Skip to content

Commit fad193b

Browse files
PhilKang0704PhilKang0704
authored
Merge pull request #307895 from MicrosoftDocs/main
[Publishing] [Out of Band Publish] azure-docs-pr - release-cti-new-toc - 11/05 - 9:30 PM PST (11/06 - 11:00 AM IST)
2 parents 5f7fe0e + 37b0e75 commit fad193b

File tree

83 files changed

+1173
-45
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+1173
-45
lines changed

‎articles/azure-change-tracking-inventory/TOC.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
- name: Azure Change Tracking and Inventory documentation
2+
href: index.yml
3+
- name: Overview
4+
href: overview-monitoring-agent.md
5+
- name: Get started
6+
items:
7+
- name: Azure Change Tracking and Inventory release notes
8+
href: extension-version-details.md
9+
- name: Supported regions and mappings
10+
href: region-mappings-monitoring-agent.md
11+
- name: Support matrix for Azure Change Tracking and Inventory
12+
href: change-tracking-inventory-support-matrix.md
13+
- name: Quickstarts
14+
items:
15+
- name: Enable Azure Change Tracking and Inventory
16+
href: quickstart-monitor-changes-collect-inventory-azure-change-tracking-inventory.md
17+
- name: Tutorials
18+
items:
19+
- name: Change a workspace and configure Data Collectionq Rule
20+
href: tutorial-change-workspace-configure-data-collection-rule.md
21+
- name: Manage Change Tracking and Inventory
22+
items:
23+
- name: Enable from machines pane
24+
href: enable-change-tracking-at-scale-machines-blade.md
25+
- name: Enable using Azure policy
26+
href: enable-change-tracking-at-scale-policy.md
27+
- name: Create Data Collection Rule
28+
href: create-data-collection-rule.md
29+
- name: Disable Change Tracking and Inventory
30+
href: disable-azure-change-tracking-inventory-monitoring-agent.md

