Azure Compliance ControlsAzure Virtual Machines
Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for Azure
This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures. Microsoft Antimalware for Azure should be configured to automatically update protection signatures.
What this control checks
VMs have automatic protection signature updates configured for Microsoft Antimalware
Framework mappings
The clauses this control is mapped to in each framework.
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.4 Update malicious code protection mechanisms when new releases are available
- 3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
- SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
- SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- 0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_malware_agent_automatic_upgrade_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_malware_agent_automatic_upgrade_enabled - Azure Policy Definition:
c43e4a30-77cb-48ab-a4dd-93f175c63b57
Last reviewed: 2026-10-11