Issue with Installing Azure Monitor Agent (AMA) on VMs Using OS Disk Images Despite Policy Configuration using this policy - "Configure Windows virtual machines to run Azure Monitor Agent using system-assigned managed identity"

Hello Pardeep,

Kindly check the below and see if it works.

1. Policy Enforcement: Ensure that the policy you have configured is indeed applying to all relevant VMs, including those created from OS disk images. Sometimes the policy may not be correctly scoped.
2. Managed Identity Configuration: Since you're using system-assigned managed identity, confirm that the VMs created from OS disk images have a managed identity enabled. If the identity isn’t set up correctly, the AMA might not install.
3. Remediation Tasks: If the VMs were created before the policy was applied, you may need to create a remediation task to enforce the policy on existing VMs. This could help force the installation of the AMA.
4. Check for Errors: Review the installation logs to see if there are any specific errors being reported that might explain why the AMA is not installing. This can often provide valuable insight.
5. VM State: Ensure that the VMs are running and fully booted. Sometimes, installation issues occur if the VM is not in a coherent state when the policy attempts to apply.
6. Data Collection Rule (DCR): Verify that at least one DCR is associated with those VMs. The AMA installs alongside a DCR, so lacking this association could prevent installation.
7. Known Issues: Check if any known issues exist that might affect your scenario. For example, if there’s a race condition related to identity assignment, you may encounter similar problems.

Reference documents:

Troubleshoot known issues with Azure Update Manager | Microsoft Learn

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-policy?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#known-issues

https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/azure-monitor-agent/ama-windows-installation-issues-detailed-troubleshooting-steps?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider

Troubleshoot known issues with Azure Update Manager | Microsoft Learn

 If the comment was helpful, please click "Upvote".

Thanks,

Siva shunmugam.

Hi @Siva shunmugam Nadessin ,Thank you for the detailed response and suggestions.

I’ve already verified and implemented all the recommended steps, and here’s what I’ve observed across different VM scenarios:

1. VMs with standard images: AMA was successfully installed via policy.
2. VMs using custom images (AVD): I included the image IDs in the policy parameters, and AMA was installed successfully via remediation task, as these were existing VMs.
3. VMs created using OS disk images: These VMs did not get AMA installed, even though: (This step is something which is not installing the AMA)

• The policy is correctly scoped and applied.
• System-assigned managed identity is enabled.
• The OS disk resource ID was tested in the policy parameters.
• VM state is healthy and running.
• DCR association is verified and correct.

Despite all above pre-checks being validated, AMA is still not installing on these VMs. I suspect this might be due to how the policy interprets OS disk-based deployments versus image-based ones.

Could you please confirm:

Is there a known limitation or behavior with AMA installation on VMs created from OS disk images?

Is there an alternative method to enforce AMA installation on such VMs (e.g., via script, CLI, or manual remediation)?

Would a custom policy or different parameter format help in this scenario?

Any insights or workarounds would be greatly appreciated.