VMs not connecting to Log Analytics Workspace

[jemrobinson]

✅ Checklist

• I have searched open and closed issues for duplicates.
• This is a problem observed when deploying a Data Safe Haven.
• I can reproduce this with the latest version.
• I have read through the documentation.
• This isn't an open-ended question (open a discussion if it is).

💻 System information

• Operating System: macOS
• Data Safe Haven version: develop @ 1a60d97

🚫 Describe the problem

VMs are not able to connect to the Log Analytics Workspace using the Azure Monitor Agent. This could be a problem with one of the following:

• NSG rules
• Installation of the agent on the VM
• Configuration of the Data Collection Rule (DCR)
• Configuration of the Data Collection Endpoint (DCE)
• Association of the VM to the DCR
• Association of the VM to the DCE
• Need for another connection (e.g. diagnostic settings connection from the DCR to the workspace).

♻️ To reproduce

Deploy an SRE with an integrated workspace

[craddm]

To date, this still is not working as deployed by Pulumi.

However, after manually creating another data collection rule, it does work.

I created a new data collection rule in the portal.

1. creating a new data collection rule also automatically gave the VM a system-assigned managed identity.
2. Even though when creating the rule I told it not to use a data collection endpoint, it still actually created the new rule with the existing data collection endpoint (which was created by pulumi). This means the new rule is fundamentally the same as the pulumi generated rule.
3. Deleting the new rule does not stop the log analytics workspace collecting data from the VMs; thus, the old rule now works.
4. Removing the managed identity from the VM doesn't stop the logs being collected
5. Deleting the old rule and then reinstating it with Pulumi stops data collection
6. Manually setting the workspace to have a system-assigned managed identity restarts data collection

It feels like it might be necessary for the VM to have managed identity for data collection to start.