Virtual machines should use Azure Resource Manager resources
Use new Azure Resource Manager for your virtual machines. It provides security enhancements such as stronger access control (RBAC), better auditing, access to managed identities, access to key vault for secrets, and Azure AD-based authentication.
Use new Azure Resource Manager for your virtual machines to provide security enhancements such as: stronger access control (RBAC), better auditing, Azure Resource Manager based deployment and governance, access to managed identities, access to key vault for secrets, Azure AD-based authentication and support for tags and resource groups for easier security management.
What this control checks
Virtual machines should be migrated to new Azure Resource Manager resources.
Common pitfalls
Effect defaults to Audit
The effect parameter has a defaultValue of Audit. The allowed values are Audit, Deny and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Virtual machines should be migrated to new Azure Resource Manager resources" (1d84d5fb-01f6-4d12-ba4f-4a26081d403d); PowerPipe control azure_compliance.control.compute_vm_uses_azure_resource_manager.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-3 (Access Enforcement).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-3 (Access Enforcement).
Framework mappings
The clauses this control is mapped to in each framework.
- Access Enforcement (AC-3)
FedRAMP Moderate Baseline Rev 4
- AC-3 Access Enforcement
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.2: Limit system access to the types of transactions and functions that authorized users are permitted to execute.
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L1-3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute
- AC-3 Access Enforcement
- 0835.09n1Organizational.1-09.n 09.06 Network Security Management
- 10.5.4 Logs for external-facing technologies (for example, wireless, firewalls, DNS, mail) are written onto a secure, centralized, internal log server or media
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_uses_azure_resource_manager - Powerpipe Control:
azure_compliance.control.compute_vm_uses_azure_resource_manager - Azure Policy Definition:
1d84d5fb-01f6-4d12-ba4f-4a26081d403d
Last reviewed: 2026-10-11