{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "slug": "dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs", "url": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/" }, "title": "Check VM watch's selected authentication method before rotating an Event Hubs credential", "summary": "Why might changing an Event Hubs connection string not change the authentication VM watch actually uses?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:17+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 232, "potentially_affected": "VM watch deployments exporting signals to an authorized Azure Event Hub.", "dse_recommendation": "Reconcile the configured authentication methods before diagnosing or rotating the output credential.", "primary_source": { "name": "Configure Event Hubs for VM watch - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/configure-eventhub-vm-watch", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

VM watch supports managed identity, SAS tokens and connection strings for Event Hubs output. When several methods are configured, managed identity has the highest priority and a connection string the lowest. For connection-string authentication, the documented value is Base64-encoded and excludes EntityPath; the hub name is configured separately. Startup and heartbeat telemetry require a separate option that is false by default. Microsoft Learn.

\n

Applicability

\n

Use this review while evaluating the VM watch preview’s output configuration or investigating missing events. Separate the chosen authentication method from the kinds of telemetry expected at the destination.

\n

DSE recommendation

\n

Reconcile the configured authentication methods before diagnosing or rotating the output credential. Have the telemetry owner inspect method flags and the intended managed identity without copying secret values into the ticket. Align the configuration with the approved method and confirm the destination namespace and hub. If startup or heartbeat events are required, review that explicit setting rather than treating their absence as proof of authentication failure.

\n

Verification

\n

After an authorized configuration change, inspect incoming event content and VM watch’s own logs. Confirm that the expected VM identity and signal types reach the intended hub. Record which method was actually configured, not simply which credential was most recently edited. Keep any connection-string or SAS material out of ordinary screenshots and retained diagnostics.

\n

Official references

\n

Microsoft Learn: Configure Event Hubs for VM watch. Source reviewed September 9, 2026.

", "content_text": "Source facts\nVM watch supports managed identity, SAS tokens and connection strings for Event Hubs output. When several methods are configured, managed identity has the highest priority and a connection string the lowest. For connection-string authentication, the documented value is Base64-encoded and excludes EntityPath; the hub name is configured separately. Startup and heartbeat telemetry require a separate option that is false by default. Microsoft Learn.\nApplicability\nUse this review while evaluating the VM watch preview’s output configuration or investigating missing events. Separate the chosen authentication method from the kinds of telemetry expected at the destination.\nDSE recommendation\nReconcile the configured authentication methods before diagnosing or rotating the output credential. Have the telemetry owner inspect method flags and the intended managed identity without copying secret values into the ticket. Align the configuration with the approved method and confirm the destination namespace and hub. If startup or heartbeat events are required, review that explicit setting rather than treating their absence as proof of authentication failure.\nVerification\nAfter an authorized configuration change, inspect incoming event content and VM watch’s own logs. Confirm that the expected VM identity and signal types reach the intended hub. Record which method was actually configured, not simply which credential was most recently edited. Keep any connection-string or SAS material out of ordinary screenshots and retained diagnostics.\nOfficial references\nMicrosoft Learn: Configure Event Hubs for VM watch. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nVM watch supports managed identity, SAS tokens and connection strings for Event Hubs output. When several methods are configured, managed identity has the highest priority and a connection string the lowest. For connection-string authentication, the documented value is Base64-encoded and excludes EntityPath; the hub name is configured separately. Startup and heartbeat telemetry require a separate option that is false by default. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/configure-eventhub-vm-watch).\n\n## Applicability\n\nUse this review while evaluating the VM watch preview’s output configuration or investigating missing events. Separate the chosen authentication method from the kinds of telemetry expected at the destination.\n\n## DSE recommendation\n\nReconcile the configured authentication methods before diagnosing or rotating the output credential. Have the telemetry owner inspect method flags and the intended managed identity without copying secret values into the ticket. Align the configuration with the approved method and confirm the destination namespace and hub. If startup or heartbeat events are required, review that explicit setting rather than treating their absence as proof of authentication failure.\n\n## Verification\n\nAfter an authorized configuration change, inspect incoming event content and VM watch’s own logs. Confirm that the expected VM identity and signal types reach the intended hub. Record which method was actually configured, not simply which credential was most recently edited. Keep any connection-string or SAS material out of ordinary screenshots and retained diagnostics.\n\n## Official references\n\n[Microsoft Learn: Configure Event Hubs for VM watch](https://learn.microsoft.com/en-us/azure/virtual-machines/configure-eventhub-vm-watch). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "url": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check VM watch's selected authentication method before rotating an Event Hubs credential", "item": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "url": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/", "headline": "Check VM watch's selected authentication method before rotating an Event Hubs credential", "description": "Why might changing an Event Hubs connection string not change the authentication VM watch actually uses?", "abstract": "Why might changing an Event Hubs connection string not change the authentication VM watch actually uses?", "articleBody": "Source facts\nVM watch supports managed identity, SAS tokens and connection strings for Event Hubs output. When several methods are configured, managed identity has the highest priority and a connection string the lowest. For connection-string authentication, the documented value is Base64-encoded and excludes EntityPath; the hub name is configured separately. Startup and heartbeat telemetry require a separate option that is false by default. Microsoft Learn.\nApplicability\nUse this review while evaluating the VM watch preview’s output configuration or investigating missing events. Separate the chosen authentication method from the kinds of telemetry expected at the destination.\nDSE recommendation\nReconcile the configured authentication methods before diagnosing or rotating the output credential. Have the telemetry owner inspect method flags and the intended managed identity without copying secret values into the ticket. Align the configuration with the approved method and confirm the destination namespace and hub. If startup or heartbeat events are required, review that explicit setting rather than treating their absence as proof of authentication failure.\nVerification\nAfter an authorized configuration change, inspect incoming event content and VM watch’s own logs. Confirm that the expected VM identity and signal types reach the intended hub. Record which method was actually configured, not simply which credential was most recently edited. Keep any connection-string or SAS material out of ordinary screenshots and retained diagnostics.\nOfficial references\nMicrosoft Learn: Configure Event Hubs for VM watch. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:17+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-039-check-vm-watch-s-selected-authentication-method-before-rotating-an-event-hubs/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check VM watch's selected authentication method before rotating an Event Hubs credential" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure Event Hubs for VM watch - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/configure-eventhub-vm-watch" } } ] } }