Azure Compliance ControlsMicrosoft Defender for Cloud
Virtual machines should have endpoint protection installed
Azure virtual machines are assessed for the presence of an endpoint protection (antimalware) solution and its reported health across the subscription. Prowler check defender_assessments_vm_endpoint_protection_installed covers this. Its severity is high.
What this control checks
Virtual machines have endpoint protection installed
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 8.1.3.3 Ensure that 'Endpoint protection' component status is set to 'On'
RBI Cyber Security Framework for UCBs
- Annex I (6)
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- 7.6 Ensure that Endpoint Protection for all Virtual Machines is installed
- 7.6 Ensure that Endpoint Protection for all Virtual Machines is installed
- 8.8 Ensure that Endpoint Protection for all Virtual Machines is installed
- 164.308(a)(5)(ii)(B): Administrative Safeguards
Related controls
- Windows Azure Arc machines should have the Log Analytics extension installed
- Unprotected Azure SQL servers should have Azure Defender for SQL enabled
- Virtual machine scale sets should have resource logs enabled
- Virtual machines should use Azure Resource Manager resources
- Virtual machine network interfaces should have IP forwarding disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_defender_assessments_vm_endpoint_protection_installed - Prowler Check:
defender_assessments_vm_endpoint_protection_installed
Last reviewed: 2026-10-11