Prerequisites for the Nodinite Azure Monitoring agent

Info

This page is the one home for the prerequisites of the Nodinite Azure Monitoring Agent: software, Azure access, Windows rights, firewall ports, and proxy settings. The Install, Configuration, and Troubleshooting pages link here instead of repeating these facts.

Get started with the Nodinite Azure Monitoring Agent by making sure your environment meets these prerequisites. Meet them, and you get a secure, reliable monitoring solution for your Azure EAI services, from Subscriptions and Resource Groups down to Azure Functions, Web Jobs, and Azure Storage.

• ✅ Ensure secure and least-privilege access to Azure resources
• ✅ Meet all software and network requirements for seamless operation
• ✅ Empower teams to monitor and manage Azure without direct portal access
• ✅ Stay up to date with supported versions and best practices

How the agent uses Azure

The Monitoring Service polls the agent for the state of every Resource it discovers, and sends Remote Configuration changes and Remote Actions to it. The agent then talks to Azure on your behalf:

Diagram: Nodinite Azure Monitoring Agent architecture and required connections. The agent calls the Azure REST API for discovery, monitoring, and Remote Actions, runs Kusto queries against Application Insights for Functions Monitoring, and reads Azure Storage.

Azure services at a glance

Authentication options

Software Requirements

The Azure Agent usually runs on the Nodinite application server, together with the Core Services. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, installed through the Nodinite Portal (Agents step). Nodinite v6 installed it as a Windows Service. Virtual machines are supported.

Earlier versions of this agent made use of .NET Framework 4.7.2.

Supported Versions

Cloud technologies evolve quickly, and Microsoft deprecates older API versions regularly. Nodinite always supports the APIs that Microsoft supports, so update Nodinite and the Nodinite Azure Agent periodically to stay current.

Make sure to subscribe to our Release Notes.

What Azure User rights and Services does the Azure agent require?

For the Least Privileges, review the Azure Access page, least privileges section. Carefully read and follow the instructions in the Azure Applications Access user guide for specific use, and insights about the least privileges required.

The agent provides features to Read, Write, Manage, and Post data to many Azure-related services.

The agent always uses an App Registration (Application/Client) in Microsoft Entra ID to authenticate with the Azure REST API and manage Azure services and resources. You enter its Tenant ID, Subscription ID, Client ID, and Client Secret per Subscription in the Configuration. Depending on the feature and version, some data-plane integrations can also use SAS keys/connection strings (for example, Azure Storage access in specific scenarios).

Only assign the rights required for the services the customer actually enables. If the customer opts out of a monitoring category, don't add the related Azure RBAC role or delegated permission; keep the App Registration limited to the enabled features only.

1. To ease administration, assign the ApplicationId/ClientId the Contributor role.
2. To send messages to the Azure Event Hub, add the Azure Event Hubs Data Sender role to the ApplicationId/ClientId (Post).
   
   Example: Assigning the Azure Event Hubs Data Sender role in the Azure Portal.
3. To monitor Azure Storage, configure access according to your selected approach in the agent. Some scenarios use Connection Strings, while RBAC-based access is also available for selected features. See RBAC reading for Azure Storage.
4. To monitor Azure Key Vault, assign the App Registration (Application/Client) the Key Vault Reader role.
5. To monitor Azure Functions, enable Azure Monitoring. You must tie an Application Insights instance to the Azure Function Web Site hosting the Functions you want to monitor. Include access rights as described in the next item.
6. Application Insights Monitoring (Kusto query execution and Functions Monitoring) requires the App Registration to have Delegated permissions to read data. Filter on Application Insights API and check the Data.Read checkbox.
7. Some features, like Web Jobs History, require you to set SCM Basic Auth Publishing Credentials to On.
8. The APIM Monitoring requires membership in the API Management Service Contributor role.

What Windows User Rights does the Azure agent require?

The agent runs under a service identity, usually on the Nodinite application server:

• Nodinite v7: the IIS application pool identity of the agent web site, set in the Nodinite Portal (Agents step).
• Nodinite v6 (legacy): the account of the Windows Service.

Use a domain account (preferred) or a local named account, and grant it access and run-time rights. Follow the 'How to set logon as a Windows service right' user guide for detailed instructions. All Azure access goes through the App Registration.

What Firewall settings are required for the Azure agent?

Where you install the Nodinite Azure Agent in relation to the Nodinite Monitoring Service and the Azure endpoints it calls determines your firewall configuration. The diagram shows every host involved, with the agent on its own server; each arrow starts at the side that opens the connection.

Network diagram: the Monitoring Service calls the agent; the agent gets a token from Microsoft Entra ID and calls the Azure APIs over HTTPS, directly or through a corporate forward proxy. Dashed arrows are optional hops.

Note

When the agent runs on the Core Services Server (the typical installation), you need no firewall rule between the Monitoring Service and the agent. The Web Client and Web API reach the agent only through the Monitoring Service.

Between the Monitoring Service and the Azure agent

The Monitoring Service opens every connection; the agent never calls it. On Windows Server, Nodinite v7 hosts the agent as its own IIS web site, on a port you set per environment in the Nodinite Portal (Servers step, Agents step).

