Skip to content

Deploy Azure monitoring

DISCLAIMER: This document is still under development and is not ready for use. The information provided is subject to change. Use at your own risk.

Because of the new 3.0.0 standard we must make alot of changes to the central monitoring template. The current automation is tailored to single subscription deployment. In the new standard we need to incorperate the possibibility of multiple solutions and solution subscriptions.

Currently we need to manually deploy the different resources

Deployment

This page assumes that you have basic knowledge of the azure bicep/terraform templates and are proficient at using these templates.

  1. Create a resource group Azure v3.0.0 uses a differente naming scheme and default locations for all resources. In the future we might combine the creation of the log analytics workspace with a basic tenant baseline deployment. For now manually create a new resource group using the following naming scheme:

<Customer name abbreviation>-MGMT-PROD-MON

  1. Run the first bicep deployment In the azure repo resides a generalized deployment for monitoring. The bicep can be found under the landing zones\Platform folder. Select the MGMT subscription and perform the deployment below:

New-AzResourceGroupDeployment -ResourceGroupName '<Name of the resource group>' -TemplateFile .\deploy_monitoring.bicep -location westeurope -customerFullName "<Full name of the customer>"

  1. Grant permissions to the newly created logic apps In the future we might use azure policy to assign the correct permissions. For now we must manually grant the required permissions to these logic apps.
  2. YAReservationmonitor
    • Monitoring Metrics Publisher - On the DCR Automations collection rule

  3. YAStoragenmonitor

    • Monitoring Metrics Publisher - On the DCR Automations collection rule
    • Reader - On all storage accounts. Do not grant this permission on a high level. Use either policy to grant it to all storage accounts, or grant it to the dedicated storage resource groups

  4. Manually run logic apps Manually run both logic apps to verify that everything is working as intended.

  5. To be added: A couple of configuration items still need to be moved over to V3.0.0. Below a short list of all points:

  6. Alert rules
    • Currently no alert rules have been adapted
  7. Automatically enable azure monitor
    • Azure monitor still needs to be enabled manually on all VM's
  8. Automatically enable diagnostic logging
    • Diag logs for key vaults
    • Diag logs for AVD host pools