Virtual machine scale sets should be in a load balancer backend pool
Azure VM scale sets are associated with at least one load balancer backend pool. The evaluation looks for a backend pool link on each scale set's network configuration. Prowler rates the check medium severity.
Without a load balancer, traffic targets instances directly, bypassing health-based distribution. This degrades availability (overloads, no failover) and reliability (dropped sessions, uneven scaling) and can amplify DoS impact by concentrating flows on fewer nodes, increasing outage risk.
What this control checks
Virtual machine scale sets should be in a load balancer backend pool
Common pitfalls
Prefer the Standard SKU over legacy Basic
Prefer SKU Standard over legacy Basic.
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_scaleset_associated_with_load_balancer (prowler azure --checks vm_scaleset_associated_with_load_balancer).
Framework-specific interpretation
BSI C5:2025: Mapped to PI-01.01AC (The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service...).
Framework mappings
The clauses this control is mapped to in each framework.
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
Related controls
- Virtual machines and virtual machine scale sets should have encryption at host enabled
- Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed
- Virtual machines should use just-in-time network access control for management ports
- Azure subscriptions should have Microsoft Defender for Servers enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_vm_scaleset_associated_with_load_balancer - Prowler Check:
vm_scaleset_associated_with_load_balancer
Last reviewed: 2026-10-11