Enable Azure Policy to Automatically Configure Log Analytics and VM Insights Across Subscriptions via Management Group Scope

Hello Sree, it makes total sense to move from “one-off” API calls to a centralized, policy-driven model—especially when you have multiple subscriptions under a management group. Here’s a high-level approach you can take for both diagnostics (logs & metrics) and VM Insights:

Steps to create an Azure Policy to enable Diagnostic Settings for the following resource types at the subscription scope:"

Resources:

• Microsoft.Web/serverFarms
• Microsoft.DBforMySQL/flexibleServers
• Microsoft.DBforPostgreSQL/flexibleServers
• Microsoft.Sql/servers/databases

Once the resources are created (or if they are already present), follow the steps below for each resource:"

1. Navigate to Azure Policy > Definitions > + Policy Definition
2. Set the Definition location to your subscription
3. Paste the provided JSON into the Policy Rule editor
4. Enter the required details such as Display Name, Description, and set the Category to Monitoring
5. Add the appropriate Policy Rule JSON for each resource type as provided below
6. Click Save

After completing the above steps, proceed to create and assign the Azure Policy at the subscription scope as outlined below:"

1. After clicking Save, the policy definition will be validated and the newly created definition will open.
2. Click on Assign Policy.
3. Select the appropriate Scope and fill in the remaining required fields. Ensure that Policy Enforcement is enabled.
   1. Click Next → In the Parameters tab, provide the Log Analytics Workspace Resource ID → Click Next.
   2. Under Remediation, select Create a remediation task and enable System-assigned managed identity.
   3. Click Review + Create.

Required Role Assignments:

1. The managed identity created for the policy assignment must have the following roles:
   • Monitoring Contributor (to configure diagnostic settings)
   • Log Analytics Contributor (to send data to the workspace)
   To verify role assignments:
   • Navigate to Subscriptions → Select your subscription
     • Go to Access Control (IAM) → Role Assignments tab
       • Filter by Type = Service Principal
         • Search using the policy assignment name or principal ID
           • Confirm that both required roles are assigned

Note: These steps apply to all specified resource types when creating custom policies to enable diagnostic settings.

• Enable VM insights using Azure Policy (initiatives & assignment) https://docs.microsoft.com/azure/azure-monitor/vm/vminsights-enable-policy
• Assign a VM insights policy initiative https://docs.microsoft.com/azure/azure-monitor/vm/vminsights-enable-policy#assign-a-vm-insights-policy-initiative
• Enable Insights at scale using Azure policies (policy assignment flow) https://docs.microsoft.com/azure/azure-local/manage/monitor-multi-azure-policies?view=azloc-2604

Hope this helps! please feel free to reach out if you have any further questions. Thanks

For Log Analytics and VM insights enablement at management group scope, use Azure Policy initiatives with either built-in or custom diagnostic-settings policies and assign them at the management group level.

1. Built-in vs custom policies for diagnostic settings

• Built-in diagnostic policies exist per resource type and destination (Log Analytics, Storage, Event Hub). Examples in the Monitoring category include policies such as:
  • “Enable logging by category group for microsoft.dbformysql/flexibleservers to Log Analytics”
  • “Enable logging by category group for microsoft.dbforpostgresql/flexibleservers to Log Analytics”
• These built-ins are per resource type. A single built-in policy does not cover multiple resource types. For each resource type (App Service plans, SQL databases, MySQL/PostgreSQL flexible servers, etc.), a separate policy definition is required.
• If a built-in does not exist for a specific resource type, create a custom policy definition that deploys a diagnostic setting to your Log Analytics workspace. The documentation shows an example for SQL databases:
  • PowerShell:

        New-AzPolicyDefinition -name "Deploy Diagnostic Settings for SQL Server database to Log Analytics workspace" \
          -policy .\Apply-Diag-Settings-LA-Microsoft.Sql-servers-databases\azurepolicy.rules.json \
          -parameter .\Apply-Diag-Settings-LA-Microsoft.Sql-servers-databases\azurepolicy.parameters.json \
          -mode All -Metadata '{"category":"Monitoring"}'
    

