Windows virtual machines should have the Windows Guest Configuration extension installed for assignments
This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration. The extension is a prerequisite for all Windows Guest Configuration assignments.
The Windows Guest Configuration extension is a prerequisite for all Windows Guest Configuration assignments. It must be deployed to machines before using any Windows Guest Configuration policy definition.
What this control checks
Windows VMs need the Windows Guest Configuration extension, a prerequisite for Guest Configuration.
Common pitfalls
Only VMs supported by Guest Configuration
This policy deploys the Windows Guest Configuration extension to Windows virtual machines hosted in Azure that are supported by Guest Configuration.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Deploy the Windows Guest Configuration extension to enable Guest Configuration assignments on Windows VMs" (385f5831-96d4-41db-9a3c-cd3af78aaae6); PowerPipe control azure_compliance.control.compute_vm_guest_configuration_installed_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), IA-5 (Authenticator Management) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), IA-5 (Authenticator Management) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- IA-5 (1): Password-Based Authentication
- IA-5(1) Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- 3.5.8: Prohibit password reuse for a specified number of generations.
- 3.5.10 Store and transmit only cryptographically-protected passwords
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_installed_windows - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_installed_windows - Azure Policy Definition:
385f5831-96d4-41db-9a3c-cd3af78aaae6
Last reviewed: 2026-10-11