Getting started with On-Demand Assessments

Assessments are available through Services Hub to help you assess and optimize the availability, security, and performance of your on-premises, hybrid, and cloud Microsoft technology environments. These assessments use Microsoft Azure Log Analytics, which is designed to give you simplified IT and security management across your environment.

Note

On average, it takes two hours to initially configure your environment to run an On-Demand Assessment. After you run an assessment, you can review the recommendations in Azure Log Analytics. This will provide you with a prioritized list of recommendations, categorized across six focus areas. This permits you and your team to quickly understand risk levels, the health of your environments, act to decrease risk, and improve your overall IT health.

An offline copy of the On-Demand Assessment Setup Guide may be downloaded for reference.

On-Demand Assessment: Setup and Configuration Service

The On-Demand Assessment service is designed to unlock the full potential of your IT environment by providing ongoing analysis of your on-premises, hybrid, and cloud Microsoft technology landscape. Led by a Microsoft architect, this remote service ensures that your systems are running efficiently with the latest practices. The value of this service lies in its ability to give you a comprehensive view of your IT environment, identify potential issues and risks, and simplify IT and security management across your environment and is an included service. Talk to your CSAM to schedule your Setup and Configuration Service.

Use the following checklist to ensure all steps in this section are completed before moving onto the next section.

Note

The On-Demand Assessment was developed and tested using Windows Powershell 5.1. Using in any other versions of Powershell, including Powershell Core 7, can lead to unpredictable behavior during installation.

Subscription

On-Demand Assessments ingest their recommendations and supporting details into Log Analytics. The Azure Log Analytics service requires an Azure subscription owned by the organization. If there is already an Azure subscription, then a customer representative (their registered email address) with the required Azure Log Analytics access and/or Azure Subscription access will need to be invited to Services Hub workspace by the CSAM.

To utilize On-Demand Assessments (ODAs), customers must have access to an Azure subscription. The following options are available:

  1. Use an existing Azure subscription (Our guidance) Customers may leverage their current Azure subscription to run On-Demand Assessments.
  2. Create a new Azure subscription for ODAs under the customers EA agreement (Our guidance) Customers can provision a dedicated Azure subscription specifically for On-Demand Assessments if they do not want to use one that they already have.
  3. Explore other Azure trial offering (Credit Card required) Customers may consider alternative trial options available at Create your Azure Free Account or Pay as you Go

Note

Customers can choose to use any Azure Subscription for this purpose as long as the user has the required Azure Subscription and/or Log Analytics role to perform the required actions. The Azure Subscription can be an EA or Pay-As-You-Go or trial Azure subscriptions. Azure subscriptions created merely due to the presence of Office 365 licenses cannot be used as they don't have active azure credits.

Note

If you don’t know the Azure owner or other roles of your Azure subscriptions, follow this link: Role assignments in Azure Subscriptions.

Services Hub Registration

The user in your organization, who is the Microsoft Azure subscription owner must be invited to Services Hub workspace and complete their registration on Services Hub. Additionally, if the assessment will include a Microsoft engineer lead delivery, then the Microsoft engineer must also be invited to Services Hub workspace and complete their registration on Services Hub. Invites to Services Hub can be started by your organization’s Services Administrator, existing Services Hub users, or your Microsoft representative. To provide users access to On-Demand Assessments in Services Hub, your organization’s Services Administrator must grant these permissions by selecting the Health and Programs checkboxes in the Invite users dialog.

CSAM tasks

  1. The CSAM invites customer and CSA (for engineer led assessment deliveries). Log in to Services Hub using Microsoft Edge and go to Customer workspace -> Manage Users page.

  2. Add customers' email addresses and CSA with alias@Microsoft.com and ensure the Health role is selected to permit the user to see the IT Health page in Services Hub.

The Manage Users dialog showing Users at the top left, and a delete can on the right.

The Add users dialog showing email field, Health selected, and the Add users selection at the bottom.

