We are attempting to use Azure Network Watcher Connection Monitor to monitor connectivity to an Azure VM public IP address.

Hi Ritesh Purbey ,

You are using Azure Network Watcher – Connection Monitor to validate whether external/ISP users can reach an Azure VM public IP. Based on the product design and documentation, here are the key clarifications and troubleshooting steps.

1. Support for inbound connectivity from external ISP networks

Connection Monitor is a source-initiated synthetic monitoring tool. It tests connectivity from a defined source endpoint to a destination endpoint.

• Supported sources: Azure VMs, VM scale sets, or Arc-enabled on‑premises machines with the monitoring agent
• Supported destinations: IP addresses (including public IPs), FQDNs, URLs, Azure resources

This means:

• You can configure your Azure VM public IP as the destination
• However, the test results reflect connectivity from the configured source(s) only

Connection Monitor does not simulate arbitrary Internet or ISP-originated traffic. It cannot directly validate inbound reachability from external ISP networks unless you deploy a source endpoint representing those locations.

2. Agent requirement for external reachability validation

Connection Monitor requires a monitoring agent/extension on the source endpoint:

• Azure VMs require the Network Watcher extension
• On-premises machines must be Arc-enabled with Azure Monitor Agent

Without a source endpoint under your control, no probes are generated, and inbound reachability from external ISPs cannot be validated.

3. Prerequisites for monitoring public IP endpoints

Ensure the following prerequisites are met:

Source requirements

• Source VM is deployed and running
• Network Watcher extension installed
• Outbound connectivity to Azure Monitor

Azure configuration

• Network Watcher enabled in the region
• Log Analytics workspace configured for data collection

Destination requirements

• Destination can be a public IP address
• The tested protocol (TCP/ICMP/HTTP) must be listening/responding on the target port

4. Why the status shows “Unknown (?)”

In Connection Monitor, this typically corresponds to an Indeterminate state, which means:

No monitoring data is available in the Log Analytics workspace

Common causes of this condition:

• No valid source endpoint / agent missing
• Source VM is stopped or deallocated (no data during monitoring cycle)
• Network Watcher extension not installed or not functioning
• No telemetry reaching Log Analytics
• Misconfigured test group (invalid source/destination mapping)

5. Recommended diagnostics

To troubleshoot the “Unknown” state:

1. Verify source endpoint
   • Ensure the source VM exists, is running, and has the Network Watcher extension installed
2. Check Log Analytics data
   • Confirm metrics/logs are being generated for the Connection Monitor resource
3. Validate test configuration
   • Correct protocol (TCP/ICMP/HTTP)
   • Correct destination IP and port
   • Target service is listening
4. Run Connection Troubleshoot
   • Use Network Watcher → Connection troubleshoot for point-in-time validation
5. Review network controls
   • NSG rules, routes (UDR), firewall configuration
   • Ensure traffic is not blocked along the pathTo troubleshoot the “Unknown” state.

Refer: Azure Network Watcher – Connection Monitor overview

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please "Accept the answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Azure Network Watcher Connection Monitor is designed to test connectivity from an Azure-hosted source endpoint toward a destination endpoint. It is not intended to validate inbound reachability from arbitrary external ISP networks into an Azure VM public IP unless you control and deploy a monitoring source at the external location. In other words, Connection Monitor doesn't natively simulate “the Internet” or random ISP-originated traffic from outside Azure without an actual test agent or endpoint acting as the source.

Effectively, Connection Monitor does not directly support the scenario of validating whether external ISP users can reach your Azure VM public IP when no monitoring agent, VM, or supported endpoint exists at the external source location. The monitor requires a defined source endpoint. Supported sources are Azure VMs, Azure Arc-enabled machines, or other supported monitored endpoints where the Azure Monitor Agent and Network Watcher extension can operate. Without a source endpoint under your control, Connection Monitor is not able to generate the traffic needed to test inbound reachability from the ISP side.

For public IP monitoring, the prerequisites include having a supported source endpoint with Azure Monitor Agent installed, Network Watcher enabled in the region, proper outbound connectivity from the source, and correct NSG/firewall rules allowing the test protocol and ports. The destination can be a public IP, FQDN, Azure VM, or on-premises endpoint, but the source should be manageable by Azure Monitor. If using ICMP, TCP, or HTTP tests, the destination service needs to actually respond on the specified protocol and port. Additionally, the VM guest firewall, NSGs, Azure Firewall, load balancers, and ISP filtering must all allow the traffic path.

An Unknown status in Connection Monitor usually indicates the monitoring configuration has not successfully initialized or the source endpoint cannot execute the tests. Common causes include missing Azure Monitor Agent installation (which I gather is the culprit in your case), unsupported VM OS, Network Watcher not enabled in the region, extension provisioning failures, RBAC permission problems, blocked outbound access from the source VM to Azure Monitor endpoints, DNS resolution failures, or stale monitor configurations after resource changes. It can also occur when the test group has not yet completed initialization or when telemetry ingestion is delayed.

In general, to diagnose the Unknown state, you'd verify that the source VM appears healthy under Azure Monitor Agents and Extensions. This would involve confirming that both AzureMonitorWindowsAgent or AzureMonitorLinuxAgent and the Network Watcher Agent extension are installed and in a succeeded provisioning state. Then you'd verify Network Watcher is enabled in both source and destination Azure regions. You woudl also review the Connection Monitor “Topology” and “Test Groups” pages for endpoint resolution errors, agent health warnings, or failed configuration deployments. Another potential source of troubleshooting info could be Azure Activity Logs and the Network Watcher diagnostic logs, which could reveal extension deployment failures or authorization issues.

For your specific use case, you might want to consider other options such as Azure Application Insights availability tests, and Internet-facing synthetic monitoring through Azure Monitor. Application Insights availability tests can perform HTTP/HTTPS reachability checks from multiple Microsoft-managed global probe locations without requiring you to deploy agents externally.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin