Manual log analytics agent provisioning
To manually install the Log Analytics agent:
Disable auto provisioning.
Optionally, create a workspace.
Enable Microsoft Defender for Cloud on the workspace on which you're installing the Log Analytics agent:
From Defender for Cloud's menu, select Environmental settings.
Set the workspace on which you're installing the agent. Make sure the workspace is in the same subscription you use in Defender for Cloud, and you have read/write permissions for the workspace.
Select Microsoft Defender for Cloud on, and Save.
To deploy agents on new VMs using a Resource Manager template, install the Log Analytics agent:
To deploy agents on your existing VMs, follow the instructions in Collect data about Azure Virtual Machines.
To use PowerShell to deploy the agents, use the instructions from the virtual machines documentation: