Virtual machines should have automatic protection signature updates configured for Microsoft Antimalware for Azure
This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures. Microsoft Antimalware for Azure should be configured to automatically update protection signatures.
What this control checks
VMs have automatic protection signature updates configured for Microsoft Antimalware
Common pitfalls
Only Windows virtual machines are audited
This policy audits any Windows virtual machine not configured with automatic update of Microsoft Antimalware protection signatures.
Extension needs autoUpgradeMinorVersion true
The existenceCondition requires Microsoft.Compute/virtualMachines/extensions/autoUpgradeMinorVersion equals true.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Microsoft Antimalware for Azure should be configured to automatically update protection signatures" (c43e4a30-77cb-48ab-a4dd-93f175c63b57); PowerPipe control azure_compliance.control.compute_vm_malware_agent_automatic_upgrade_enabled.
Framework-specific interpretation
NIST SP 800-171 Rev 2: Mapped to 3.14.2 (Provide protection from malicious code at designated locations within organizational systems), 3.14.4 (Update malicious code protection mechanisms when new releases are available) and 3.14.5 (Perform periodic scans of the information system and real-time scans of files from external sources as files are...).
CMMC 2.0 Level 2: Mapped to SI.L1-3.14.2 (Provide protection from malicious code at designated locations within organizational systems), SI.L1-3.14.4 (Update malicious code protection mechanisms when new releases are available) and SI.L1-3.14.5 (Perform periodic scans of the information system and real-time scans of files from external sources as files are...).
HIPAA HITRUST v9.2: Mapped to 0201.09j1Organizational.124-09.j (09.04 Protection Against Malicious and Mobile Code).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.4 Update malicious code protection mechanisms when new releases are available
- 3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
- SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
- SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- 0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_malware_agent_automatic_upgrade_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_malware_agent_automatic_upgrade_enabled - Azure Policy Definition:
c43e4a30-77cb-48ab-a4dd-93f175c63b57
Last reviewed: 2026-10-11