Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Microsoft Defender for Cloud provides security recommendations to improve organizational security posture and reduce risk. An important element in risk reduction is to harden machines for your business environment. You can assess and remediate operating system (OS) baseline misconfigurations using the Azure Machine Configuration extension and Defender Vulnerability Management.
Assessment (Azure Machine Configuration extension)
Defender for Cloud uses built-in Azure policy initiatives to assess and apply security configurations. The default initiative is the Microsoft Cloud Security Benchmark (MCSB).
MCSB includes compute security baselines for Windows and Linux operating systems.
These OS baseline recommendations aren't part of the free security posture features in Defender for Cloud.
The recommendations are available when Defender for Servers Plan 2 is enabled.
When you enable Defender for Servers Plan 2, you also enable relevant Azure policies on the subscription:
- Windows machines should meet requirements of the Azure compute security baseline
- Linux machines should meet requirements for the Azure compute security baseline
Don't remove these policies. You won't be able to use the machine configuration extension that collects machine data.
Data collection
The Azure machine configuration extension, formerly known as the Azure Policy guest configuration, runs on the machine and gathers machine information for assessment.
Installing the machine configuration extension
Install the machine configuration extension as follows:
- Azure: On Azure machines, install the extension by remediating the recommendation Guest Configuration extension should be installed on machines.
- AWS/GCP: On AWS and GCP machines, the machine configuration installs by default when you select Arc provisioning in the AWS or GCP connector.
- On-premises: For on-premises machines, machine configuration is enabled by default when you onboard on-premises VMs as Azure Arc-enabled VMs.
- Azure VMs: On Azure virtual machines (VMs) only, not Arc-enabled VMs, assign a managed identity to the machine by remediating the recommendation Virtual machines Guest Configuration extension should be deployed with system-assigned managed identity.
What's not included
This pricing doesn't include other features provided by the machine configuration extension outside Defender for Cloud. These features are subject to Azure Policy machine configuration pricing. For example, remediation and custom policies. For more information, see Azure Policy machine configuration pricing details.
Assessment (Defender Vulnerability Management)
Defender for Cloud integrates with Microsoft Defender for Endpoint and Microsoft Defender Vulnerability Management. This integration gives machines vulnerability protection and endpoint detection and response (EDR) features.
As part of the integration with Defender Vulnerability Management, it provides security baselines assessment.
Security baselines assessment uses custom baseline profiles. Each profile is a template of device settings and benchmarks to compare them against.
Supported systems and requirements
The following requirements and limitations apply to security baselines assessment:
Assessing devices against the Defender Vulnerability Management security baselines assessment profiles is currently available in public preview.
You must enable Defender for Servers Plan 2 and run the Defender for Endpoint agent on machines you want to assess.
Assessment supports machines running security baseline profiles:
- windows_server_2008_r2
- windows_server_2016
- windows_server_2019
- windows_server_2022
Reviewing recommendations
To review recommendations made by security baseline assessments, search for the recommendation Machines should be configured securely (powered by MDVM), and view the recommendation for all resources.