‎articles/azure-change-tracking-inventory/change-tracking-inventory-support-matrix.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
title: Azure Change Tracking and Inventory Support matrix
3+
description: Get a summary of support settings and limitations for enabling Azure CTI and tracking changes.
4+
#customer intent: As a customer, I want to understand the supported operating systems for Azure Change Tracking and Inventory so that I can ensure compatibility with my environment.
5+
services: automation
6+
ms.date: 11/03/2025
7+
ms.topic: overview
8+
ms.service: azure-change-tracking-inventory
9+
ms.author: v-jasmineme
10+
author: jasminemehndir
11+
---
12+
13+
# Support matrix for Azure Change Tracking and Inventory
14+
15+
Azure Change Tracking and Inventory (CTI) monitors changes and provide inventory logs for servers across Azure, on-premises, and other cloud environments. This article summarizes support settings and limitations when you enable Azure CTI and track changes.
16+
17+
## Support matrix
18+
19+
|**Component**| **Applies to**|
20+
|---|---|
21+
|Operating systems| Windows </br> Linux |
22+
|Resource types | Azure VMs </br> Azure Arc-enabled VMs </br> Virtual machines scale set|
23+
|Data types | Windows registry </br> Windows services </br> Linux Daemons </br> Files </br> Software
24+
25+
## Limits
26+
27+
The following table shows the tracked item limits per machine for Azure CTI.
28+
29+
| **Resource** | **Limit**| **Notes** |
30+
|---|---|---|
31+
|File|500||
32+
|File size|5 MB||
33+
|Registry|250||
34+
|Windows software|250|Doesn't include software updates.|
35+
|Linux packages|1,250||
36+
|Windows Services |250||
37+
|Linux Daemons | 250||
38+
39+
## Supported operating systems
40+
41+
Azure CTI is supported on all operating systems that meet Azure Monitor agent requirements. See [supported operating systems](/azure/azure-monitor/agents/agents-overview#supported-operating-systems) for a list of the Windows and Linux operating system versions that are currently supported by the Azure Monitor agent.
42+
43+
To understand client requirements for TLS, see [TLS for Azure Automation](../automation/automation-managing-data.md#tls-for-azure-automation).
44+
45+
46+
## Enable Azure Change Tracking and Inventory
47+
48+
You can enable Azure CTI in the following ways:
49+
50+
- Manually for non-Azure Arc-enabled machines, Refer to the Initiative *Enable Change Tracking and Inventory for Arc-enabled virtual machines* in **Policy > Definitions > Select Category = ChangeTrackingAndInventory**. To enable Azure CTI at scale, use the **DINE Policy** based solution. For more information, see [Quickstart: Enable Azure Change Tracking and Inventory](quickstart-monitor-changes-collect-inventory-azure-change-tracking-inventory.md).
51+
52+
- For a single Azure VM from the [Virtual machine pane](../automation/change-tracking/enable-vms-monitoring-agent.md) in the Azure portal. This scenario is available for Linux and Windows VMs.
53+
54+
- For [multiple Azure VMs](quickstart-monitor-changes-collect-inventory-azure-change-tracking-inventory.md) by selecting them from the Virtual machines pane in the Azure portal.
55+
56+
## Track file changes
57+
58+
For tracking changes in files on both Windows and Linux, Azure CTI uses SHA256 hashes of the files. The feature uses the hashes to detect if changes have been made since the last inventory.
59+
60+
## Track file content changes
61+
62+
Azure CTI allows you to view the contents of a Windows or Linux file. For each change to a file, Azure CTI stores the contents of the file in an [Azure Storage account](../storage/common/storage-account-create.md). When you're tracking a file, you can view its contents before or after a change. The file content can be viewed either inline or side by side. [Learn more](tutorial-change-workspace-configure-data-collection-rule.md).
63+
64+
![Screenshot of viewing changes in a Windows or Linux file.](./media/overview/view-file-changes.png)
65+
66+
## Track registry keys
67+
68+
Azure CTI allows monitoring of changes to Windows registry keys. Monitoring allows you to pinpoint extensibility points where third-party code and malware can activate. The following table lists pre-configured (but not enabled) registry keys. To track these keys, you must enable each one.
69+
70+
> [!div class="mx-tdBreakAll"]
71+
> |Registry Key | Purpose |
72+
> | --- | --- |
73+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Startup` | Monitors scripts that run at startup.
74+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\Scripts\Shutdown` | Monitors scripts that run at shutdown.
75+
> |`HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run` | Monitors keys that are loaded before the user signs in to the Windows account. The key is used for 32-bit applications running on 64-bit computers.
76+
> |`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components` | Monitors changes to application settings.
77+
> |`HKEY_LOCAL_MACHINE\Software\Classes\Directory\ShellEx\ContextMenuHandlers` | Monitors context menu handlers that hook directly into Windows Explorer and usually run in-process with **explorer.exe**.
78+
