application directory permissions by dropping in Trojan horse versions of system DLLs.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Monitors the list of packages that can receive event notifications from winlogon.exe, the interactive sign-in support model for Windows.

Track software changes

Change Tracking and Inventory tracks installed software on Windows and Linux machines by collecting software inventory and comparing each collection cycle with the previous state. This capability helps you detect software installs, removals, and version changes across machines and maintain software inventory visibility in your environment. For more information about collection limits and frequencies, see Support matrix and regions.

Track Windows services and Linux daemons

Change Tracking and Inventory tracks changes to Windows services and Linux daemons, including state and configuration-related changes, and records those changes in configuration-change events for analysis and alerting. Tracking these changes helps you identify service-related changes across machines.

Related content

  • Last updated on