{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
        "slug": "dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/"
        },
        "title": "Do not assume an Azure Monitor Agent proxy setting covers every destination",
        "summary": "Which destination can bypass the configured Azure Monitor Agent proxy?",
        "format": {
            "slug": "briefing",
            "name": "Briefing"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:23:18+00:00",
        "modified_at": "2026-09-10T02:11:18+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 246,
        "potentially_affected": "Azure Monitor Agent network designs, including the Azure Monitor Metrics preview destination.",
        "dse_recommendation": "Review the actual collection destinations before treating the agent proxy as an exclusive outbound path.",
        "primary_source": {
            "name": "Azure Monitor Agent Network Configuration - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Azure Monitor Agent supports HTTPS communication through a proxy, including anonymous or basic authentication. However, its Azure Monitor Metrics preview destination does not support that proxy configuration and sends through the public internet. Microsoft also excludes Azure Arc-enabled servers from OMS Gateway connectivity and requires HTTPS inspection to be disabled for the documented agent endpoints. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns the agent&#8217;s destination-specific network behavior, not a promise that every configured telemetry stream follows one route. The custom-metrics preview is unavailable in Azure Government and Azure operated by 21Vianet. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>. Evaluate any preview use under the organization&#8217;s existing approval policy.</p>\n<h2>DSE recommendation</h2>\n<p>Review the actual collection destinations before treating the agent proxy as an exclusive outbound path. Separate the log route from any configured custom-metrics route in the network review. Where direct public egress is prohibited, ask the monitoring owner to resolve the incompatible destination choice before deployment. Do not approve a gateway design for Arc solely because an Azure VM example uses one.</p>\n<h2>Verification</h2>\n<p>Inspect the effective agent extension settings and destination configuration on a representative host. Under an approved test, compare the observed connections with the proposed route for each stream and confirm the intended data arrives. Check the inspection policy as well as the proxy setting. Preserve evidence of the actual destination and network path, and raise a specific design exception if either differs from the approved requirement.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Azure Monitor Agent network configuration</a>. Source reviewed September 9, 2026.</p>",
        "content_text": "Source facts\nAzure Monitor Agent supports HTTPS communication through a proxy, including anonymous or basic authentication. However, its Azure Monitor Metrics preview destination does not support that proxy configuration and sends through the public internet. Microsoft also excludes Azure Arc-enabled servers from OMS Gateway connectivity and requires HTTPS inspection to be disabled for the documented agent endpoints. Microsoft Learn.\nApplicability\nThis concerns the agent’s destination-specific network behavior, not a promise that every configured telemetry stream follows one route. The custom-metrics preview is unavailable in Azure Government and Azure operated by 21Vianet. Microsoft Learn. Evaluate any preview use under the organization’s existing approval policy.\nDSE recommendation\nReview the actual collection destinations before treating the agent proxy as an exclusive outbound path. Separate the log route from any configured custom-metrics route in the network review. Where direct public egress is prohibited, ask the monitoring owner to resolve the incompatible destination choice before deployment. Do not approve a gateway design for Arc solely because an Azure VM example uses one.\nVerification\nInspect the effective agent extension settings and destination configuration on a representative host. Under an approved test, compare the observed connections with the proposed route for each stream and confirm the intended data arrives. Check the inspection policy as well as the proxy setting. Preserve evidence of the actual destination and network path, and raise a specific design exception if either differs from the approved requirement.\nOfficial references\nMicrosoft Learn: Azure Monitor Agent network configuration. Source reviewed September 9, 2026.",
        "content_markdown": "## Source facts\n\nAzure Monitor Agent supports HTTPS communication through a proxy, including anonymous or basic authentication. However, its Azure Monitor Metrics preview destination does not support that proxy configuration and sends through the public internet. Microsoft also excludes Azure Arc-enabled servers from OMS Gateway connectivity and requires HTTPS inspection to be disabled for the documented agent endpoints. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration).\n\n## Applicability\n\nThis concerns the agent’s destination-specific network behavior, not a promise that every configured telemetry stream follows one route. The custom-metrics preview is unavailable in Azure Government and Azure operated by 21Vianet. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration). Evaluate any preview use under the organization’s existing approval policy.\n\n## DSE recommendation\n\nReview the actual collection destinations before treating the agent proxy as an exclusive outbound path. Separate the log route from any configured custom-metrics route in the network review. Where direct public egress is prohibited, ask the monitoring owner to resolve the incompatible destination choice before deployment. Do not approve a gateway design for Arc solely because an Azure VM example uses one.\n\n## Verification\n\nInspect the effective agent extension settings and destination configuration on a representative host. Under an approved test, compare the observed connections with the proposed route for each stream and confirm the intended data arrives. Check the inspection policy as well as the proxy setting. Preserve evidence of the actual destination and network path, and raise a specific design exception if either differs from the approved requirement.\n\n## Official references\n\n[Microsoft Learn: Azure Monitor Agent network configuration](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration). Source reviewed September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Do not assume an Azure Monitor Agent proxy setting covers every destination",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/",
                "headline": "Do not assume an Azure Monitor Agent proxy setting covers every destination",
                "description": "Which destination can bypass the configured Azure Monitor Agent proxy?",
                "abstract": "Which destination can bypass the configured Azure Monitor Agent proxy?",
                "articleBody": "Source facts\nAzure Monitor Agent supports HTTPS communication through a proxy, including anonymous or basic authentication. However, its Azure Monitor Metrics preview destination does not support that proxy configuration and sends through the public internet. Microsoft also excludes Azure Arc-enabled servers from OMS Gateway connectivity and requires HTTPS inspection to be disabled for the documented agent endpoints. Microsoft Learn.\nApplicability\nThis concerns the agent’s destination-specific network behavior, not a promise that every configured telemetry stream follows one route. The custom-metrics preview is unavailable in Azure Government and Azure operated by 21Vianet. Microsoft Learn. Evaluate any preview use under the organization’s existing approval policy.\nDSE recommendation\nReview the actual collection destinations before treating the agent proxy as an exclusive outbound path. Separate the log route from any configured custom-metrics route in the network review. Where direct public egress is prohibited, ask the monitoring owner to resolve the incompatible destination choice before deployment. Do not approve a gateway design for Arc solely because an Azure VM example uses one.\nVerification\nInspect the effective agent extension settings and destination configuration on a representative host. Under an approved test, compare the observed connections with the proposed route for each stream and confirm the intended data arrives. Check the inspection policy as well as the proxy setting. Preserve evidence of the actual destination and network path, and raise a specific design exception if either differs from the approved requirement.\nOfficial references\nMicrosoft Learn: Azure Monitor Agent network configuration. Source reviewed September 9, 2026.",
                "datePublished": "2026-09-10T00:23:18+00:00",
                "dateModified": "2026-09-10T02:11:18+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-518-do-not-assume-an-azure-monitor-agent-proxy-setting-covers-every-destination/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Do not assume an Azure Monitor Agent proxy setting covers every destination"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Briefing",
                    "Information priority"
                ],
                "genre": "Briefing",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 246,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Azure Monitor Agent Network Configuration - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-network-configuration"
                }
            }
        ]
    }
}