  • Azure CLI:

        az policy definition create \
          --name 'deploy-diag-setting-sql-database--workspace' \
          --display-name 'Deploy Diagnostic Settings for SQL Server database to Log Analytics workspace' \
          --rules 'Apply-Diag-Settings-LA-Microsoft.Sql-servers-databases\\azurepolicy.rules.json' \
          --params 'Apply-Diag-Settings-LA-Microsoft.Sql-servers-databases\\azurepolicy.parameters.json' \
          --subscription 'AzureMonitor_Docs' \
          --mode All
    

2. Use an initiative to cover multiple resource types

• A single policy cannot cover multiple resource types, but a single initiative can.
• Create an initiative that includes:
  • All built-in diagnostic-setting policies for each resource type you need (e.g., MySQL flexible servers, PostgreSQL flexible servers, others in the Monitoring category).
  • Any custom diagnostic-setting policies you created (e.g., for App Service plans, SQL elastic pools, etc.).
• Recommendations for the initiative:
  • Set Category to Monitoring so it’s grouped with related policies.
  • Use initiative-level parameters for shared settings such as Log Analytics workspace ID and (if applicable) Event Hub details. This allows specifying the workspace once for all policies in the initiative and changing it centrally later.

3. Assigning at management group scope

• To assign at management group scope using built-in policies/initiatives from the Azure portal:
  1. Go to Policy → Definitions.
  2. Filter Category = Monitoring and Definition type = Initiative or Policy.
  3. For initiatives, search for audit or allLogs and select the initiative for your destination; for individual policies, search by resource type and destination.
  4. On the selected initiative/policy pane, select Assign initiative.
  5. On the Basics tab, set Scope to the management group that contains your subscriptions. The initiative/policy will apply to all resources in that scope (with optional exclusions and resource selectors if needed).
  6. On the Parameters tab, select the Log Analytics workspace (and other destination parameters) that all policies in the initiative should use.
  7. On the Remediation tab, select Create a remediation task and ensure a system-assigned managed identity is created. This ensures existing resources are brought into compliance.
  8. Select Review + create → Create.
• For custom initiatives (e.g., your own diagnostic-setting policies):
  • Create the initiative (with Category = Monitoring) and add all relevant policy definitions.
  • Use initiative parameters for workspace and other shared values.
  • Then assign the initiative to the management group as above.

4. Ensuring coverage for existing and new resources

• New resources:
  • Once the initiative is assigned with enforcement enabled, any new resource of a covered type created in the management group scope will be evaluated and, with DeployIfNotExists policies, automatically configured with diagnostic settings to the specified Log Analytics workspace.
• Existing resources:
  • Create a remediation task when assigning the initiative. This deploys diagnostic settings to existing resources that are currently noncompliant.
  • The documentation explicitly notes that remediation tasks are required to apply diagnostic settings to already-created resources.

5. VM insights and VM monitoring via policy

• For VM insights, use the VM insights policy initiatives and assign them at management group, subscription, or resource group scope:
  • In the Azure portal, go to Policy → Assignments → Assign initiative.
  • On Basics, set Scope to the management group.
  • Select one of the VM insights initiatives as the Initiative definition.
  • Configure parameters (e.g., Log Analytics workspace) and remediation.
• After assignment, compliance can be reviewed via the VM insights policy coverage view and Policy compliance views. Compliance state indicates whether agents (Azure Monitor Agent or Log Analytics agent and Dependency agent) are deployed to all VMs in scope.

6. Compliance and monitoring

• Use Policy → Compliance to review initiative compliance at management group or subscription level. Noncompliant resources indicate where diagnostic settings or agents are missing and may need remediation.
• For VM insights specifically, use Monitor → Insights → Virtual machines → Other onboarding options → Enable using policy to view Azure Monitor for VMs Policy Coverage, including:
  • Scope (management group or subscription)
  • Total VMs
  • Assignment coverage
  • Compliance state

Summary

• Separate policy definitions are required per resource type; a single policy cannot cover all resource types.
• Use a single Monitoring-category initiative that aggregates all relevant diagnostic-setting policies (built-in and custom) and VM insights initiatives.
• Assign the initiative at management group scope with initiative-level parameters for the Log Analytics workspace and create remediation tasks to cover both existing and new resources.

References:

• Create diagnostic settings at scale by using custom Azure policies
• Create diagnostic settings at scale by using built-in Azure policies
• Enable VM insights using Azure Policy
• Azure Policy built-in policy definitions