Azure Monitor Agent not initializing or connecting to LAW for specific Production VMs deployed via Bicep module

Question

Azure Monitor Agent not initializing or connecting to LAW for specific Production VMs deployed via Bicep module

Vaibhav Anand 0

We use a Bicep module to deploy Azure Monitor Agent (AMA) along with DCE, DCR, and DCRA for all our Windows Server 2022 VMs. This setup works fine for every VM in Non-Prod and a few VMs in Prod. But Prod WebApp VMs never connect to Log Analytics, and one Prod RM VM that was previously sending logs suddenly stopped and now shows “Not Connected”.

Bharath Y P 2,560 Reputation points Microsoft External Staff Moderator

2025-12-04T21:26:31.18+00:00
Hello Vaibhav Anand,

We understand that you're having trouble with the Azure Monitor Agent (AMA) not connecting for some of your Production VMs.

Since Non‑Prod works, some Prod works, but Prod WebApp VMs don’t connect (and one Prod RM VM flipped to Not Connected), this smells like a connectivity/association or rule/region mismatch rather than a generic AMA install problem.

Verify DCR region and DCRA association: DCR created in a different region than the workspace, or DCRA not attached to the specific VM resource.
# DCR and region az monitor data-collection rule show \ --name <dcr-name-prod> --resource-group <rg-monitoring> -o tsv --query "location" # Workspace region (should match DCR) az monitor log-analytics workspace show \ --workspace-name <law-name> --resource-group <rg-monitoring> -o tsv --query "location" # List associations for the VM az monitor data-collection rule association list \
If region mismatch exists, redeploy the DCR in the workspace’s region. Microsoft explicitly requires this. Ensure each affected Prod VM has at least one DCRA to the intended DCR. Remember the many‑to‑many rule; wrong DCR > no data. Create data collection rules (DCRs) in Azure Monitor - Azure Monitor | Microsoft Learn Data collection rules in Azure Monitor - Azure Monitor | Microsoft Learn

Verify the extension is healthy on the Prod WebApp VMs:
# Extension presence & status Get-AzVMExtension -ResourceGroupName <rg-prod> -VMName <vmname> -Name "AzureMonitorWindowsAgent" # Local Windows service state Get-Service -Name azuremonitoragent
You should see the AzureMonitorWindowsAgent extension Provisioning succeeded and the azuremonitoragent service Running. If not, reinstall the extension (uninstall > install). This is the first set of checks in Microsoft’s AMA guidance. Install and Manage the Azure Monitor Agent - Azure Monitor | Microsoft Learn Troubleshoot the Azure Monitor agent on Windows virtual machines and scale sets - Azure Monitor | Microsoft Learn

Verify AMA Installation: Check the status of the AMA installation on your VMs. Run the following command:
$vm = Get-AzVM -ResourceGroupName <YourResourceGroupName> -Name <YourVMName> -Status if ($vm.extensions) { Write-Output "Listing all VM extensions:" $vm.extensions | ForEach-Object { Write-Output "Extension Name: $($_.Name)" Write-Output "Type: $($_.Type)" Write-Output "Provisioning State: $($_.statuses.code)" Write-Output "---" } } else { Write-Output "No extensions found for this VM." }
Ensure that the AMA extension appears with a suitable provisioning state.

Check Heartbeat Data: Run a query in Log Analytics to see if you’re receiving heartbeat data. Use:
Heartbeat | where Computer contains "<your-computer-name>"
If you see no data, the agent is likely not communicating with the Log Analytics workspace.

Confirm that your VMs can reach the required Azure endpoints. You can test connectivity using PowerShell:
Test-Connection monitor.azure.com

Ensure there are no network restrictions, such as firewalls or proxies, that might be blocking the necessary Azure endpoints for AMA operation. Confirm DNS configuration and allowlist the URLs required for communication.

Look into the log files located at C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.Monitor.AzureMonitorWindowsAgent to see if there are any errors that might provide more context.

If you still encounter an issue, could you provide more details regarding the following?

Have you checked the Azure Monitor Agent's logs for any specific error messages?

Is the Data Collection Rule properly configured with the correct resources?

Are all your VMs in the same network setup, or are there differences (like different VLANs)?

Have you made any recent changes in the environment or updates that could affect the connectivity?

Reference document:

Microsoft Defender for Cloud troubleshooting guide - Microsoft Defender for Cloud | Microsoft Learn

Hope this helps, If you encounter any issue, please do let us know. thanks
Bharath Y P 2,560 Reputation points Microsoft External Staff Moderator

2025-12-05T19:05:43.8366667+00:00

Hello Vaibhav Anand, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. If the answer addressed your query, it would be great if you could accept it and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue.

1 answer

Your answer

Bharath Y P 2,560 Reputation points Microsoft External Staff Moderator

2025-12-05T19:05:43.8366667+00:00

Hello Vaibhav Anand, I just wanted to kindly follow up to check if you had a chance to review my earlier response. I hope the information shared was helpful. Please feel free to reach out if you have any additional questions or need further clarification. If the answer addressed your query, it would be great if you could accept it and up-vote. This not only helps us but also makes it easier for other community members who might face the same issue.

Answer 1

Hello,

Welcome to Microsoft Azure.

Based on your description, the Prod VMs appear to be failing to communicate with Azure Monitor Agent and Log Analytics due to network configuration issues, i recommend validating the following:

1.Network – Ensure the Prod VMs have outbound access to the required Azure Monitor endpoints:

Azure Monitor Agent overview

2. DCR/DCRA Association – Confirm that the data collection rules are correctly applied to the VMs:

az monitor data-collection rule association list --resource <VM_ID>

3.AMA Status – Check the agent service/extension:

Get-Service AzureMonitorAgent

Get-AzVMExtension -ResourceGroup <RG> -VMName <VM> -Name AzureMonitorWindowsAgent

4.Local AMA Logs – Review logs for specific errors:

C:\ProgramData\AzureMonitorAgent\logs

If the VMs remain “Not Connected” after these checks, I recommend opening a support ticket with Microsoft for backend analysis of Azure Monitor.

Share via

Azure Monitor Agent not initializing or connecting to LAW for specific Production VMs deployed via Bicep module

1 answer

Your answer