Azure Compliance ControlsAzure Virtual Machines
Windows virtual machines should have Windows Defender Exploit Guard enabled
Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks (Windows only).
What this control checks
Windows virtual machines must have Windows Defender Exploit Guard enabled
Framework mappings
The clauses this control is mapped to in each framework.
- SC-3 Security Function Isolation
- SI-3 Malicious Code Protection
- SI-16 Memory Protection
FedRAMP Moderate Baseline Rev 4
- SI-3 Malicious Code Protection
- SI-3(1) Central Management
- SI-16 Memory Protection
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.4 Update malicious code protection mechanisms when new releases are available
- 3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner
- SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
- SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
- SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SC-3 Security Function Isolation
- SI-3 Malicious Code Protection
- SI-3(1) Central Management
- SI-16 Memory Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_windows_defender_exploit_guard_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_windows_defender_exploit_guard_enabled - Azure Policy Definition:
bed48b13-6647-468e-aa2f-1af1d3f4dd40
Last reviewed: 2026-10-11