> |`HKEY_LOCAL_MACHINE\Software\Classes\Directory\Shellex\CopyHookHandlers` | Monitors copy hook handlers that hook directly into Windows Explorer and usually run in-process with **explorer.exe**.
79+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers` | Monitors for icon overlay handler registration.
80+
>|`HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers` | Monitors for icon overlay handler registration for 32-bit applications running on 64-bit computers.
81+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects` | Monitors for new browser helper object plugins for Internet Explorer. Used to access the Document Object Model (DOM) of the current pane and to control navigation.
82+
> |`HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects` | Monitors for new browser helper object plugins for Internet Explorer. Used to access the Document Object Model (DOM) of the current pane and to control navigation for 32-bit applications running on 64-bit computers.
83+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions` | Monitors for new Internet Explorer extensions, such as custom tool menus and custom toolbar buttons.
84+
> |`HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions` | Monitors for new Internet Explorer extensions, such as custom tool menus and custom toolbar buttons for 32-bit applications running on 64-bit computers.
85+
> |`HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Drivers32` | Monitors 32-bit drivers associated with wavemapper, wave1 and wave2, msacm.imaadpcm, .msadpcm, .msgsm610, and vidc. Similar to the [drivers] section in the **system.ini** file.
86+
> |`HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32` | Monitors 32-bit drivers associated with wavemapper, wave1 and wave2, msacm.imaadpcm, .msadpcm, .msgsm610, and vidc for 32-bit applications running on 64-bit computers. Similar to the [drivers] section in the **system.ini** file.
87+
> |`HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDlls` | Monitors the list of known or commonly used system DLLs. Monitoring prevents people from exploiting weak application directory permissions by dropping in Trojan horse versions of system DLLs.
88+
> |`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify` | Monitors the list of packages that can receive event notifications from **winlogon.exe**, the interactive logon support model for Windows.
89+
90+
91+
## Recursion support
92+
93+
Azure CTI supports recursion, which allows you to specify wildcards to simplify tracking across directories. Recursion also provides environment variables to allow you to track files across environments with multiple or dynamic drive names. The following list includes common information you should know when configuring recursion:
94+
95+
- Wildcards are required for tracking multiple files.
96+
97+
- You can use wildcards only in the last segment of a file path, for example, **c:\folder\\file*** or **/etc/*.conf**.
98+
99+
- If an environment variable has an invalid path, validation succeeds but the path fails during execution.
100+
101+
- You should avoid general path names when setting the path, as this type of setting can cause too many folders to be traversed.
102+
103+
## Change Tracking and Inventory data collection
104+
105+
The next table shows the data collection frequency for the types of changes supported by Azure CTI. Inventory logs will be populated every 10 hours by default for all data types. Additionally, when there is a change registered for any of the data types, the inventory and change logs will be generated for this instance.
106+
107+
| **Change Type** | **Frequency** |
108+
| --- | --- |
109+
| Windows registry | 50 minutes |
110+
| Windows file | 30 to 40 minutes |
111+
| Linux file | 15 minutes |
112+
| Windows services | 10 minutes to 30 minutes</br> Default: 30 minutes |
113+
| Windows software | 30 minutes |
114+
| Linux software | 5 minutes |
115+
| Linux Daemons | 5 minutes |
116+
117+
The following table shows the tracked item limits per machine for Azure CTI.
118+
119+
| **Resource** | **Limit** |
120+
|---|---|
121+
|File|500|
122+
|Registry|250|
123+
|Windows software (not including hotfixes) |250|
124+
|Linux packages|1250|
125+
|Windows Services | 250 |
126+
|Linux Daemons| 500|
127+
128+
### Windows services data
129+
130+
#### Prerequisites
131+
132+
To enable tracking of Windows Services data, you must upgrade CT extension and use extension more than or equal to 2.11.0.0
133+
134+
#### For Windows Azure VMs
135+
136+
```powershell-interactive
137+
- az vm extension set --publisher Microsoft.Azure.ChangeTrackingAndInventory --version 2.11.0 --ids /subscriptions/<subscriptionids>/resourceGroups/<resourcegroupname>/providers/Microsoft.Compute/virtualMachines/<vmname> --name ChangeTracking-Windows --enable-auto-upgrade true
138+
```
139+
#### For Linux Azure VMs
140+
141+
```powershell-interactive
142+
– az vm extension set --publisher Microsoft.Azure.ChangeTrackingAndInventory --version 2.11.0 --ids /subscriptions/<subscriptionids>/resourceGroups/<resourcegroupname>/providers/Microsoft.Compute/virtualMachines/<vmname> --name ChangeTracking-Linux --enable-auto-upgrade true
143+
```
144+
#### For Arc-enabled Windows VMs
145+
146+
```powershell-interactive
147+
