Windows Server virtual machines should have the default Microsoft IaaSAntimalware extension installed
Azure Policy deploys a Microsoft IaaSAntimalware extension with a default configuration when a VM is not configured with the antimalware extension. A second policy audits any Windows server VM without Microsoft IaaSAntimalware extension deployed.
What this control checks
Checks whether Windows Server virtual machines have an antimalware extension installed
Common pitfalls
Effect defaults to AuditIfNotExists
The effect parameter defaults to AuditIfNotExists. Allowed values are AuditIfNotExists and Disabled.
Only listed Windows Server image SKUs apply
The policy applies when Microsoft.Compute/imagePublisher equals MicrosoftWindowsServer and Microsoft.Compute/imageOffer equals WindowsServer. The Microsoft.Compute/imageSKU must be in the listed values, such as 2019-Datacenter.
Extension must be IaaSAntimalware from Microsoft.Azure.Security
The existence condition requires Microsoft.Compute/virtualMachines/extensions/type equal to IaaSAntimalware. It also requires Microsoft.Compute/virtualMachines/extensions/publisher equal to Microsoft.Azure.Security.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Deploy default Microsoft IaaSAntimalware extension for Windows Server" (2835b622-407b-4114-9198-6f7064cbe0dc) and "Microsoft IaaSAntimalware extension should be deployed on Windows servers" (9b597639-28e4-48eb-b506-56b05d366257); PowerPipe control azure_compliance.control.compute_vm_malware_agent_installed.
Framework-specific interpretation
NIST SP 800-171 Rev 2: Mapped to 3.14.2 (Provide protection from malicious code at designated locations within organizational systems), 3.14.4 (Update malicious code protection mechanisms when new releases are available) and 3.14.5 (Perform periodic scans of the information system and real-time scans of files from external sources as files are...).
CMMC 2.0 Level 2: Mapped to SI.L1-3.14.2 (Provide protection from malicious code at designated locations within organizational systems), SI.L1-3.14.4 (Update malicious code protection mechanisms when new releases are available) and SI.L1-3.14.5 (Perform periodic scans of the information system and real-time scans of files from external sources as files are...).
HIPAA HITRUST v9.2: Mapped to 0201.09j1Organizational.124-09.j (09.04 Protection Against Malicious and Mobile Code).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.14.2 Provide protection from malicious code at designated locations within organizational systems
- 3.14.4 Update malicious code protection mechanisms when new releases are available
- 3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- SI.L1-3.14.2 Provide protection from malicious code at designated locations within organizational systems
- SI.L1-3.14.4 Update malicious code protection mechanisms when new releases are available
- SI.L1-3.14.5 Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed
- 0201.09j1Organizational.124-09.j 09.04 Protection Against Malicious and Mobile Code
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_malware_agent_installed - Powerpipe Control:
azure_compliance.control.compute_vm_malware_agent_installed - Azure Policy Definitions:
2835b622-407b-4114-9198-6f7064cbe0dc,9b597639-28e4-48eb-b506-56b05d366257
Last reviewed: 2026-10-11