Virtual machines should use an organization-approved SKU size
Azure virtual machines are compared against an organization allowlist of VM size SKUs defined in `desired_vm_sku_sizes`. Instances using sizes outside this list are flagged as non-standard.
Unrestricted VM sizes enable over-provisioned or exotic SKUs, leading to: Sudden cost spikes and quota exhaustion (availability). Unrestricted VM sizes also lead to use of hardware lacking required security features (confidentiality/integrity). Unrestricted VM sizes also lead to abuse by compromised accounts for cryptomining at scale.
What this control checks
Flags virtual machines whose size is not an approved SKU size
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Allowed virtual machine size SKUs" (cccc23c7-8427-4f53-ad12-b6a63eb452b3); Prowler check vm_desired_sku_size (prowler azure --checks vm_desired_sku_size).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_desired_sku_size - Prowler Check:
vm_desired_sku_size - Azure Policy Definition:
cccc23c7-8427-4f53-ad12-b6a63eb452b3
Last reviewed: 2026-10-11