Azure Compliance ControlsAzure Virtual Machines
Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed
Azure Policy deploys a Microsoft IaaSAntimalware extension with a default configuration when a VM is not configured with the antimalware extension. A second policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.
What this control checks
Checks whether Windows Server virtual machines have an antimalware extension installed
Framework mappings
The clauses this control is mapped to in each framework.
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.4 Update malicious code protection mechanisms when new releases are available
- 3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
- SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
- SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- 0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_malware_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_malware_agent_installed - Azure Policy Definitions:
2835b622-407b-4114-9198-6f7064cbe0dc,9b597639-28e4-48eb-b506-56b05d366257
Last reviewed: 2026-10-11