Linux virtual machines should have the Linux Guest Configuration extension installed for assignments
This policy deploys the Linux Guest Configuration extension to Linux virtual machines hosted in Azure that are supported by Guest Configuration. The extension is a prerequisite for all Linux Guest Configuration assignments.
The Linux Guest Configuration extension is a prerequisite for all Linux Guest Configuration assignments and must be deployed to machines before using any Linux Guest Configuration policy definition.
What this control checks
Linux VMs must have the Linux Guest Configuration extension deployed before Guest Configuration.
Common pitfalls
Effect accepts only AuditIfNotExists or Disabled
The effect parameter has allowed values AuditIfNotExists and Disabled. The effect parameter has a default value of AuditIfNotExists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Deploy the Linux Guest Configuration extension to enable Guest Configuration assignments on Linux VMs" (331e8ea8-378a-410f-a2e5-ae22f38bb0da) and "Guest Configuration extension should be installed on your machines" (ae89ebca-1c92-4898-ac2c-9f63decb045c); PowerPipe control azure_compliance.control.compute_vm_guest_configuration_installed_linux.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-3 (Access Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Access Enforcement (AC-3)
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.12: Monitor and control remote access sessions.
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.10 Store and transmit only cryptographically-protected passwords
- AC-3 Access Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_guest_configuration_installed_linux - Powerpipe Control:
azure_compliance.control.compute_vm_guest_configuration_installed_linux - Azure Policy Definitions:
331e8ea8-378a-410f-a2e5-ae22f38bb0da,ae89ebca-1c92-4898-ac2c-9f63decb045c
Last reviewed: 2026-10-11