Azure Compliance ControlsMicrosoft Defender for Cloud
Azure subscriptions should have auto provisioning of the Log Analytics agent enabled
To monitor for security vulnerabilities and threats, Azure Security Center collects data from your Azure virtual machines. Data is collected by the Log Analytics agent, formerly known as the Microsoft Monitoring Agent (MMA), which reads various security-related configurations and event logs from the machine and copies the data to your Log Analytics workspace for analysis. We recommend enabling auto provisioning to automatically deploy the agent to all supported Azure VMs and any new ones that are created.
What this control checks
Auto provisioning of the Log Analytics agent is set to On at the subscription level.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.8: The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity's objectives.
- CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- A.8.15 Logging
- 2 Risk management policy
- 3 Incident handling
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
- SI-4: System Monitoring
NIST Cybersecurity Framework v2.0
- DE.AE-02: Potentially adverse events are analyzed to better understand associated activities.
- DE.AE-03: Information is correlated from multiple sources.
- DE.AE-04: The estimated impact and scope of adverse events are understood.
- DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis.
- DE.CM-01
10 more clauses
- DE.CM-02
- DE.CM-03
- DE.CM-06
- DE.CM-09
- RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident.
- RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved.
- RS.AN-07
- RS.MA-01
- RS.MI-01: Incidents are contained.
- RS.MI-02
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- 3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
- 3.14.7: Identify unauthorized use of organizational systems.
- 3.1.g Trails
- AM-01.01AC The information collected about assets is considered in logging and monitoring applications to identify the impact on cloud services and functions in case of events that could lead to a breach of protection objectives, and to support information provided to affected cloud service...
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-15.01AC On request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
9 more clauses
- OPS-15.01B The log data generated (cloud service derived data and cloud service provider data) allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of an incident.
- OPS-15.02B Each logged event shall include a time/date stamp to ensure accurate and traceable records.
- OPS-15.03B The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of infrastructure components and network communication during security events.
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- OPS-26.05B The cloud service provider implements monitoring measures to ensure system components comply with hardening specifications.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- SIM-03.01B Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- 2.11 Ensure that 'Automatic provisioning of monitoring agent' is set to 'On'
- 2.11 Ensure That Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- 2.2.1 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- 2.1.15 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- 2.1.14 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- 3.1.1.1 Ensure that Auto provisioning of 'Log Analytics agent for Azure VMs' is Set to 'On'
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- SI-4 Information System Monitoring
- 1213.09ab2System.128-09.ab 09.10 Monitoring
- 1220.09ab3System.56-09.ab 09.10 Monitoring
Related controls
- Azure subscriptions should have Microsoft Defender CSPM set to 'On'
- Microsoft Defender for Cloud policy assignments should have enforcement mode set to Default
- Azure subscriptions should have Microsoft Defender for container registries enabled
- Virtual machines should have system updates installed
- Azure subscriptions should have Microsoft Defender for IoT Hub enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
securitycenter_automatic_provisioning_monitoring_agent_on - Powerpipe Control:
azure_compliance.control.securitycenter_automatic_provisioning_monitoring_agent_on - Prowler Check:
defender_auto_provisioning_log_analytics_agent_vms_on
Last reviewed: 2026-10-14