microsoft · rakal-dyh · May 5, 2026 · Apr 21, 2026 · Apr 27, 2026 · Apr 27, 2026
@@ -1,6 +1,6 @@
 ---
 name: azure-compute
-description: "Azure VM and VMSS router for recommendations, pricing, autoscale, orchestration, connectivity troubleshooting, and capacity reservations. WHEN: Azure VM, VMSS, scale set, recommend, compare, server, website, burstable, lightweight, VM family, workload, GPU, learning, simulation, dev/test, backend, autoscale, load balancer, Flexible orchestration, Uniform orchestration, cost estimate, connect, refused, Linux, black screen, reset password, reach VM, port 3389, NSG, troubleshoot, capacity reservation, CRG, reserve VMs, guarantee capacity, pre-provision capacity, CRG association, CRG disassociation."
+description: "Azure VM and VMSS router for recommendations, pricing, autoscale, orchestration, connectivity troubleshooting, capacity reservations, and Essential Machine Management. WHEN: Azure VM, VMSS, scale set, recommend, compare, server, website, burstable, lightweight, VM family, workload, GPU, learning, simulation, dev/test, backend, autoscale, load balancer, Flexible orchestration, Uniform orchestration, cost estimate, connect, refused, Linux, black screen, reset password, reach VM, port 3389, NSG, troubleshoot, capacity reservation, CRG, reserve VMs, guarantee capacity, pre-provision capacity, CRG association, CRG disassociation, essential machine management, EMM, machine enrollment."
 license: MIT
 metadata:
   author: Microsoft
@@ -20,6 +20,7 @@ Activate this skill when the user:
 - Mentions VM families, autoscale, load balancing, or Flexible versus Uniform orchestration
 - Wants to troubleshoot Azure VM connectivity issues such as unreachable VMs, RDP/SSH failures, black screens, NSG/firewall issues, or credential resets
 - Asks about Capacity Reservation Groups (CRGs), reserving VM capacity, associating/disassociating VMs with a CRG, or guaranteeing compute capacity
+- Asks about Essential Machine Management (EMM), machine enrollment, onboarding VMs for monitoring/security, or enabling machine management at subscription level
 - Uses prompts like "Help me choose a VM"
 
 ## Routing
@@ -35,15 +36,19 @@ User intent?
 ├─ Capacity reservation / CRG / reserve capacity / associate VM with CRG
 │  └─ Route to [Capacity Reservation](workflows/capacity-reservation/capacity-reservation.md)
 │
+├─ Essential Machine Management / EMM / machine enrollment
+│  └─ Route to [Essential Machine Management](workflows/essential-machine-management/essential-machine-management.md)
+│
 └─ Unclear
-   └─ Ask: "Are you looking for a VM recommendation, troubleshooting a connectivity issue, or managing capacity reservations?"
+   └─ Ask: "Are you looking for a VM recommendation, troubleshooting a connectivity issue, managing capacity reservations, or enabling Essential Machine Management?"
 ```
 
 | Signal                                                                        | Workflow                                                                                   |
 | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
 | "recommend VM", "which VM", "VM size", "VM pricing", "VMSS", "scale set"     | [VM Recommender](workflows/vm-recommender/vm-recommender.md)                               |
 | "can't connect", "RDP", "SSH", "NSG blocking", "reset password", "black screen" | [VM Troubleshooter](workflows/vm-troubleshooter/vm-troubleshooter.md)                   |
 | "capacity reservation", "CRG", "reserve capacity", "guarantee capacity", "associate VM with CRG" | [Capacity Reservation](workflows/capacity-reservation/capacity-reservation.md) |
+| "essential machine management", "EMM", "machine enrollment" | [Essential Machine Management](workflows/essential-machine-management/essential-machine-management.md) |
 
 > **Routing rule:** Always read the matched workflow file before accessing any reference files. The workflow file contains the step-by-step guidance and the reference routing table for the user's request.
