Windows machines should not store passwords using reversible encryption
This control requires that prerequisites are deployed to the policy assignment scope. Under this control, machines are marked non-compliant if they are Windows machines that do not store passwords using `reversible encryption`.
What this control checks
Checks the reversible encryption password storage setting on Windows VMs
Common pitfalls
Policy assignment scope needs prerequisites deployed
Requires that prerequisites are deployed to the policy assignment scope.
Arc machine option incurs a monthly per-machine charge
By selecting this option, you agree to be charged monthly per Arc connected machine. The IncludeArcMachines parameter has a defaultValue of false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit Windows machines that do not store passwords using reversible encryption" (da0f98fe-a24b-4ad5-af69-bd0400233661); PowerPipe control azure_compliance.control.compute_vm_passwords_stored_using_reversible_encryption_windows.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to IA-5 (Authenticator Management) and IA-5(1) (Password-based Authentication).
FedRAMP Moderate Baseline Rev 4: Mapped to IA-5 (Authenticator Management) and IA-5(1) (Password-Based Authentication).
Framework mappings
The clauses this control is mapped to in each framework.
- IA-5: Authenticator Management
- IA-5(1) Password-based Authentication
FedRAMP Moderate Baseline Rev 4
- IA-5 (1): Password-Based Authentication
- IA-5(1) Password-Based Authentication
- 3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- 3.5.10 Store and transmit only cryptographically-protected passwords
- IA.L1-3.5.2 Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems
- IA.L2-3.5.10 Store and transmit only cryptographically-protected passwords
- IA-5 Authenticator Management
- IA-5(1) Password-Based Authentication
Related controls
- Windows virtual machines should have the Windows Guest Configuration extension installed for assignments
- Microsoft Entra ID policies should have 'Custom banned password list' set to 'Enforce'
- Network security groups should have RDP access restrictions configured
- Virtual machines should have endpoint protection installed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_passwords_stored_using_reversible_encryption_windows - Powerpipe Control:
azure_compliance.control.compute_vm_passwords_stored_using_reversible_encryption_windows - Azure Policy Definition:
da0f98fe-a24b-4ad5-af69-bd0400233661
Last reviewed: 2026-10-11