Virtual machine scale sets should have at least one VM instance
Azure VM scale sets with `0` VM instances are identified as empty. The Prowler check vm_scaleset_not_empty verifies that a Virtual Machine Scale Set has at least one VM instance.
Orphaned scale sets degrade governance and can hide stale autoscale or permissive identities. If reactivated, they may launch VMs from outdated images, exposing vulnerable services and enabling lateral movement, impacting confidentiality and availability. They also create inventory sprawl and unnecessary spend.
What this control checks
Virtual machine scale sets should have at least one VM instance
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_scaleset_not_empty (prowler azure --checks vm_scaleset_not_empty).
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_scaleset_not_empty - Prowler Check:
vm_scaleset_not_empty
Last reviewed: 2026-10-11