VM watch’s environmentAttributes help determine whether signals are eligible to execute. In the documented outbound-disabled example, setting OutboundConnectivityDisabled marks outbound-network-related signal execution ineligible. The source presents that value as information about an already disabled outbound path. Separately, signalFilters can enable optional collectors or disable named or tagged signals; only core-group signals are enabled by default. Microsoft Learn.
\nUse this distinction during a VM watch preview evaluation when a restricted VM produces an unexpected or absent check. Keep the monitoring declaration separate from the network configuration it is intended to describe.
\nCompare the declared VM watch environment with the actual network restriction before suppressing a check. Have the network and monitoring owners agree which checks are meaningful for the VM’s actual design. Verify the restriction through its authorized network controls, then review whether the declared attribute accurately represents it. Do not use an ineligible-check result as evidence that outbound traffic has been blocked.
\nIn a controlled environment, inspect the configured attribute, collector filters and resulting signal eligibility together. Test the permitted and prohibited network behavior through the approved network-validation process independently. If the declaration and actual connectivity disagree, correct the responsible configuration before accepting the monitoring result. Preserve the reason for each intentionally excluded check so a later owner can distinguish policy-driven omission from an unexpected collection failure.
\nMicrosoft Learn: Configure VM watch. Source reviewed September 9, 2026.
", "content_text": "Source facts\nVM watch’s environmentAttributes help determine whether signals are eligible to execute. In the documented outbound-disabled example, setting OutboundConnectivityDisabled marks outbound-network-related signal execution ineligible. The source presents that value as information about an already disabled outbound path. Separately, signalFilters can enable optional collectors or disable named or tagged signals; only core-group signals are enabled by default. Microsoft Learn.\nApplicability\nUse this distinction during a VM watch preview evaluation when a restricted VM produces an unexpected or absent check. Keep the monitoring declaration separate from the network configuration it is intended to describe.\nDSE recommendation\nCompare the declared VM watch environment with the actual network restriction before suppressing a check. Have the network and monitoring owners agree which checks are meaningful for the VM’s actual design. Verify the restriction through its authorized network controls, then review whether the declared attribute accurately represents it. Do not use an ineligible-check result as evidence that outbound traffic has been blocked.\nVerification\nIn a controlled environment, inspect the configured attribute, collector filters and resulting signal eligibility together. Test the permitted and prohibited network behavior through the approved network-validation process independently. If the declaration and actual connectivity disagree, correct the responsible configuration before accepting the monitoring result. Preserve the reason for each intentionally excluded check so a later owner can distinguish policy-driven omission from an unexpected collection failure.\nOfficial references\nMicrosoft Learn: Configure VM watch. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nVM watch’s environmentAttributes help determine whether signals are eligible to execute. In the documented outbound-disabled example, setting OutboundConnectivityDisabled marks outbound-network-related signal execution ineligible. The source presents that value as information about an already disabled outbound path. Separately, signalFilters can enable optional collectors or disable named or tagged signals; only core-group signals are enabled by default. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/configure-vm-watch).\n\n## Applicability\n\nUse this distinction during a VM watch preview evaluation when a restricted VM produces an unexpected or absent check. Keep the monitoring declaration separate from the network configuration it is intended to describe.\n\n## DSE recommendation\n\nCompare the declared VM watch environment with the actual network restriction before suppressing a check. Have the network and monitoring owners agree which checks are meaningful for the VM’s actual design. Verify the restriction through its authorized network controls, then review whether the declared attribute accurately represents it. Do not use an ineligible-check result as evidence that outbound traffic has been blocked.\n\n## Verification\n\nIn a controlled environment, inspect the configured attribute, collector filters and resulting signal eligibility together. Test the permitted and prohibited network behavior through the approved network-validation process independently. If the declaration and actual connectivity disagree, correct the responsible configuration before accepting the monitoring result. Preserve the reason for each intentionally excluded check so a later owner can distinguish policy-driven omission from an unexpected collection failure.\n\n## Official references\n\n[Microsoft Learn: Configure VM watch](https://learn.microsoft.com/en-us/azure/virtual-machines/configure-vm-watch). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/", "url": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Treat VM watch's outbound-disabled attribute as a test-eligibility declaration", "item": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/", "url": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/", "headline": "Treat VM watch's outbound-disabled attribute as a test-eligibility declaration", "description": "Does setting OutboundConnectivityDisabled in VM watch enforce a network restriction?", "abstract": "Does setting OutboundConnectivityDisabled in VM watch enforce a network restriction?", "articleBody": "Source facts\nVM watch’s environmentAttributes help determine whether signals are eligible to execute. In the documented outbound-disabled example, setting OutboundConnectivityDisabled marks outbound-network-related signal execution ineligible. The source presents that value as information about an already disabled outbound path. Separately, signalFilters can enable optional collectors or disable named or tagged signals; only core-group signals are enabled by default. Microsoft Learn.\nApplicability\nUse this distinction during a VM watch preview evaluation when a restricted VM produces an unexpected or absent check. Keep the monitoring declaration separate from the network configuration it is intended to describe.\nDSE recommendation\nCompare the declared VM watch environment with the actual network restriction before suppressing a check. Have the network and monitoring owners agree which checks are meaningful for the VM’s actual design. Verify the restriction through its authorized network controls, then review whether the declared attribute accurately represents it. Do not use an ineligible-check result as evidence that outbound traffic has been blocked.\nVerification\nIn a controlled environment, inspect the configured attribute, collector filters and resulting signal eligibility together. Test the permitted and prohibited network behavior through the approved network-validation process independently. If the declaration and actual connectivity disagree, correct the responsible configuration before accepting the monitoring result. Preserve the reason for each intentionally excluded check so a later owner can distinguish policy-driven omission from an unexpected collection failure.\nOfficial references\nMicrosoft Learn: Configure VM watch. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:16+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-040-treat-vm-watch-s-outbound-disabled-attribute-as-a-test-eligibility-declaration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Treat VM watch's outbound-disabled attribute as a test-eligibility declaration" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure VM watch - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/configure-vm-watch" } } ] } }