Server Hardening powered by Azure machine configuration extension

Question

Server Hardening powered by Azure machine configuration extension

Yasmin, Fitri 396

I'm looking for guidance on hardening VMs on Azure. Through the document Architecture strategies for hardening resources, I've found out that Microsoft Defender for Cloud includes server hardening capabilities powered by Azure machine configuration extension.

In the Review and remediate OS misconfigurations in Microsoft Defender for Cloud, the instructions is to do the following

In Defender for Cloud, open the Recommendations page.
Select the relevant recommendation.
1. For Windows machines, Vulnerabilities in security configuration on your Windows machines should be remediated (powered by Guest Configuration).
2. For Linux machines, Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)

However, when I followed the above, I see on Azure portal that these recommendation is set for deprecation. What is the latest recommendations as replacement of the above? or is there a new alternative to implement Azure-native server hardening?

0 comments

Answer accepted by question author

SUNOJ KUMAR YELURU 18,496 MVP Volunteer Moderator

Hello @Yasmin, Fitri,

Thank you for using Q & A forum.

Enable Defender for Servers Plan 2.
Auto-deploy the Azure Machine Configuration extension.
Use the Microsoft Cloud Security Benchmark (MCSB) recommendations surfaced in Defender for Cloud.
Add Azure Policy initiatives for compliance and ongoing enforcement.
Ignore references to the older Guest Configuration recommendation pages if they are marked for deprecation; they're being replaced by the newer recommendation experience rather than by a different hardening technology.

So there is no new replacement product for server hardening—the strategic direction is still Defender for Cloud + Azure Machine Configuration + Azure Policy + MCSB baselines.

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

0 comments

1 additional answer

Your answer

Answer 1

Michele Ariis 7,315 MVP Volunteer Moderator

Hi Yasmin; those older Guest Configuration recommendations are being retired; the current Defender for Cloud replacement is Machines should be configured securely, which uses Microsoft Defender Vulnerability Management to identify operating-system security configuration weaknesses; it requires Defender for Servers Plan 2.

For baseline compliance through Azure Machine Configuration, you can also assign the built-in Azure Policy definitions Windows machines should meet requirements of the Azure compute security baseline and Linux machines should meet requirements for the Azure compute security baseline; make sure the Machine Configuration extension and managed identity prerequisites are deployed.

One important distinction is that most of these policies audit configuration and report drift; they do not automatically harden every setting; for actual enforcement you still need remediation policies, OSConfig where supported, Intune or another configuration-management tool, depending on the operating system and the control you want to apply.

Yasmin, Fitri 396 Reputation points

2026-07-23T12:35:54.5966667+00:00
Hi Michele,

Thanks a lot for your reply. I have few follow-up questions, if you don't mind.

If I understand correctly, we have two options to audit configurations on VM:

Through MDC recommendations, by enabling Defender for Servers Plan 2. They specify the detailed findings for each machine with the risk category. Question: Is there any settings and monitoring extension required? Maybe Vulnerability assessment for machines or Agentless scanning for machines? I enabled this but still unable to find "Machines should be configured securely". Will they only be available once the old recommendations are deprecated?

Through Azure Policy with Machine Configuration extension as prerequisite. As per my observation, they don't provide detailed finding and just show if a machine is "compliant" or "non-compliat". Question: Does this mean users need to manually check their VM against Security benchmark and remediate?
Michele Ariis 7,315 Reputation points MVP Volunteer Moderator

2026-07-23T13:23:32.06+00:00

Hi Yasmin; a small correction to my previous reply; Machines should be configured securely is itself being deprecated and replaced by the Windows and Linux recommendations powered by Guest Configuration; these replacement recommendations are already available, so you do not need to wait for the old one to disappear.

For these OS configuration assessments you need Defender for Servers Plan 2, the Azure Machine Configuration extension and, for Azure VMs, a system-assigned managed identity; Vulnerability assessment for machines and Agentless scanning are separate capabilities and are not the data source for this specific recommendation; after deploying the prerequisites, allow some time for the first assessment and check that the VM is supported and within the Plan 2 scope.

Azure Policy initially shows the overall compliant or non-compliant state, but you can drill into the policy assignment, resource compliance details or Guest Assignments to see the individual settings that failed; remediation is generally not automatic, so you still need to validate and apply the required changes through scripts, configuration management or another hardening tool; the newer customizable security baseline experience can provide more granular rule selection and configuration, but parts of that experience are still in preview.