Recognize tenant-wide targeting before using the Windows client monitoring installer

Source facts

With Azure Monitor Agent’s Windows client installer, a DCR associated with the tenant’s monitored object applies to all Windows clients running that installer in the tenant. Granular client targeting is unsupported. Agents installed through the VM extension are outside this association’s scope. Microsoft identifies the monitored-object operations as preview-only. Microsoft Learn.

The installer uses Microsoft Entra device tokens rather than the VM extension’s managed identity. Clients must be Entra joined or hybrid joined. This client method does not support private-link monitoring or Azure Monitor Metrics as a destination. Microsoft Learn.

Applicability

Review Windows 11 clients using Azure Monitor Agent’s client installer and preview monitored-object operations. The method primarily targets continuously connected desktops or workstations; assess laptop limitations and all prerequisites separately.

DSE recommendation

DSE recommends listing every client already using this installer before associating a rule with the monitored object. Have the collection owner approve that actual population. Do not describe a resource-group name or a deployment tool’s pilot group as a DCR targeting boundary that the service does not provide. Keep extension-managed machines in a separate configuration inventory.

Verification

In an approved test tenant, inspect the monitored object’s complete association list and compare expected collection on multiple installer-managed clients. Confirm that the resulting destination records identify the intended devices. Review the impact on all existing clients before a production association change; avoid using a tenant-wide change as an unannounced one-device experiment. Preserve the scope decision with the exact rule and association.

Official references

Microsoft Learn: Azure Monitor Agent on Windows clients.