Azure Compliance ControlsAzure Virtual Machines
Virtual machines should have disaster recovery configured
Audit virtual machines which do not have disaster recovery configured.
What this control checks
Virtual machines need disaster recovery configured, shown by a link named ASR-Protect-*.
Framework mappings
The clauses this control is mapped to in each framework.
- CP-7 Alternate Processing Site
FedRAMP Moderate Baseline Rev 4
- CP-7 Alternate Processing Site
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.4 Recovery strategy / Contingency Plan
- CP-7 Alternate Processing Site
- 1634.12b1Organizational.1-12.b 12.01 Information Security Aspects of Business Continuity Management
- 1638.12b2Organizational.345-12.b 12.01 Information Security Aspects of Business Continuity Management
Related controls
- Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed
- Virtual machines should have a vulnerability assessment solution enabled
- Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_disaster_recovery_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_disaster_recovery_enabled - Azure Policy Definition:
0015ea4d-51ff-4ce3-8d8c-f3f8f0179a56
Last reviewed: 2026-10-11