Windows virtual machines should have Windows Defender Exploit Guard enabled

Windows Defender Exploit Guard uses the Azure Policy Guest Configuration agent. Exploit Guard has four components designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks (Windows only).

Exploit Guard has four components that are designed to lock down devices against a wide variety of attack vectors and block behaviors commonly used in malware attacks while enabling enterprises to balance their security risk and productivity requirements (Windows only).

What this control checks

Windows virtual machines must have Windows Defender Exploit Guard enabled

Common pitfalls

Exploit Guard needs Windows 10 or Server update 1709

Windows Defender Exploit Guard is only available starting with Windows 10/Windows Server with update 1709. Setting this value to 'Non-Compliant' shows machines with older versions on which Windows Defender Exploit Guard is not available (such as Windows Server 2012 R2) as non-compliant.

Compliant setting marks older machines as compliant

Setting this value to 'Compliant' shows these machines as compliant. The NotAvailableMachineState parameter has a defaultValue of Compliant.

Selecting the Arc option bills monthly per Arc machine

By selecting this option, you agree to be charged monthly per Arc connected machine. The IncludeArcMachines parameter has a defaultValue of false.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Windows Defender Exploit Guard should be enabled on your machines" (bed48b13-6647-468e-aa2f-1af1d3f4dd40); PowerPipe control azure_compliance.control.compute_vm_windows_defender_exploit_guard_enabled.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to SC-3 (Security Function Isolation), SI-16 (Memory Protection) and SI-3 (Malicious Code Protection).

FedRAMP Moderate Baseline Rev 4: Mapped to SI-16 (Memory Protection), SI-3 (Malicious Code Protection) and SI-3(1) (Central Management).

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

SC-3 Security Function Isolation
SI-3 Malicious Code Protection
SI-16 Memory Protection

FedRAMP Moderate Baseline Rev 4

SI-3 Malicious Code Protection
SI-3(1) Central Management
SI-16 Memory Protection

NIST SP 800-171 Rev 2

3.14.1 Identify, report, and correct system flaws in a timely manner
3.14.2 Provide protection from malicious code at designated locations within organizational systems
3.14.4 Update malicious code protection mechanisms when new releases are available
3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed

CMMC 2.0 Level 2

SI.L1-3.14.1 Identify, report, and correct system flaws in a timely manner
SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed

FedRAMP High

SC-3 Security Function Isolation
SI-3 Malicious Code Protection
SI-3(1) Central Management
SI-16 Memory Protection

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: compute_vm_windows_defender_exploit_guard_enabled
Powerpipe Control: azure_compliance.control.compute_vm_windows_defender_exploit_guard_enabled
Azure Policy Definition: bed48b13-6647-468e-aa2f-1af1d3f4dd40

Last reviewed: 2026-10-11

View all Azure controls →