Microsoft will retire the preview capability “Send virtual machine client data to Event Hubs and Storage” in Azure Monitor on July 31, 2026, the company confirmed through Azure Advisor notifications. The change affects any data collection rule (DCR) of kind AgentDirectToStore that pushes guest operating system telemetry from Windows and Linux VMs directly to Azure Event Hubs or Azure Storage, bypassing a Log Analytics workspace. Teams that rely on this path for security, compliance, analytics, or archiving have just over a year to inventory their dependencies, test replacements, and cut over before the pipeline goes dark.

What’s actually retiring — and what isn’t

The retirement is specific: only the preview “AgentDirectToStore” destination for Azure Monitor Agent (AMA) goes away. AMA itself continues to collect CPU counters, Event Log entries, IIS logs, and custom performance data from your servers. Associated components like Data Collection Rules, associations, and the agent lifecycle remain unchanged.

What vanishes is the ability to configure a DCR with kind AgentDirectToStore that writes guest data straight to an Event Hub or Storage blobs. Any existing rule of that kind will stop delivering data after July 31, 2026. You’ll need a different route for the same payloads.

The official advisory — first visible in Azure Advisor retirement workbooks and on the Azure Updates roadmap — does not deprecate any other AMA destination. Diagnostic settings, which handle Azure platform logs and metrics, are not part of this retirement.

Why this deadline matters for your Azure environment

If you use an AgentDirectToStore DCR, its output likely lands in a critical downstream system: a SIEM like Sentinel or Splunk, an Azure Data Explorer cluster for operational analytics, a third-party monitoring tool, or an immutable compliance archive. A silent failure after July 2026 would break those integrations, leaving a gap in your security visibility or audit trail.

Even if you actively monitor AMA health, that metric won’t surface this break. The agent will report “healthy,” but packets destined for the retiring path simply stop. Operations teams must instead trace the full data pipeline from VM to final consumption.

On the operational side, the retirement coincides with other Azure lifecycle and networking changes that WindowsForum users have flagged this year, such as the upcoming end of Azure’s default outbound access and Reserved VM Instance retirement options. Multiple uncoordinated migration projects can strain ops bandwidth. Treating this as a standalone lifecycle entry risks triaging it into a corner, whereas building an owned, end-to-end migration plan reduces that risk.

How we got here: the preview that never graduated

AgentDirectToStore first appeared as a preview alternative for customers who wanted to route guest OS telemetry to Event Hubs or Storage without landing in a Log Analytics workspace first. For scenarios like feeding a third-party SIEM already connected to Event Hubs, or writing raw logs directly into a lake for ad-hoc analysis, it simplified architecture.

But the capability remained in preview. Microsoft never documented an equivalent direct path from AMA to Azure Data Explorer, nor did it move the feature to general availability. Over time, the product team has steered ingestion strategies toward Log Analytics as a central hub, with built-in data export as the recommended bridge to external destinations. The retirement aligns with that architectural preference.

Importantly, the preview tag means the feature shipped without formal support guarantees or long-term stability commitments. Anyone who built production pipelines on a preview feature accepted the risk of future discontinuation. Now that risk is concrete.

What you need to do now: a phased migration guide

There is no single-switch replacement. The right path depends entirely on what your DCR feeds. Use the following classification to map your migration.

1. Inventory every affected rule, not just every agent

Agent health is a red herring. Instead, find all DCRs of kind AgentDirectToStore. Azure Advisor should surface these under service retirement recommendations; but verify manually too. In the portal, navigate to Monitor > Data Collection Rules, open each suspect DCR, view its JSON definition, and confirm the top-level kind field equals AgentDirectToStore. For a multi-subscription scan, use Azure Resource Graph Explorer:

resources
| where type =~ "microsoft.insights/datacollectionrules"
| where kind =~ "AgentDirectToStore"
| project subscriptionId, resourceGroup, name, location, id
| order by subscriptionId asc, resourceGroup asc, name asc

For each match, document the attached VMs, selected data sources (event channels, counters, logs), the destination Event Hub or Storage account, and the final consumer. Two rules pointing to Event Hubs may serve unrelated purposes (SIEM enrichment vs. ADX ingestion); a Storage destination might be a buffer or a compliance archive. Separate the architectures before picking a replacement.

