Azure Compliance ControlsAzure Virtual Machine Scale Sets
Virtual machine scale sets should have the Log Analytics agent installed for Azure Security Center monitoring
Audits Windows and Linux Virtual Machine Scale Sets and flags any scale set where the `Log Analytics` extension is not installed. The check evaluates each scale set for the presence of that extension, covering both operating system types.
What this control checks
Audits Windows/Linux Virtual Machine Scale Sets if the Log Analytics extension is not installed.
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- SI-4: System Monitoring
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.g Trails
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- SI-4 Information System Monitoring
- 1216.09ab3System.12-09.ab 09.10 Monitoring
- 12101.09ab1Organizational.3-09.ab 09.10 Monitoring
Related controls
- Azure subscriptions should have Microsoft Defender for Servers enabled
- Windows virtual machines should have the Windows Guest Configuration extension installed for assignments
- Security Center should have Windows Defender ATP (WDATP) integration selected
- Unprotected SQL Server virtual machines should have Azure Defender for SQL enabled
- Monitor log profiles should have retention set to 365 days or greater
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_scale_set_log_analytics_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_scale_set_log_analytics_agent_installed
Last reviewed: 2026-10-11