{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "slug": "dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host", "url": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/" }, "title": "Check which VMs lose alert coverage when subscription recommendations skip host metrics", "summary": "Does guest-only subscription alerting in Monitoring Coverage include VMs without OTel collection?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:30+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 248, "potentially_affected": "Preview Azure Monitor Monitoring Coverage VM recommended alerts, particularly subscription scope with host metric rules skipped.", "dse_recommendation": "Compare the intended subscription VM population with the actual OTel-enabled population before approving guest-only coverage.", "primary_source": { "name": "Monitoring coverage in Azure Monitor (preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/monitoring-coverage", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Monitoring Coverage is an Azure Monitor preview. Its subscription-wide VM alert option includes existing and future VMs, creates one rule per subscription, and requires a user-assigned managed identity plus Monitoring Contributor. Selected-resource scope instead creates one rule per selected VM. In subscription scope, choosing to skip host metric rules leaves guest alerts only for VMs with Azure Monitor Agent OTel collection; VMs without that telemetry remain uncovered. Microsoft Learn.

\n

Applicability

\n

This is a scope decision within the preview recommended-alert workflow, not a general assessment of every alert already deployed to a subscription. A subscription label alone should not be the acceptance criterion for the proposed guest-only configuration.

\n

DSE recommendation

\n

Compare the intended subscription VM population with the actual OTel-enabled population before approving guest-only coverage. List any exceptions and decide whether they should receive appropriate host alerts, have guest collection established, or remain an explicitly accepted gap. Assign ownership for checking newly created VMs against that decision. Keep notification configuration and the telemetry population as separate review items.

\n

Verification

\n

Inspect the proposed scope and the host-rule selection on Review + Enable. Compare representative VMs with and without the required collection and document which proposed rules can cover each. Reconcile the resulting population with the approved inventory rather than assuming subscription scope is exhaustive. Retain the selected settings and exceptions; this review should not claim that an alert fired or reached an operator unless that separate test was performed.

\n

Official references

\n

Microsoft Learn: Monitoring Coverage preview. Source reviewed September 9, 2026.

", "content_text": "Source facts\nMonitoring Coverage is an Azure Monitor preview. Its subscription-wide VM alert option includes existing and future VMs, creates one rule per subscription, and requires a user-assigned managed identity plus Monitoring Contributor. Selected-resource scope instead creates one rule per selected VM. In subscription scope, choosing to skip host metric rules leaves guest alerts only for VMs with Azure Monitor Agent OTel collection; VMs without that telemetry remain uncovered. Microsoft Learn.\nApplicability\nThis is a scope decision within the preview recommended-alert workflow, not a general assessment of every alert already deployed to a subscription. A subscription label alone should not be the acceptance criterion for the proposed guest-only configuration.\nDSE recommendation\nCompare the intended subscription VM population with the actual OTel-enabled population before approving guest-only coverage. List any exceptions and decide whether they should receive appropriate host alerts, have guest collection established, or remain an explicitly accepted gap. Assign ownership for checking newly created VMs against that decision. Keep notification configuration and the telemetry population as separate review items.\nVerification\nInspect the proposed scope and the host-rule selection on Review + Enable. Compare representative VMs with and without the required collection and document which proposed rules can cover each. Reconcile the resulting population with the approved inventory rather than assuming subscription scope is exhaustive. Retain the selected settings and exceptions; this review should not claim that an alert fired or reached an operator unless that separate test was performed.\nOfficial references\nMicrosoft Learn: Monitoring Coverage preview. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nMonitoring Coverage is an Azure Monitor preview. Its subscription-wide VM alert option includes existing and future VMs, creates one rule per subscription, and requires a user-assigned managed identity plus Monitoring Contributor. Selected-resource scope instead creates one rule per selected VM. In subscription scope, choosing to skip host metric rules leaves guest alerts only for VMs with Azure Monitor Agent OTel collection; VMs without that telemetry remain uncovered. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/monitoring-coverage).\n\n## Applicability\n\nThis is a scope decision within the preview recommended-alert workflow, not a general assessment of every alert already deployed to a subscription. A subscription label alone should not be the acceptance criterion for the proposed guest-only configuration.\n\n## DSE recommendation\n\nCompare the intended subscription VM population with the actual OTel-enabled population before approving guest-only coverage. List any exceptions and decide whether they should receive appropriate host alerts, have guest collection established, or remain an explicitly accepted gap. Assign ownership for checking newly created VMs against that decision. Keep notification configuration and the telemetry population as separate review items.\n\n## Verification\n\nInspect the proposed scope and the host-rule selection on Review + Enable. Compare representative VMs with and without the required collection and document which proposed rules can cover each. Reconcile the resulting population with the approved inventory rather than assuming subscription scope is exhaustive. Retain the selected settings and exceptions; this review should not claim that an alert fired or reached an operator unless that separate test was performed.\n\n## Official references\n\n[Microsoft Learn: Monitoring Coverage preview](https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/monitoring-coverage). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "url": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check which VMs lose alert coverage when subscription recommendations skip host metrics", "item": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "url": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/", "headline": "Check which VMs lose alert coverage when subscription recommendations skip host metrics", "description": "Does guest-only subscription alerting in Monitoring Coverage include VMs without OTel collection?", "abstract": "Does guest-only subscription alerting in Monitoring Coverage include VMs without OTel collection?", "articleBody": "Source facts\nMonitoring Coverage is an Azure Monitor preview. Its subscription-wide VM alert option includes existing and future VMs, creates one rule per subscription, and requires a user-assigned managed identity plus Monitoring Contributor. Selected-resource scope instead creates one rule per selected VM. In subscription scope, choosing to skip host metric rules leaves guest alerts only for VMs with Azure Monitor Agent OTel collection; VMs without that telemetry remain uncovered. Microsoft Learn.\nApplicability\nThis is a scope decision within the preview recommended-alert workflow, not a general assessment of every alert already deployed to a subscription. A subscription label alone should not be the acceptance criterion for the proposed guest-only configuration.\nDSE recommendation\nCompare the intended subscription VM population with the actual OTel-enabled population before approving guest-only coverage. List any exceptions and decide whether they should receive appropriate host alerts, have guest collection established, or remain an explicitly accepted gap. Assign ownership for checking newly created VMs against that decision. Keep notification configuration and the telemetry population as separate review items.\nVerification\nInspect the proposed scope and the host-rule selection on Review + Enable. Compare representative VMs with and without the required collection and document which proposed rules can cover each. Reconcile the resulting population with the approved inventory rather than assuming subscription scope is exhaustive. Retain the selected settings and exceptions; this review should not claim that an alert fired or reached an operator unless that separate test was performed.\nOfficial references\nMicrosoft Learn: Monitoring Coverage preview. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:28:30+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-206-check-which-vms-lose-alert-coverage-when-subscription-recommendations-skip-host/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check which VMs lose alert coverage when subscription recommendations skip host metrics" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Monitoring coverage in Azure Monitor (preview) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/monitoring-coverage" } } ] } }