Linking of the Azure Subscription and Log Analytics workspace to Services Hub workspace

  1. Log into Services Hub with the Azure subscription owner's credentials. In the Primary Navigation, select IT Health then select On-Demand Assessments.

  2. Select Get Started with Assessment.

The Linking Azure Subscription and Log Analytics workspace page with the Get Started with Assessment highlighted.

Note

a. Get Started with Assessment - This button is available only if your Services Hub workspace has not yet been linked to any Log Analytics workspace. It typically appears when you're linking a Log Analytics workspace to Services hub for > the first time.

b. Edit Log Analytics Workspace - If a Log Analytics workspace has already been linked to your Services Hub workspace, you'll see the Edit Log Analytics Workspace option instead of the Get Started with Assessment button.

  1. Select the desired Azure subscription from the list and choose next.

The Preconfigure Assessments page with the Choose Your Azure Subscription step highlighted.

Organizations that have an Azure subscription but lack the required permissions will need to work with your company's Services Admin, CSAM, or Support Account Coordinator to have the customer representative with the required permissions within Azure register on Services Hub and preconfigure your assessments.

  1. Choose the Azure Log Analytics workspace that the assessment(s) you choose will be added in or use "Create New" to create a dedicated workspace for the assessment(s) if desired. Then select next.

The Enable Assessments page.

Note

An Azure Log Analytics workspace may also be created from Azure using the steps documented in the How to Create new Azure Log Analytics Workspace from Azure article.

  1. At the conclusion of the linking process, select “View assessments."

The View Assessments button.

Note

If you have some policy definitions set up on Subscription, make sure you have allowed Microsoft.OperationalInsights and Microsoft.OperationsManagement resource types for linking to work.

Please Follow instructions to register the resource provider.

Resource Providers information

Add the Assessments in Services Hub

Warning

Follow the setupassessment.pdf document's instructions before proceeding to add the assessment.

To configure an assessment, go to Services Hub, IT Health, and On-Demand Assessments. Browse through the assessment catalog and select "Add Assessment" to add the assessment that best fits your organization’s needs.

Select an assessment of your choice from the list of available assessments, provide the required details and click on Add Assessment.

The View Assessments.

You will be able to see the assessment tile added to AMA on top navigation section of assessment. You are now all set for next steps.

The Available On-Demand Assessments page with the Active Directory assessment highlighted.

  1. In step 1, select your desired Data Collection machine (Azure Arc or Azure VM) from the list of machines available.
  2. Enter the working directory path details in step 2.

The Working directory is a folder located on the data collector machine that contains all the files related to the assessment generated after its execution. In simple terms, it is the folder which you have created while adding the assessment task in data collector machine.

The Active Directory assessment dialog with the Add Assessment button highlighted.

You will be able to see the assessment tile added to AMA on top navigation section of assessment. You are now all set for next steps

Providing Access to Azure Log Analytics workspace

Granting access to the Log Analytics workspace to Microsoft personnel is necessary for CSA led deliveries of On-Demand Assessments and must be completed by the Azure subscription owner. We recommend you add users as a Log Analytics Reader role at Azure Subscription level to grant @microsoft.com users access to your Azure Log Analytics workspace to view your assessments. In case of any security concerns with subscription, provide both Log Analytics Reader at Azure Arc/VM level and Log Analytics Reader at Log Analytics workspace level explicitly.

For help with common issues with Assessment setup, refer to Troubleshooting the On-Demand Assessments (AMA) | Microsoft Learn

Note

This step is not required for self-consumption of assessments without CSA led delivery.

TROUBLESHOOTING:

For help with common issues with Assessment setup, refer toTroubleshooting the On-Demand Assessments (AMA) | Microsoft Learn

Need more help?

If you have additional questions or run into issues, simply open a support case with the Services Hub Support team at: 👉 https://aka.ms/ServicesHubSupport

  • Last updated on