Azure Compliance ControlsAzure Virtual Machines
Windows machines should not store passwords using reversible encryption
This control requires that prerequisites are deployed to the policy assignment scope. Under this control, machines are marked non-compliant if they are Windows machines that do not store passwords using `reversible encryption`.
What this control checks
Checks the reversible encryption password storage setting on Windows VMs
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- IA-5(1) Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.10 Store and transmit only cryptographically-protected passwords
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.10 Store and transmit only cryptographically-protected passwords
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
Related controls
- Windows virtual machines should have the Windows Guest Configuration extension installed for assignments
- Microsoft Entra ID policies should have 'Custom banned password list' set to 'Enforce'
- Network security groups should have RDP access restrictions configured
- Virtual machines should have endpoint protection installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_passwords_stored_using_reversible_encryption_windows - Powerpipe Control:
azure_compliance.control.compute_vm_passwords_stored_using_reversible_encryption_windows - Azure Policy Definition:
da0f98fe-a24b-4ad5-af69-bd0400233661
Last reviewed: 2026-10-11