Windows virtual machines should have the Windows Guest Configuration extension installed for assignments
This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The extension is a prerequisite for all Windows Guest Configuration assignments.
What this control checks
Azure Policy check 385f5831-96d4-41db-9a3c-cd3af78aaae6 applies to resources of type Microsoft.Compute/virtualMachines, and its effect is deployIfNotExists. The powerpipe check compute_vm_guest_configuration_installed_windows carries the title "Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs".
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- IA-5 (1): Password-Based Authentication
- IA-5(1) Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- 3.5.8: Prohibit password reuse for a specified number of generations.
- 3.5.10 Store and transmit only cryptographically-protected passwords
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_installed_windows - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_installed_windows - Azure Policy Definition:
385f5831-96d4-41db-9a3c-cd3af78aaae6
Last reviewed: 2026-10-11