2. Map each rule to one of three replacement strategies

A. If the final consumer is a SIEM, monitoring tool, or any service that expects data from an Event Hub
Switch to a Log Analytics workspace as an intermediate hop, then use a workspace data export rule to forward to the existing Event Hub or Storage. This is the documented, generally available method for getting guest telemetry out of the Microsoft ecosystem. The sequence:
- Create or identify an AMA DCR that sends the same guest data to a Log Analytics workspace.
- Verify that the required tables (Event, Perf, W3CIISLog, etc.) are populated correctly.
- Confirm that every table is on the list of exportable types. Not all workspace tables support data export; check Microsoft’s table eligibility documentation.
- Create a data export rule on the workspace targeting your Event Hub namespace or Storage account. Watch the hard limit of 10 active export rules per workspace. Consolidate tables only when owners, retention policies, and access controls align.
- Test end to end: generate known test events, confirm they appear in the downstream consumer with correct timestamps, schemas, and counts.
- Monitor export health via workspace metrics and set alerts for delivery failures.

B. If the final consumer is Azure Data Explorer (ADX)
Do not assume a direct AMA-to-ADX pipeline exists. The retirement notice offers no such successor. Instead, treat ADX ingestion as a design decision. Consult current Microsoft documentation to determine the supported architecture for ingesting guest OS telemetry into ADX. Likely options include:
- AMA → Log Analytics → data export → Event Hub → ADX (via Event Hub ingestion)
- AMA → Log Analytics → data export → Storage → ADX (via blob ingestion)
- Possibly a managed streaming pipeline using Azure Data Factory or Stream Analytics; validate against exact ADX connector docs.
Before choosing, verify region availability, managed-identity setup, required DCR transformations, table schema mapping, and throughput limits. Run a side-by-side test: let both old and new paths run in parallel, compare record counts and content over several time windows. An ADX connection succeeding may not guarantee every record your old DCR selected arrives intact.

C. If the destination is an immutable compliance archive
Start with the compliance requirements, not the Azure configuration. The archival must be immutable, with defined retention, access controls, and legal-hold capabilities. Use the same Log Analytics → data export path to a Storage account, but then apply storage-level governance:
- Enable version-level immutability or container-level policy as mandated by your organization.
- Set the appropriate retention period and configure access controls (RBAC, SAS, networking).
- Validate that export writes all necessary tables; if a required table isn’t exportable, explore alternatives like exporting to Event Hub and then to Storage via a function app.
- Reconcile archives by comparing source workspace records with blobs, verifying completeness and timestamps.
- Document the evidence package for auditors: table eligibility list, successful export monitor, destination immutability settings, reconciliation logs, and named operational ownership.

3. Validate, then cut over

Run old and new paths in parallel for at least two normal business cycles. Compare counts, not individual samples. Test failure modes: what happens if the export rule hits a throttle, or the destination Event Hub runs out of capacity? Validate that your monitoring alerts on destination failures. For archives, test retrieval and immutability enforcement.

Only after the data owner signs off, disable the AgentDirectToStore rule. Keep the old configuration (or a snapshot) until post-cutover audits verify no data loss. Document rollback instructions in case of unexpected downstream materalization—though after July 31, 2026, rollback will be impossible.

Diagnostic settings are not the answer

A common misconception: “I’ll just point diagnostic settings at my Event Hub to replace the agent-based stream.” Diagnostic settings collect Azure platform telemetry (resource logs, activity logs, metrics — things like VM heartbeat, network flow data, platform events). They do not capture Windows Event Logs, performance counters, or custom application logs that AMA gathers inside the guest OS. You’ll likely need both: diagnostic settings for platform visibility, and the AMA+Log Analytics+export route for guest data. A mixed environment is normal; don’t treat them as interchangeable.

Outlook: no more surprises

The retirement is a reminder that Azure’s preview features carry no longevity promise. As Microsoft continues to mature its monitoring stack, operations teams should audit any other preview DCR kinds or ingestion paths for similar withdrawals. The move to Log Analytics as the central pivot is unlikely to reverse. Expect future investments — better export controls, more exportable tables, simplified ADX integration — to orbit around the workspace. For now, the countdown clock is at 13 months; inventorying affected rules this week is the first step toward a boring, uneventful July 2026.