Virtual machines should use system-assigned managed identity with the Guest Configuration extension
The Guest Configuration extension requires a system assigned managed identity. Azure virtual machines in scope are non-compliant when they have the Guest Configuration extension installed but do not have a system assigned managed identity.
The Guest Configuration extension requires a system assigned managed identity.
What this control checks
VMs with the Guest Configuration extension installed must have a system assigned managed identity.
Common pitfalls
Non-compliant without system assigned identity
Azure virtual machines in the scope of this policy will be non-compliant when they have the Guest Configuration extension installed but do not have a system assigned managed identity.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity" (d26f7642-7545-4e18-9b75-8c9bbdee3a9a); PowerPipe control azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6(4) (Central Review and Analysis) and 2 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-02 (Inventories of software, services, and systems managed by the organization are maintained.) and PR.PS-01 (Configuration management practices are established and applied.).
FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation) and SI-4 (Information System Monitoring).
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- ID.AM-02
- PR.PS-01
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- SI-4: Information System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.b Segregation of Functions
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- SI.L2-3.14.7 Identify unauthorized use of organizational systems
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- SI-4 Information System Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_with_system_assigned_managed_identity - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity - Azure Policy Definition:
d26f7642-7545-4e18-9b75-8c9bbdee3a9a
Last reviewed: 2026-10-11