---
title: "Microsoft Azure collector"
canonical: "https://docs.devo.com/space/latest/94656498/Microsoft%20Azure%20collector"
format: markdown
---
> Macro (toc)

## Purpose

The [Microsoft Azure](https://azure.microsoft.com/en-us/) collector gets data from Azure cloud computing services.  Common uses are:

- Detect malicious [Entra ID](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063647) authentication
- Detect malicious [role, policy, and group](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198686237) changes impacting cloud infrastructure
- Correlate [risky users](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk) identified by Entra ID with data you have in Devo
- Detect malicious Application Gateway traffic
- Detect failures and measure costs of [virtual machines](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063727)


## Run It

The Azure Collector has two services:

- [VM Metrics](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198063727), for Virtual Machines
- [Event Hub](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198522408), for everything else in Azure

These services should be enabled in separate collector instances.


## Devo collector features

| **Features** | **Details** |
| --- | --- |
| Allow parallel downloading (`multipod`) | The vm_metrics service cannot work in multipod mode. If you want to use the event_hubs service in multipod mode, you must not include a vm_service in the same collector. |
| Populated Devo events | - `table` |
| Flattening pre-processing | - `no` |
| Allowed source events obfuscation | - `yes` |