Virtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignments
This policy adds a system-assigned managed identity to virtual machines that are supported by Guest Configuration and have at least one user-assigned identity but no system-assigned managed identity. It is a prerequisite for all Guest Configuration assignments.
A system-assigned managed identity is a prerequisite for all Guest Configuration assignments and must be added to machines before using any Guest Configuration policy definitions. The Guest Configuration extension requires a system assigned managed identity.
What this control checks
VMs with a user-assigned identity also need a system-assigned identity for Guest Configuration
Common pitfalls
Only VMs with a user-assigned identity
This policy adds a system-assigned managed identity to virtual machines hosted in Azure that are supported by Guest Configuration and have at least one user-assigned identity but do not have a system-assigned managed identity.
Extension check is audit only by default
The effect parameter allows AuditIfNotExists and Disabled. The defaultValue is AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Add system-assigned managed identity to enable Guest Configuration assignments on VMs with a user-assigned identity" (497dff13-db2a-4c0f-8603-28fa3b331ab6) and "Virtual machines' Guest Configuration extension should be deployed with system-assigned managed identity" (d26f7642-7545-4e18-9b75-8c9bbdee3a9a); PowerPipe controls azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity and azure_compliance.control.compute_vm_guest_configuration_with_user_and_system_assigned_managed_identity.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-3 (Access Enforcement) and 2 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-3 (Access Enforcement) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Access Enforcement (AC-3)
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- AU-12 Audit Generation
- IA-5 (1): Password-Based Authentication
2 more clauses
- IA-5(1) Password-Based Authentication
- SI-4: Information System Monitoring
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.7 Enforce a minimum password complexity and change of characters when new passwords are created
- 3.5.8: Prohibit password reuse for a specified number of generations.
1 more clause
- 3.5.10 Store and transmit only cryptographically-protected passwords
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- SI.L2-3.14.7 Identify unauthorized use of organizational systems
- AC-3 Access Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
- Do not allow an individual to submit a new password/passphrase that is the same as any of the last four passwords/passphrases he or she has used
- Passwords/passphrases require a minimum length of at least seven characters, contain both numeric and alphabetic characters
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_with_user_and_system_assigned_managed_identity - Powerpipe Controls:
azure_compliance.control.compute_vm_guest_configuration_with_system_assigned_managed_identity,azure_compliance.control.compute_vm_guest_configuration_with_user_and_system_assigned_managed_identity - Azure Policy Definitions:
497dff13-db2a-4c0f-8603-28fa3b331ab6,d26f7642-7545-4e18-9b75-8c9bbdee3a9a
Last reviewed: 2026-10-11