Exam MD-102 topic 1 question 89 discussion

No, the Azure Monitor Agent cannot be installed on a Windows 10 computer that isn't Azure AD joined. The Azure Monitor Agent uses Azure AD authentication to connect to the Log Analytics workspace, and Azure AD authentication requires the computer to be joined to Azure AD. If you want to collect data from a Windows 10 computer that isn't Azure AD joined, you can use the Microsoft Monitoring Agent (MMA). The MMA is a legacy agent that does not require the computer to be joined to Azure AD. However, the MMA is not as feature-rich as the Azure Monitor Agent, and it is not supported as long. In general, it is recommended to join all Windows 10 computers to Azure AD. This makes it easier to manage and secure the computers, and it enables you to use a variety of Azure services, such as Microsoft Intune and Azure Conditional Access.

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites The machine must be domain joined to a Microsoft Entra tenant (AADj or Hybrid AADj machines)

The answer i s D: The Azure Monitor Agent works on both domain-joined and non-domain-joined devices (including workgroup computers). After installing the agent, you can configure it to send data to your Log Analytics workspace. Azure AD joining is not a prerequisite for using the agent or querying data from the workspace.

I feel sorry for the noobs who are being fed wrong answers... That's why I always advise to STUDY first before coming here. The correct answer is A! Why? "The machine must be domain joined to a Microsoft Entra tenant (AADj or Hybrid AADj machines), which enables the agent to fetch Microsoft Entra device tokens used to authenticate and fetch data collection rules from Azure." Source: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites

Even if the device is only connected to a workgroup, you can still use Azure Log Analytics to query events by installing the Azure Monitor Agent. Being in a workgroup does not prevent the device from sending logs to an Azure Log Analytics workspace.

To ensure that you can use Log Analytics to query events from Computer1, you should Install the Azure Monitor Agent (Option D) on Computer1. D. Install the Azure Monitor Agent

The question states , “You need to ensure that you can use Log Analytics to query events from Computer1.” And not what needs to be done first. What do you need to get the log analytics to work.

D is must, A can be done later

A is correct. with the old agent joning the domain/ aad is not needed.

To ensure that you can use Log Analytics to query events from a Windows 10 computer that is in a workgroup, you should: D. Install the Azure Monitor Agent. Installing the Azure Monitor Agent on Computer1 is necessary for it to communicate and send data to the Azure Log Analytics workspace. This agent collects monitoring data from the operating system and workloads of the computer, then sends it to the workspace where you can analyze and query the data. Joining Azure AD, configuring Windows Defender Firewall, or creating an event subscription are not directly related to enabling the collection and querying of events through Azure Log Analytics.

I think A as well The machine must be domain joined to a Microsoft Entra tenant (AADj or Hybrid AADj machines), which enables the agent to fetch Microsoft Entra device tokens used to authenticate and fetch data collection rules from Azure. https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites

The Azure Monitor Agent can be used to query events on a computer that is not joined to Azure AD. Joining Azure AD offers additional benefits like centralized management and conditional access, but it's not necessary for basic event collection. Here's what you need to know for each method: Using the Azure Monitor Agent: Install the Azure Monitor Agent on the computer that is not joined to Azure AD. Configure the agent to connect to your Log Analytics workspace using a Workspace Access Key instead of Azure AD authentication. Define data collection rules to specify which events you want to collect. The agent will collect and send the chosen events to your Log Analytics workspace where you can query them.

I would choose answer D, install Azure monitor Agent

Must be domain joined. Ref: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#prerequisites

is the right one. I initially thought I can just download the Azure Monitor Agent MSI. But then, I saw this https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-windows-client#:~:text=Not%20Microsoft%20Entra,try%20installation%20again. "join the device with a Microsoft Entra tenant"

D. Install the Azure Monitor Agent https://learn.microsoft.com/en-us/azure/azure-monitor/logs/queries?tabs=groupby#permissions-required

think its D - https://www.mdmandgpanswers.com/blogs/view-blog/windows-10-and-server-event-logs-to-azure-log-analytics-walkthru