azurevirtual-machineazure-monitoringazure-vm-extension

able to install Azure monitor Agent installation without enabling any managed identity(system or user)

I am able to install Azure monitor Agent installation without enabling any managed identity(system or user) on a Virtual Machine through below powershell cmdlet

System-Assigned:

Set-AzVMExtension 
 -Name AzureMonitorWindowsAgent 
 -ExtensionType AzureMonitorWindowsAgent 
 -Publisher Microsoft.Azure.Monitor 
 -ResourceGroupName <resource-group-name>
 -VMName <virtual-machine-name> 
 -Location <location> 
 -TypeHandlerVersion <version-number> 
 -EnableAutomaticUpgrade $true 
 -SettingString '{"authentication":{"managedIdentity":{"identifier-name":"mi_res_id","identifier-value":"/subscriptions/<my-subscription-id>/resourceGroups/<my-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<my-user-assigned-identity>"}}}

User-Assigned:

Set-AzVMExtension
 -Name AzureMonitorWindowsAgent
 -ExtensionType AzureMonitorWindowsAgent
 -Publisher Microsoft.Azure.Monitor 
 -ResourceGroupName <resource-group-name> 
 -VMName <virtual-machine-name> 
 -Location <location> 
 -TypeHandlerVersion <version-number> 
 -EnableAutomaticUpgrade $true

I have used both of the above powershell cmdlets on a set of VMs and did not assigned any system or user assigned managed identity but If I run the power shell script I am still able tp install the agent and no change is reflecting in identity section of VM.

Can someone help me understand the AMA installation process if I am getting in wrong direction.

I have built powershell script using below documentation https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal

Solution

  • able to install Azure monitor Agent installation without enabling any managed identity(system or user)

    If you are able to install the Azure Monitor Agent without enabling the System Managed Identity or User Managed Identity, it may be because you are logged in with a user account, not an identity authentication.

    The Set-AzVMExtension command will work with user authentication as well.

    In your case, make sure to check whether you are logged in with a user account by using Get-AzContext before executing the Set-AzVMExtension command.

    enter image description here

    To log in with an identity for installing the Agent on a VM, you need to enable the identity inside the VM, assign the role of Virtual Machine Contributor or Azure Connected Machine Resource Administrator, and log in with the identity using the commands below

    Connect using a Managed Identity ,Refer this link for authentication via managed identity in VM

    Connect-AzAccount  -Identity
Set-AzContext -Subscription Subscription1

    Connect using a User Managed Identity Refer this Link for authentication via user managed identity in VM.

    Connect-AzAccount -Identity -AccountId  $identity.ClientId

    In my case, I installed the agent without enabling identity in VM and installed it using user authentication.

    Set-AzVMExtension -Name AzureMonitorWindowsAgent -ExtensionType AzureMonitorWindowsAgent -Publisher Microsoft.Azure.Monitor -ResourceGroupName Venkat -VMName venkatvm -Location "East US" -TypeHandlerVersion "1.1" -EnableAutomaticUpgrade $true

    Output:

    enter image description here