ODA ad assessment installed but Data Collection rules not created.

Question

ODA ad assessment installed but Data Collection rules not created.

Norman Su Fung 0 Microsoft External Staff

Hello Support,

i have installed the oda ad assessment and the extension is installed and up to date, however the data collection rule for it is not generated.

please assist to remediate this issue ?

Suchitra Suregaunkar 16,370 Reputation points Microsoft External Staff Moderator

2026-08-09T17:30:11.53+00:00
Hello @Norman Su Fung

Thank you for posting your query on Microsoft Q&A platform.

Installing the AMA/assessment extension alone never creates the assessment DCR, the DCR is provisioned by the Services Hub / Engage Center connector when the assessment is added and bound to a collector machine in a correctly linked workspace. So this is almost always a connector/linking or permission gap, not an extension problem.

Please have a look into below workaround:

1. Connector + workspace linkage (most common) On-Demand Assessments are now delivered through the Engage Center Connector in the Azure portal, not the legacy Services Hub Connector. If the customer was migrated, the connector name changed while the Log Analytics workspace stayed the same and if the assessment experience isn't provisioning, the documented fix is to recreate the connector using the same workspace. Also verify the subscription and Log Analytics workspace are still linked under profile → Edit Log Analytics workspace in Services Hub; re-supplying subscription + workspace there resolves a large class of "assessment won't configure" cases.

2. Permissions of the identity doing the setup Required: Owner or Contributor at subscription level, and Contributor/Owner on the Log Analytics workspace. Without these, the assessment can be added in the UI but the DCR/DCE objects cannot be created in Azure. Also confirm the same account is used for both Services Hub and the Azure portal.

3. Collector machine placement and readiness The collector must be an Azure VM or Azure Arc-enabled server that is connected and ready, with outbound HTTPS (443) to the Azure service endpoints. For Arc collectors, the assessment can only bind machines discoverable through the connector a common blocker in hybrid setups is the Arc machine and the Log Analytics workspace not being in the same resource group.

4. Assessment actually added and bound In Services Hub / Engage Center → IT Health → On-Demand Assessments, confirm the AD assessment tile exists and the collector server is selected during configuration. Then complete the in-VM setup (Add-ADAssessmentTask) — the scheduled task appears under Task Scheduler → Microsoft → Operations Management Suite → AOI → Assessments.

Confirm the account has Owner/Contributor on the subscription and rights on the workspace.

Re-link subscription + workspace in Services Hub (profile → Edit Log Analytics workspace).

Recreate the Engage Center Connector against the same workspace.

Remove the AD assessment tile and re-add it, selecting the correct Arc/Azure VM collector.

Wait ~10–15 minutes, then check Azure Monitor → Data Collection Rules for the ODA DCR (and its DCE) in the workspace's resource group.

Re-run the in-VM Add-ADAssessmentTask setup and trigger the scheduled task.

Thanks,
Suchitra.

1 answer

Your answer

Answer 1

Installing or updating the Azure Monitor Agent extension does not by itself create the assessment’s Data Collection Rule. DCR creation occurs when the assessment is added and correctly associated through Services Hub. Confirm the subscription has the Microsoft.Insights resource provider registered and that the setup identity can create DCRs and DCR associations in the target resource group. Verify Services Hub is linked to the active subscription and Log Analytics workspace, then remove and add the AD assessment again while selecting the correct Arc-enabled server or VM as the data-collection machine. Check that the agent is connected, that the working-directory mapping is correct, and that no legacy Microsoft Monitoring Agent configuration is interfering. Creating a basic test DCR is useful for isolating permissions from assessment setup. If creation still fails, use Services Hub Support and provide subscription, workspace, collector, and timestamp details privately; do not post tenant or resource identifiers publicly.

Norman Su Fung 0 Reputation points Microsoft External Staff

2026-07-24T00:44:37.6966667+00:00

Thank you Christos for the reponse. Yes, the microsoft insight is installed. I manage to setup the ODA Ad Security assessment but not the AD assessment. im the owner of the subscription so i don't this is permissions issue.