Windows machines should have the Log Analytics agent connected as expected
Requires that prerequisites are deployed to the policy assignment scope. Flags Windows machines as non-compliant when the Log Analytics agent is registered to a workspace other than the workspace ID specified in the policy parameter.
What this control checks
Windows VMs must have the Log Analytics agent installed and connected
Common pitfalls
Prerequisites must be deployed to the scope
Requires that prerequisites are deployed to the policy assignment scope.
Agent registered to a different workspace fails
Machines are non-compliant if the agent is not installed, or if it is installed but the COM object AgentConfigManager.MgmtSvcCfg returns that it is registered to a workspace other than the ID specified in the policy parameter.
Arc connected servers are charged monthly
By selecting this option, you agree to be charged monthly per Arc connected machine.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines on which the Log Analytics agent is not connected as expected" (6265018c-d7e2-432f-a75d-094d5f6f4465); PowerPipe controls azure_compliance.control.compute_vm_log_analytics_agent_installed and azure_compliance.control.compute_vm_log_analytics_agent_installed_windows.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 12102.09ab1Organizational.4-09.ab (09.10 Monitoring) and 1217.09ab3System.3-09.ab (09.10 Monitoring).
Framework mappings
The clauses this control is mapped to in each framework.
- 1217.09ab3System.3-09.ab 09.10 Monitoring
- 12102.09ab1Organizational.4-09.ab 09.10 Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_log_analytics_agent_installed_windows - Powerpipe Controls:
azure_compliance.control.compute_vm_log_analytics_agent_installed,azure_compliance.control.compute_vm_log_analytics_agent_installed_windows - Azure Policy Definition:
6265018c-d7e2-432f-a75d-094d5f6f4465
Last reviewed: 2026-10-11