Virtual machines should use an approved custom image
Azure VMs are evaluated for use of an approved custom image by inspecting the VM image reference. The expected format is a subscription-scoped ID like `/subscriptions/.../providers/Microsoft.Compute/images/<image>`, not marketplace, gallery, or community sources.
Using unapproved images undermines integrity and confidentiality by introducing unknown packages, misconfigurations, or malware. Attackers can implant backdoors, weaken hardening, and bypass baselines, enabling data exfiltration and lateral movement, and harming availability with unpatched software.
What this control checks
Virtual machines must be created from an approved custom image
Common pitfalls
Image ID must be subscription-scoped
The expected format is a subscription-scoped ID like /subscriptions/.../providers/Microsoft.Compute/images/<image>, not marketplace, gallery, or community sources.
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_ensure_using_approved_images (prowler azure --checks vm_ensure_using_approved_images).
Framework-specific interpretation
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-1-1 (Annex I (1.1) - UCBs should maintain an up-to-date business IT Asset Inventory Register containing the following...).
BSI C5:2025: Mapped to OPS-26.03B (If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the...) and PSS-11.01B (If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider...).
Framework mappings
The clauses this control is mapped to in each framework.
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- OPS-26.03B If non-modifiable ('immutable') images are used, compliance with the hardening specifications, as defined in the hardening requirements, is checked upon creation of the images.
- PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_ensure_using_approved_images - Prowler Check:
vm_ensure_using_approved_images
Last reviewed: 2026-10-11