You add the Microsoft Monitoring Agent VM extension to VM1 > This is WRONG You Install the Microsoft Monitoring Agent VM agent to VM1 > This is Correct 1. Log analytics agent - Install in VM. 2. Log analytics workspace - collect the log files from Log Analytics Agent. 3. Azure Monitor - Create alert based on logs read from Log Analytics Workspace. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overviewplatform/agents- overview