1. You need standalone agent and this can be any Windows 2012 or later server joined to domain.
2. Make sure this Agent server has access to Azure.The following URLs must be accessible for cloud auditing to be fully functional:
* https://login.microsoftonline.com
* https://graph.windows.net
* https://graph.microsoft.com
* https://manage.office.com
* https://outlook.office365.com/powershell-liveid/
3. When you deploy the template, the agent logs into azure, creates a web application and only the agent has the keys to view the application. The azure logs get published to the application, the agent scrapes the application and copies the events and dumps into Change Auditor.