Do not assume an Azure Monitor Agent proxy setting covers every destination

Source facts

Azure Monitor Agent supports HTTPS communication through a proxy, including anonymous or basic authentication. However, its Azure Monitor Metrics preview destination does not support that proxy configuration and sends through the public internet. Microsoft also excludes Azure Arc-enabled servers from OMS Gateway connectivity and requires HTTPS inspection to be disabled for the documented agent endpoints. Microsoft Learn.

Applicability

This concerns the agent’s destination-specific network behavior, not a promise that every configured telemetry stream follows one route. The custom-metrics preview is unavailable in Azure Government and Azure operated by 21Vianet. Microsoft Learn. Evaluate any preview use under the organization’s existing approval policy.

DSE recommendation

Review the actual collection destinations before treating the agent proxy as an exclusive outbound path. Separate the log route from any configured custom-metrics route in the network review. Where direct public egress is prohibited, ask the monitoring owner to resolve the incompatible destination choice before deployment. Do not approve a gateway design for Arc solely because an Azure VM example uses one.

Verification

Inspect the effective agent extension settings and destination configuration on a representative host. Under an approved test, compare the observed connections with the proposed route for each stream and confirm the intended data arrives. Check the inspection policy as well as the proxy setting. Preserve evidence of the actual destination and network path, and raise a specific design exception if either differs from the approved requirement.

Official references

Microsoft Learn: Azure Monitor Agent network configuration. Source reviewed September 9, 2026.