Announcing Azure Monitoring Agent support in Azure Landing Zones

Introduction

• Terraform upgrade guide [User Guide] Upgrade from v5.2.1 to v6.0.0
• Bicep release notes: v0.18.0 Release Notes

Key Updates and Enhancements

Centralization of the User Assigned Managed Identity

• Centralized UAMI: Azure Landing Zones now utilizing a single, centralized UAMI for AMA, enhancing manageability and scalability.
• Reliability: After the UAMI is created, it's replicated globally, and credential requests happen within the VM/VMSS's region instead of the UAMI region. Therefore, if the VM is in EastUS and the UAMI in WestUS, whenever the VM needs the UAMI credential, the request is completely fulfilled in EastUS.
• Scalability: Caching is enabled to support large-scale deployments. Managed identity limits for user assigned identity assignment remain the same regardless if you use single UAMI versus serval UAMI since rate limiting is done based on the VM/VMSS receiving the assignment not on the UAMI being assigned. This enables the convenience of managing a single identity that is both scalable and reliable.
• Protection: Added new custom policy Do not allow deletion of specified resource and resource type that provides a safeguard against accidental removal of the User Assigned Managed Identity used by AMA. Assigned at the Platform Management Group, it blocks delete calls using the deny action effect.

New Policies and Built-in Initiatives

• Deny Action Delete Policy: A new policy has been introduced that denies the deletion of the UAMI used for AMA, adding an extra layer of security.
• Policy Initiatives Updates: Built-in policy initiatives for VM Insights, Change Tracking, and Microsoft Defender for Cloud (MDfC) Defender for SQL have been updated to support a single centralized UAMI.
• Feature Flag: The restriction that enforces a UAMI per subscription is lifted by setting the restrictBringYourOwnUserAssignedIdentityToSubscription feature flag to false, enabling the use of a single centralized UAMI.

For more details on the policy changes please review What's New.

Brownfield Migration Guidance

• Assess current state: Conduct a thorough analysis of your existing environment to identify dependencies and custom configurations.
• Update Azure Landing Zones: guidance and automation tools help streamline the update process for Azure Landing Zones components
• Removing MMA and additional steps: It is crucial to be aware of other settings in your environment that may necessitate further considerations and steps when planning to migrate. While the final phase involves removing the Microsoft Monitoring Agent and addressing, you may need to address additional requirements discovered during the initial assessment, we have included references to already existing documentation to help with the next steps

Automation Tools

• Update Policies and Initiatives.
• Delete outdated Policy Assignments.
• Deploy a User Assigned Managed Identity for the AMA agent.
• Deploys Data Collection Rules for VMInsights, ChangeTracking and MDfC Defender for SQL.
• Assign new Policies and Initiatives.
• Remove Legacy Solutions
• Create remediation tasks for the newly assigned Policies and initiatives.
• Remove obsolete User Assigned Managed Identities (that were deployed with releases starting 2024-01-31 until 2024-04-24)

Conclusion