Log Analytics workspace access fails for ERP monitoring agents with private endpoints

Cloud Platforms Microsoft Azure
, , , , , , , ,
1

ERP monitoring agents deployed on Azure VMs can’t send logs to our Log Analytics workspace after we configured private endpoints. Agents show connected status but no data is flowing to the workspace.

We’ve set up private endpoint DNS configuration and verified the conditional access policy allows the managed identity. The agent network requirements should be met since VMs are in the same VNet as the private endpoint.


Agent Status: Connected
Last Heartbeat: None
Error: Failed to resolve workspace endpoint
Private DNS Zone: privatelink.oms.opinsights.azure.com

We’re missing critical monitoring data for our ERP environment. The private endpoint shows approved status. What’s wrong with the DNS setup or conditional access configuration?

2

Don’t overlook conditional access policies. If you have CA policies that restrict access to Azure resources, they can block the agent authentication even with correct DNS. The Log Analytics agent uses system-assigned managed identity for authentication, and that identity needs to be excluded from certain CA policies that require user interaction. Check your CA policy assignments in Azure AD.

3

The DNS resolution is likely the issue. When using private endpoints with Log Analytics, you need multiple DNS zones configured correctly. It’s not just the OMS zone - you also need zones for the data collection endpoints. Check if all required zones are linked to your VNet.