Virtual machines should have the Guest Configuration extension installed
To ensure secure configurations of in-guest settings of your machine, install the Guest Configuration extension. The extension monitors the configuration of the operating system, application configuration or presence, and environment settings.
To ensure secure configurations of in-guest settings of your machine, install the Guest Configuration extension.
What this control checks
Guest Configuration extension should be installed on your machines
Common pitfalls
Effect allows only AuditIfNotExists or Disabled
The effect parameter allows AuditIfNotExists or Disabled. The effect defaults to AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Guest Configuration extension should be installed on your machines" (ae89ebca-1c92-4898-ac2c-9f63decb045c); PowerPipe control azure_compliance.control.compute_vm_guest_configuration_installed.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6(4) (Central Review and Analysis) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.), ID.AM-02 (Inventories of software, services, and systems managed by the organization are maintained.) and ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.).
FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation) and SI-4 (Information System Monitoring).
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- ID.AM-02
- ID.RA-09
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- SI-4: Information System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- SI.L2-3.14.7 Identify unauthorized use of organizational systems
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- SI-4 Information System Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_installed - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_installed - Azure Policy Definition:
ae89ebca-1c92-4898-ac2c-9f63decb045c
Last reviewed: 2026-10-11