Option: Service Bus Relaying (cloud or hybrid)

Use Service Bus Relayed connections when Nodinite and the agent are on different networks. Both sides connect outbound to the Azure Relay namespace, so neither server needs an inbound rule. Nodinite uses the same principle as the on-premises data gateway; see 'Adjust communication settings for the on-premises data gateway' and the 'Azure Relay FAQs'.

Tip

For guidance on configuring, testing, and troubleshooting AMQP ports 5671 and 5672, see AMQP Port Configuration - 5671 and 5672.

Between the Azure agent and Microsoft Azure

The agent signs in with the App Registration (Service Principal) and works through the Azure SDKs, which call the Azure REST API under the hood (plus a few direct REST API calls where an SDK lacks a feature, and Microsoft Graph), and the data-plane endpoints of the resources you monitor. All traffic is outbound; Azure needs no inbound rule. Allow these hostnames (public Azure cloud), as listed in Azure Monitor endpoint access and firewall configuration:

Note

Azure resource-level network rules can still block the agent, even when your own firewall allows the traffic:

• Resource firewalls (Storage account firewall, Event Hubs IP filters, Function App access restrictions): add the Agent Server's outbound IP address or virtual network to the allow list.
• Private Link / Private Endpoint: the Agent Server needs a network path to the private endpoint (same VNet, VNet peering, VPN, or ExpressRoute).
• NSGs, Azure Firewall, or virtual appliances: allow outbound TCP 443 from the Agent Server to the hostnames above.
• Non-HTTPS protocols or custom ports (rare): verify the target service protocol and ports before you deploy.

Review the resource's Networking settings in the Azure portal, or ask your cloud network administrators.

Between the Azure agent and the corporate forward proxy

Required only when all outbound HTTPS traffic must pass a corporate forward proxy; see Corporate Forward Proxy Configuration. The proxy then opens the HTTPS connections to the Azure hostnames above.

Between the servers and DNS

Important

Stateful Firewalls: Most Windows Firewall implementations are stateful, so response traffic for established outbound connections is allowed automatically. The inbound response rules above are for reference and troubleshooting.

Corporate Forward Proxy Configuration

In many enterprise environments, all outbound HTTP/HTTPS traffic from servers must route through a corporate forward proxy (such as a Zscaler, Squid, or Blue Coat appliance). The Azure Monitoring Agent makes outbound calls to Azure REST APIs, Azure Storage, and Application Insights on port 443, so this applies directly.

Note

Why Windows Services don't pick up proxy settings automatically: The agent runs as a Windows Service under a dedicated service account, not as an interactive user. Windows Services do not inherit the browser proxy settings from WinINET (Internet Explorer / system proxy settings). Without explicit proxy configuration, the .NET runtime inside the service process has no proxy configured and all outbound requests to Azure endpoints silently fail or time out, even though a browser on the same machine works fine.

.NET Framework 4.8 – exe.config approach

Add a <system.net> section to the agent's exe.config file. This instructs the .NET Framework runtime to route all WebRequest and HttpClient traffic through the proxy.

<system.net>
  <defaultProxy>
    <proxy
      usesystemdefault="True"
      proxyaddress="http://proxy.corp.example.com:3128"
      bypassonlocal="True"
    />
    <bypasslist>
      <!-- Bypass the proxy for all internal corporate domains -->
      <add address=".*\.internal\.example\.com$" />
      <!-- Bypass for a specific public domain, but not certain subdomains -->
      <add address="^(?!.*\.(api|service)\.example\.com$).*\.example\.com$" />
    </bypasslist>
  </defaultProxy>
</system.net>

Important

The bypasslist entries are .NET regular expressions, not simple wildcards. Test your patterns carefully — an overly broad bypass may expose traffic to the wrong route, and an overly narrow one may route internal traffic through the proxy unnecessarily.

What Azure Services does the Functions Monitoring require?

You must enable Application Insights for Azure Functions to use them with Nodinite Functions Monitoring.

The agent uses custom Kusto queries to get logs and evaluate the state and metrics of executions.

Microsoft covers this topic in the How to configure monitoring for Azure Functions user guide.

Frequently asked questions

Additional solutions to common problems and the Nodinite Azure Monitoring Agent FAQ appear in the Troubleshooting user guide.

How do I enable Logging using Azure API Management Services?

Review the APIMGMT - Logging user guide to enable Nodinite Logging with Azure API Management Service APIs.

How do I enable Logging using Azure Functions?

Review the Serilog user guide to enable Nodinite Logging with Azure Functions.

How do I monitor and log Azure Logic Apps?

Use the separate Azure Logic Apps Logging and Monitoring Agent; it has its own prerequisites. For Azure Service Bus, use the Message Queueing Agent; for Azure SQL, use the Database Monitoring Agent.

Next Steps

• Install the Azure agent
• Configure the Azure agent

Related Topics

• Azure Monitoring Agent
• Azure Monitoring features
• Azure Application Access - Least Privileges
• AMQP Port Configuration - 5671 and 5672
• Add or manage a Monitoring Agent Configuration
• Monitoring Agents
• Troubleshooting
• Administration
• Azure Role Deployment Automation