– az connectedmachine extension create --name ChangeTracking-Windows --publisher Microsoft.Azure.ChangeTrackingAndInventory --type ChangeTracking-Windows --machine-name <arc-server-name> --resource-group <resource-group-name> --location <arc-server-location> --enable-auto-upgrade true
148+
```
149+
150+
#### For Arc-enabled Linux VMs
151+
152+
```powershell-interactive
153+
- az connectedmachine extension create --name ChangeTracking-Linux --publisher Microsoft.Azure.ChangeTrackingAndInventory --type ChangeTracking-Linux --machine-name <arc-server-name> --resource-group <resource-group-name> --location <arc-server-location> --enable-auto-upgrade true
154+
```
155+
156+
#### Configure frequency
157+
158+
The default collection frequency for Windows services is 30 minutes. To configure the frequency, under **Edit** Settings, use a slider on the **Windows services** tab.
159+
160+
:::image type="content" source="media/overview-monitoring-agent/frequency-slider-inline.png" alt-text="Screenshot of frequency slider." lightbox="media/overview-monitoring-agent/frequency-slider-expanded.png":::
161+
162+
## Current limitations
163+
164+
Azure CTI using Azure Monitoring Agent doesn't support or has the following limitations:
165+
166+
- Recursion for Windows registry tracking
167+
- Currently, only the HKEY_LOCAL_MACHINE is supported. You will encounter this limitation whenever you manually add the registry key.
168+
- Network file systems
169+
- Different installation methods
170+
- ***.exe** files stored on Windows
171+
- The **Max File Size** column and values are unused in the current implementation.
172+
- If you are tracking file changes, it is limited to a file size of 5 MB or less.
173+
- If the file size appears >1.25MB, then FileContentChecksum is incorrect due to memory constraints in the checksum calculation.
174+
- If you try to collect more than 2500 files in a 30-minute collection cycle, Azure CTI performance might be degraded.
175+
- If network traffic is high, change records can take up to six hours to display.
176+
- If you modify a configuration while a machine or server is shut down, it might post changes belonging to the previous configuration.
177+
- Collecting Hotfix updates on Windows Server 2016 Core RS3 machines.
178+
- Linux daemons might show a changed state even though no change has occurred. This issue arises because of how the `SvcRunLevels` data in the Azure Monitor [ConfigurationChange](/azure/azure-monitor/reference/tables/configurationchange) table is written.
179+
- Change Tracking extension doesn't support any hardening standards for any Linux operating systems or Distros.
180+
- Change Tracking extension doesn't support inventory for Microsoft store applications for any Windows operating systems or Distros.
181+
182+
183+
## Support for alerts on configuration state
184+
185+
A key capability of Azure CTI is alerting on changes to the configuration state of your hybrid environment. Many useful actions are available to trigger in response to alerts. For example, actions on Azure functions, Automation runbooks, webhooks, and the like. Alerting on changes to the **c:\windows\system32\drivers\etc\hosts** file for a machine is one good application of alerts for Azure CTI data. There are many more scenarios for alerting as well, including the query scenarios defined in the next table.
186+
187+
|Query |Description |
188+
|---------|---------|
189+
|ConfigurationChange <br>&#124; where ConfigChangeType == "Files" and FileSystemPath contains " c:\\windows\\system32\\drivers\\"|Useful for tracking changes to system-critical files.|
190+
|ConfigurationChange <br>&#124; where FieldsChanged contains "FileContentChecksum" and FileSystemPath == "c:\\windows\\system32\\drivers\\etc\\hosts"|Useful for tracking modifications to key configuration files.|
191+
|ConfigurationChange <br>&#124; where ConfigChangeType == "WindowsServices" and SvcName contains "w3svc" and SvcState == "Stopped"|Useful for tracking changes to system-critical services.|
192+
|ConfigurationChange <br>&#124; where ConfigChangeType == "Daemons" and SvcName contains "ssh" and SvcState!= "Running"|Useful for tracking changes to system-critical services.|
193+
|ConfigurationChange <br>&#124; where ConfigChangeType == "Software" and ChangeCategory == "Added"|Useful for environments that need locked-down software configurations.|
194+
|ConfigurationData <br>&#124; where SoftwareName contains "Monitoring Agent" and CurrentVersion!= "8.0.11081.0"|Useful for seeing which machines have outdated or noncompliant software version installed. This query reports the last reported configuration state, but doesn't report changes.|
195+
|ConfigurationChange <br>&#124; where RegistryKey == @"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\QualityCompat"| Useful for tracking changes to crucial antivirus keys.|
196+
|ConfigurationChange <br>&#124; where RegistryKey contains @"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy"| Useful for tracking changes to firewall settings.|
197+
198+
## Next steps
199+
200+
To enable Azure CTI from the Azure portal, see the Quickstart article [Quickstart: Enable Azure Change Tracking and Inventory](/azure/azure-change-tracking-inventory/quickstart-monitor-changes-collect-inventory-azure-change-tracking-inventory).

0 commit comments

Comments
 (0)