Azure Compliance ControlsAzure Virtual Machines
Virtual machines should have the Log Analytics agent installed for Azure Security Center monitoring
Log Analytics agent should be installed on your virtual machine for Azure Security Center monitoring. This policy audits any Windows/Linux virtual machines if the Log Analytics extension is not installed.
What this control checks
Audits Windows/Linux virtual machines where the Log Analytics extension is not installed.
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- SI-4: System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.g Trails
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- SI-4 Information System Monitoring
- 1215.09ab2System.7-09.ab 09.10 Monitoring
- 12100.09ab2System.15-09.ab 09.10 Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_log_analytics_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_log_analytics_agent_installed
Last reviewed: 2026-10-11