Azure audit securitycenter monitor agent not provisioned remediation

Using Console

Using CLI

Using Python

To remediate the “Monitoring Agent is not provisioned” misconfiguration in Azure using Python, you can use the Azure Python SDK. Here are the steps to remediate the issue:

Install the Azure Python SDK using pip:

pip install azure-mgmt-monitor

Import the necessary modules:

from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.monitor import MonitorManagementClient

Create a Service Principal and retrieve the credentials:

TENANT_ID = '<your tenant id>'
CLIENT_ID = '<your client id>'
SECRET = '<your client secret>'
SUBSCRIPTION_ID = '<your subscription id>'

credentials = ServicePrincipalCredentials(client_id=CLIENT_ID, secret=SECRET, tenant=TENANT_ID)

Create a MonitorManagementClient object:

monitor_client = MonitorManagementClient(credentials, SUBSCRIPTION_ID)

Check if the Monitoring Agent is provisioned:

monitoring_status = monitor_client.activity_logs.list(filter="category eq 'Administrative' and operationName.value eq 'Microsoft.Compute/virtualMachines/extensions/write' and resourceType eq 'Microsoft.Compute/virtualMachines/extensions' and status.value eq 'Succeeded'")
if len(list(monitoring_status)) == 0:
    print("Monitoring Agent is not provisioned")
else:
    print("Monitoring Agent is provisioned")

If the Monitoring Agent is not provisioned, you can remediate the issue by installing the agent extension:

vm_name = '<your virtual machine name>'
resource_group_name = '<your resource group name>'
extension_name = 'MicrosoftMonitoringAgent'

monitor_client.virtual_machine_extensions.create_or_update(
    resource_group_name,
    vm_name,
    extension_name,
    {
        'location': '<your location>',
        'publisher': 'Microsoft.EnterpriseCloud.Monitoring',
        'virtual_machine_extension_type': extension_name,
        'type_handler_version': '1.0',
        'auto_upgrade_minor_version': True,
        'settings': {},
        'protected_settings': {
            'workspaceId': '<your workspace id>',
            'workspaceKey': '<your workspace key>'
        }
    }
)

Note: Replace the placeholders with your own values.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Azure audit securitycenter monitor agent not provisioned remediation

Triage and Remediation

Remediation