Windows machines should have the Azure compute security baseline requirements satisfied
Requires that prerequisites are deployed to the policy assignment scope. Machines are non-compliant if the machine is not configured correctly for one of the recommendations in the Azure compute security baseline.
What this control checks
Windows machines must satisfy the Azure compute security baseline requirements
Common pitfalls
Effect options are limited to two values
The effect parameter allows AuditIfNotExists and Disabled. The effect has a defaultValue of AuditIfNotExists.
Arc machines cost extra when included
The IncludeArcMachines parameter has a defaultValue of false. By selecting this option, you agree to be charged monthly per Arc connected machine.
Prerequisites needed at the assignment scope
Requires that prerequisites are deployed to the policy assignment scope.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Windows machines should meet requirements of the Azure compute security baseline" (72650e9f-97bc-4b2a-ab5f-9781a9fcecbc); PowerPipe control azure_compliance.control.compute_vm_meet_security_baseline_requirements_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings).
FedRAMP Moderate Baseline Rev 4: Mapped to CM-6 (Configuration Settings).
Framework mappings
The clauses this control is mapped to in each framework.
- Configuration Settings (CM-6)
FedRAMP Moderate Baseline Rev 4
- CM-6 Configuration Settings
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM.L2-3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- CM.L2-3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- CM-6 Configuration Settings
Related controls
- Virtual machines should use system-assigned managed identity with the Guest Configuration extension
- Windows machines should have the password complexity setting enabled
- Virtual machines should have a vulnerability assessment solution enabled
- Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for Azure
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_meet_security_baseline_requirements_windows - Powerpipe Control:
azure_compliance.control.compute_vm_meet_security_baseline_requirements_windows - Azure Policy Definition:
72650e9f-97bc-4b2a-ab5f-9781a9fcecbc
Last reviewed: 2026-10-11