Linux virtual machines should have the Linux Guest Configuration extension installed for assignments
This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The extension is a prerequisite for all Linux Guest Configuration assignments.
What this control checks
Azure Policy 331e8ea8-378a-410f-a2e5-ae22f38bb0da checks resources of type Microsoft.Compute/virtualMachines and uses Microsoft.Compute/imagePublisher and storageProfile.osDisk.osType (like Linux*) to find Linux VMs. Azure Policy ae89ebca-1c92-4898-ac2c-9f63decb045c checks Microsoft.Compute/virtualMachines and has an effect parameter with allowed values AuditIfNotExists and Disabled, defaulting to AuditIfNotExists.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Access Enforcement (AC-3)
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.10 Store and transmit only cryptographically-protected passwords
- AC-3 Access Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_installed_linux - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_installed_linux - Azure Policy Definitions:
331e8ea8-378a-410f-a2e5-ae22f38bb0da,ae89ebca-1c92-4898-ac2c-9f63decb045c
Last reviewed: 2026-10-11