MDC not creating default workspace or default data collection rule

Question

I enabled MDC on a new subscription, selected to use the Azure Monitoring Agent, and chose to create the default workspace. Even though the documentation says "By default, the destination is the “default workspace” that Defender for Cloud creates for each region in the subscription: defaultWorkspace-<subscriptionId>-<regionShortName>. Defender for Cloud automatically configures the data collection rules, workspace solution, and additional extensions for that workspace." (https://learn.microsoft.com/en-us/azure/defender-for-cloud/auto-deploy-azure-monitoring-agent#configure-custom-destination-log-analytics-workspace) I don't see a corresponding DCR or LAW being created.

I know this used to work because on an older subscription where I had also enabled MDC (last year sometime) I can see the DCR and LAW.

What triggers, if any, are required for MDC to create the DCR and LAW?

Answer 1

@KFM

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "[The question author cannot accept their own answer. They can only accept answers by others] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#why-only-one-accepted-answer)", I'll repost your solution in case you'd like to "[Accept] (https://docs.microsoft.com/en-us/answers/support/accepted-answers#accepted-answer-in-a-question-thread)" the answer.

As per your solution there needs to be a VM in the subscription before it will create the LAW and DCR.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Ok, so I answered my own question. The trigger is that there needs to be a VM in the subscription before it will create the LAW and DCR.