 
@@ -54,4 +59,5 @@ User intent?
 | **VM Recommender**        | Recommend VM sizes, VMSS, pricing using public APIs/docs | [vm-families](references/vm-families.md), [retail-prices-api](references/retail-prices-api.md), [vmss-guide](references/vmss-guide.md), [vm-quotas](references/vm-quotas.md) |
 | **VM Troubleshooter**     | Diagnose and resolve VM connectivity failures (RDP/SSH)  | [cannot-connect-to-vm](workflows/vm-troubleshooter/references/cannot-connect-to-vm.md) |
 | **Capacity Reservation**  | Create and manage Capacity Reservation Groups (CRGs)     | [capacity-reservation-overview](workflows/capacity-reservation/references/capacity-reservation-overview.md), [association-disassociation](workflows/capacity-reservation/references/association-disassociation.md) |
+| **Essential Machine Management** | Enable and manage EMM for subscription-level VM onboarding | [emm-overview](workflows/essential-machine-management/references/emm-overview.md), [emm-prerequisites](workflows/essential-machine-management/references/emm-prerequisites.md), [emm-enable-flow-portal-guidance](workflows/essential-machine-management/references/emm-enable-flow-portal-guidance.md), [emm-enable-flow](workflows/essential-machine-management/references/emm-enable-flow.md) |
 
@@ -0,0 +1,98 @@
+# Essential Machine Management (EMM) Workflow
+
+Routes EMM-related requests to the appropriate reference based on user intent.
+
+## Overview
+
+Essential Machine Management simplifies onboarding and configuration of management for Azure VMs and Arc-enabled servers at the subscription level. When enabled, all VMs in a subscription are automatically enrolled with a curated set of monitoring, security, and operations features.
+
+> ⚠️ **Warning:** EMM is currently in **public preview**.
+
+## Routing
+
+```text
+User intent?
+├─ Enable / onboard / enroll subscription for EMM
+│  └─ Copilot-guided (default) → Load [EMM Enable Flow](references/emm-enable-flow.md)
+│
+├─ User explicitly asks for portal guidance
+│  └─ Load [EMM Enable Flow (Portal)](references/emm-enable-flow-portal-guidance.md)
+│
+├─ What is EMM / features / pricing / tiers
+│  └─ Load [EMM Overview](references/emm-overview.md)
+│
+├─ Prerequisites / permissions / roles / managed identity
+│  └─ Load [EMM Prerequisites](references/emm-prerequisites.md)
+│
+├─ View enrolled subscriptions / browse / status
+│  └─ See "Browse Enrolled Subscriptions" below
+│
+├─ Offboard / disable EMM for a subscription
+│  └─ See "Offboard a Subscription" below
+│
+└─ Troubleshoot EMM issues
+   └─ See "Troubleshooting" below
+```
+
+| Signal | Reference |
+| ------ | --------- |
+| "enable EMM", "onboard subscription", "enroll VMs", "set up machine management" | [EMM Enable Flow](references/emm-enable-flow.md) |
+| User explicitly mentions "portal", "Azure portal", "portal UI" | [EMM Enable Flow (Portal)](references/emm-enable-flow-portal-guidance.md) |
+| "what is EMM", "features", "pricing", "tiers", "what does EMM include" | [EMM Overview](references/emm-overview.md) |
+| "permissions", "roles", "prerequisites", "managed identity for EMM" | [EMM Prerequisites](references/emm-prerequisites.md) |
+
+> ⚠️ **Important:** Only route to the portal guide when the user explicitly mentions "portal". All other enable requests use the Copilot-guided flow.
+
+## Browse Enrolled Subscriptions
+
+Query the EMM resource on each subscription to check enrollment status:
+
+```text
+GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.ManagedOps/managedOps/default?api-version=2025-07-28-preview
+```
+
+| Response | Meaning |
+| -------- | ------- |
+| `200` with `provisioningState: Succeeded` | Subscription is enrolled |
+| `200` with `provisioningState: Failed` | Enrollment attempted but failed — check error details |
+| `404` | Subscription is not enrolled |
+
+When enrolled, the response includes:
+- **SKU/tier** — e.g. Essential
+- **Enabled services** — Azure Monitor Insights, Update Manager, Change Tracking, Policy & Machine Configuration, Defender CSPM, Defender for Servers
+- **UAMI** — the user-assigned managed identity resource ID
+- **Workspaces** — Log Analytics and Azure Monitor workspace resource IDs
+- **Created by / date** — who enrolled and when (in `systemData`)
+
+To scan multiple subscriptions, use `mcp_azure_mcp_subscription_list` to list available subscriptions, then query each one. Report results as a table:
+
+```text
+| Subscription | Status | SKU | Services Enabled |
+```
+
+## Offboard a Subscription
+
+To disable EMM for a subscription, follow the "Disable EMM (Offboard)" section in [EMM Enable Flow](references/emm-enable-flow.md).
+
+> ⚠️ **Warning:** When you disable a subscription, machines no longer use consolidated pricing. Pricing reverts to standard per-service pricing which may increase costs. Existing VM configurations are not removed — disable unneeded services manually.
