Virtual machines with no identities should use system-assigned managed identity for Guest Configuration assignments

Adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration but do not have any managed identities. A system-assigned managed identity is a prerequisite for all Guest Configuration assignments.

A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. The Guest Configuration extension requires a system assigned managed identity.

What this control checks

VMs supported by Guest Configuration with no managed identity get a system-assigned managed.

Common pitfalls

VMs with the extension but no system identity fail

Azure virtual machines in the scope of this policy will be non-compliant when they have the Guest Configuration extension installed but do not have a system assigned managed identity.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Add system-assigned managed identity to enable Guest Configuration assignments on virtual machines with no identities" (3cf2ab00-13f1-4d0c-8971-2ac904541a7e) and "Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity" (d26f7642-7545-4e18-9b75-8c9bbdee3a9a); PowerPipe controls azure_compliance.control.compute_vm_guest_configuration_with_no_managed_identity and azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-3 (Access Enforcement) and 2 more clauses.

FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-3 (Access Enforcement) and 4 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Access Enforcement (AC-3)
IA-5: Authenticator Management
IA-5(1) Password-based Authentication

FedRAMP Moderate Baseline Rev 4

AC-3 Access Enforcement
AC-17 (3): Managed Access Control Points
AC-17(1) Automated Monitoring/Control
AU-12 Audit Generation
IA-5 (1): Password-Based Authentication

2 more clauses

IA-5(1) Password-Based Authentication
SI-4: Information System Monitoring

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.12: Monitor and control remote access sessions.
3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
3.5.8: Prohibit password reuse for a specified number of generations.

1 more clause

3.5.10 Store and transmit only cryptographically-protected passwords

CMMC 2.0 Level 2

AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
SI.L2-3.14.7 Identify unauthorized use of organizational systems

FedRAMP High

AC-3 Access Enforcement
AC-17 Remote Access
AC-17(1) Automated Monitoring / Control
IA-5 Authenticator Management
IA-5(1) Password-Based Authentication

PCI DSS v3.2.1

Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: compute_vm_guest_configuration_with_no_managed_identity
Powerpipe Controls: azure_compliance.control.compute_vm_guest_configuration_with_no_managed_identity, azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity
Azure Policy Definitions: 3cf2ab00-13f1-4d0c-8971-2ac904541a7e, d26f7642-7545-4e18-9b75-8c9bbdee3a9a

Last reviewed: 2026-10-11

View all Azure controls →