Azure Compliance ControlsAzure Virtual Machines
Windows virtual machines should have the network traffic data collection agent installed
Security Center uses the Microsoft Dependency agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.
What this control checks
Network traffic data collection agent should be installed on Windows virtual machines
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6 Audit Record Review, Analysis, and Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
1 more clause
- SI-4: System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.g Trails
- AU-6 Audit Record Review, Analysis And Reporting
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
1 more clause
- SI-4 Information System Monitoring
- 0835.09n1Organizational.1-09.n 09.06 Network Security Management
- 0887.09n2Organizational.5-09.n 09.06 Network Security Management
Related controls
- Linux virtual machines should have the network traffic data collection agent installed
- Windows machines should have the Log Analytics agent connected as expected
- Azure subscriptions should have Network Watcher enabled
- Security Center should have Windows Defender ATP (WDATP) integration selected
- Network security groups should have HTTP(S) access on ports 80 and 443 from the internet evaluated and restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_network_traffic_data_collection_windows_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_network_traffic_data_collection_windows_agent_installed
Last reviewed: 2026-10-11