+
+## Troubleshooting
+
+For common EMM issues, refer to the official documentation:
+- [Troubleshoot Essential Machine Management (Preview)](https://learn.microsoft.com/en-us/azure/operations/configuration-enrollment-troubleshoot)
+
+Common issues include:
+- Missing role assignments (EMM Administrator, Managed Identity Operator, Resource Policy Contributor)
+- Resource provider `Microsoft.ManagedOps` not registered in the subscription
+- UAMI lacking Contributor permission on the subscription
+- Cross-subscription workspace access requires additional RP registration
+
+## Error Handling
+
+| Error | Cause | Remediation |
+| ----- | ----- | ----------- |
+| Permission denied during enable | User lacks required roles | Assign EMM Administrator, Managed Identity Operator, and Resource Policy Contributor roles |
+| UAMI role check fails | Managed identity lacks Contributor | Assign Contributor role to the UAMI at subscription scope |
+| RP not registered | `Microsoft.ManagedOps` not registered | Register via `Register-AzResourceProvider -ProviderNamespace "Microsoft.ManagedOps"` |
+| Cross-subscription workspace error | Workspace in different sub without RP registration | Register `Microsoft.ManagedOps` in the workspace subscription and assign EMM Administrator on the workspace resource group |
+| Deployment fails | ARM template validation error | Check deployment link in browse view for detailed error; verify all prerequisites |
@@ -0,0 +1,76 @@
+# EMM Enable Flow (Portal)
+
+Step-by-step guide for enabling Essential Machine Management through the Azure portal UI.
+
+## Quick Reference
+
+| Property | Value |
+| -------- | ----- |
+| Portal blade | `EnableMachineManagement.ReactView` |
+| Extension | `Microsoft_Azure_Computehub` |
+| Portal path | Compute infrastructure → Monitoring+Operations → Essential Machine Management → Enable |
+| Resource type | `Microsoft.ManagedOps/ManagedOps` |
+
+## Enable Flow Steps
+
+The portal enable flow is a multi-tab wizard with 4 tabs:
+
+### Tab 1: Scope
+
+Select the target subscription and managed identity.
+
+| Field | Description | Required |
+| ----- | ----------- | -------- |
+| Subscription | The subscription to enable EMM for. Shows VM and Arc machine counts per subscription. | ✅ |
+| User-assigned managed identity | UAMI with Contributor on the subscription. Used for onboarding VMs. | ✅ |
+
+**Validation displayed:**
+- Required user role assignments vs current user role assignments
+- Required UAMI role assignments vs current UAMI role assignments
+
+> 💡 **Tip:** If roles are missing, the UI shows exactly which roles are needed. Assign them before proceeding.
+
+### Tab 2: Configure
+
+Select or create the monitoring workspaces.
+
+| Field | Description | Required |
+| ----- | ----------- | -------- |
+| Log Analytics workspace | Collects log data (Change Tracking & Inventory). Can create new inline. | ✅ |
+| Azure Monitor workspace | Collects metrics data (VM Insights). Can create new inline. | ✅ |
+
+**Notes:**
+- Workspaces can be in a different subscription than the one being enabled
+- If cross-subscription, additional RP registration and role assignments are needed (see [Prerequisites](emm-prerequisites.md))
+
+### Tab 3: Security
+
+Optional security add-ons.
+
+| Feature | Description | Cost |
+| ------- | ----------- | ---- |
+| Foundational CSPM | Agentless, risk-prioritized cloud security posture insights. Always included. | Free |
+| Defender CSPM | Advanced CSPM with attack path analysis. Optional toggle. | Paid |
+| Defender for Cloud | Comprehensive server protection with EDR, vulnerability management, file integrity monitoring. Optional toggle. | Paid |
+
+### Tab 4: Review & Enable
+
+Displays a summary of all selections:
+- Included features (always: Azure Monitor VM Insights, Azure Policy & Machine Configurations, Change Tracking & Inventory, Azure Update Manager)
+- Selected scope (subscription, UAMI)
+- Configure selections (Log Analytics workspace, Azure Monitor workspace)
+- Security add-ons enabled
+- Pricing information with links
+
+Clicking **Enable** triggers:
+1. Resource provider registrations on the target subscription
+2. Cross-subscription RP registration if workspaces are in a different subscription
+3. Subscription-level ARM template deployment
+
+## What Happens After Enable
+
+- A deployment is created: `ManagedOps_{uamiName}_{subscriptionId}`
+- Policy assignments are created to configure all VMs in the subscription
+- Remediation tasks are created for existing VMs
+- New VMs added to the subscription are automatically enrolled
+- The subscription appears in the browse view with status "Succeeded"