All virtual machines have endpoint protection installed

Check ID: defender_assessments_vm_endpoint_protection_installed
Provider: Azure
Service: defender
Severity: HIGH
Categories: vulnerabilities
Resource type: microsoft.security/assessments/governanceassignments

What this check verifies

Azure virtual machines are assessed for the presence of an endpoint protection (antimalware) solution and its reported health across the subscription

Risk

Absent or unhealthy endpoint protection lets malware execute on VMs, risking:

Data exfiltration (confidentiality)
Tampering and credential theft (integrity)
Ransomware, cryptomining, and outages (availability)

It also enables persistence and lateral movement to other cloud resources.

Recommendation

Enforce an endpoint protection/EDR baseline on every VM. Enable real-time protection, automatic updates, and alerting; use tamper protection and keep exclusions minimal. Apply least privilege, keep OS and agents patched, and continuously monitor coverage and health via Defender for Cloud.

Remediation

Terraform
Native IaC
Dashboard steps

# Install Microsoft Antimalware (endpoint protection) on a VM
resource "azurerm_virtual_machine_extension" "<example_resource_name>" {
  name                 = "IaaSAntimalware"
  virtual_machine_id   = "<example_resource_id>"
  publisher            = "Microsoft.Azure.Security"  # Critical: Antimalware extension publisher
  type                 = "IaaSAntimalware"           # Critical: installs endpoint protection
  type_handler_version = "1.5"
}

// Install Microsoft Antimalware (endpoint protection) on a VM
param vmName string = '<example_resource_name>'
param location string = '<LOCATION>'

resource antimalware 'Microsoft.Compute/virtualMachines/extensions@2022-11-01' = {
  name: '${vmName}/IaaSAntimalware'
  location: location
  properties: {
    publisher: 'Microsoft.Azure.Security'  // Critical: publisher for Antimalware extension
    type: 'IaaSAntimalware'                // Critical: installs endpoint protection
    typeHandlerVersion: '1.5'
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_assessments_vm_endpoint_protection_installed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Security contact has additional email addresses configured Security contact has attack path email notifications enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires