Contoso's network operations team needs to use Azure Monitor Network Insights to investigate intermittent VNet-to-VNet latency and to view flow maps across peered VNets. The subscription currently has Network Watcher enabled but no Log Analytics workspace for network monitoring. What must the team enable/configure to get VNet health, flow map visualization, and diagnostic insights in Network Insights?

To use Azure Monitor Network Insights for VNet health and flow maps, you must enable Network Watcher, which is already done. The critical missing components are NSG flow logs (v2) with Traffic Analytics enabled, and a Log Analytics workspace to ingest this data. Network Insights leverages Traffic Analytics data to visualize network topology and traffic flows. Installing Azure Security Center Standard tier or enabling NPM alone will not provide the necessary flow data and insights for Network Insights. Deploying NVAs is a different solution for traffic inspection, not directly for enabling Network Insights' built-in flow mapping.