# Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On' (Automated) .

- Source: https://support.icompaas.com/support/solutions/articles/62000229845-ensure-that-auto-provisioning-of-log-analytics-agent-for-azure-vms-is-set-to-on-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Auto-provisioning installs the Log Analytics agent automatically on Azure VMs to ensure they send security and monitoring data to Microsoft Defender for Cloud. This setting guarantees that all newly created or existing VMs begin forwarding logs without manual configuration.

  

Rationale:

Enabling auto-provisioning ensures consistent deployment of the Log Analytics agent across all Azure VMs. This improves monitoring coverage, supports automated threat detection, and prevents gaps where machines may operate without required security telemetry.

  

Impact:

-   Ensures uniform security monitoring across all Azure VMs
    
-   Automates onboarding of new VMs into Log Analytics / Defender
    
-   Supports SIEM, threat detection, and vulnerability scanning
    
-   Reduces operational overhead and human error
    
-   Required for many compliance standards
    

  

Default Value:

Auto provisioning is disabled by default.

  

Pre-Requisites:

-   A Log Analytics Workspace is available
    
-   Defender for Servers Plan recommended
    
-   Permissions:
    
    -   Microsoft.Security/\*
        
    -   Microsoft.OperationalInsights/workspaces/\*
        
    -   Microsoft.Compute/virtualMachines/\*
        

Test Plan:

1.  Sign in to the Azure portal
    
2.  Search for Microsoft Defender for Cloud
    
3.  Under the management section, Select Environment Settings
    
4.  Choose the Subscription
    
5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    
7.  Check if the Log Analytics agent is on or off
    
8.  If it is off, follow the implementation steps.
    

![](https://support.icompaas.com/assets/kb/863e51f7670ab388.png)

  

Implementation Steps:

1.  Sign in to the Azure portal
    
2.  Search for Microsoft Defender for Cloud
    
3.  Under the management section, click Environment Settings
    
4.  Choose the Subscription
    

![](https://support.icompaas.com/assets/kb/5ba894ad11eb0efd.png)

5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    

![](https://support.icompaas.com/assets/kb/37c279dfd77ca42c.png)

7.  Find the Log Analytics agent. Change toggle to On
    

![](https://support.icompaas.com/assets/kb/9ef8cab9f203b5bf.png)

8.  Continue to Save changes
    

Backout Plan:

1.  Sign in to the Azure portal.
    
2.  Search for and open Microsoft Defender for Cloud.
    
3.  Under the Management section, select Environment Settings.
    
4.  Select the required subscription.
    
5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    
7.  Set Vulnerability assessment for machines to Off.
    
8.  Save the changes.
    

  

Reference:

-   [https://learn.microsoft.com/azure/defender-for-cloud/enable-auto-provisioning](https://learn.microsoft.com/azure/defender-for-cloud/enable-auto-provisioning)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.