Virtual machines should have disaster recovery configured
Audit virtual machines which do not have disaster recovery configured. The Azure Policy definition applies to `Microsoft.Compute/virtualMachines` and `Microsoft.ClassicCompute/virtualMachines`.
What this control checks
Virtual machines need disaster recovery configured, shown by a link named ASR-Protect-*.
Common pitfalls
Needs an ASR-Protect-* link resource
The policy uses auditIfNotExists with a Microsoft.Resources/links resource. The existenceCondition requires a name like ASR-Protect-*.
Applies to classic VMs too
The policy applies to Microsoft.Compute/virtualMachines and Microsoft.ClassicCompute/virtualMachines.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit virtual machines without disaster recovery configured" (0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56); PowerPipe control azure_compliance.control.compute_vm_disaster_recovery_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CP-7 (Alternate Processing Site).
FedRAMP Moderate Baseline Rev 4: Mapped to CP-7 (Alternate Processing Site).
Framework mappings
The clauses this control is mapped to in each framework.
- CP-7 Alternate Processing Site
FedRAMP Moderate Baseline Rev 4
- CP-7 Alternate Processing Site
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.4 Recovery strategy / Contingency Plan
- CP-7 Alternate Processing Site
- 1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management
- 1638.12b2Organizational.345-12.b 12.01 Information Security Aspects of Business Continuity Management
Related controls
- Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed
- Virtual machines should have a vulnerability assessment solution enabled
- Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_disaster_recovery_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_disaster_recovery_enabled - Azure Policy Definition:
0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56
Last reviewed: 2026-10-11