All virtual machines have system updates applied

​

What this check verifies

Azure VMs are evaluated for:

• Presence of a monitoring agent
• Periodic checks for missing updates
• Installation of the latest security and critical OS updates on Windows and Linux

​

Risk

Unpatched VMs are exposed to known exploits (RCE, privilege escalation), enabling initial access and lateral movement. This endangers confidentiality (data theft), integrity (tampering), and availability (ransomware, outages). Lapses in periodic assessment prolong exposure to critical vulnerabilities.

​

Recommendation

Adopt automated patching for all VMs:

• Schedule recurring assessments
• Deploy security/critical updates promptly using maintenance windows and rings
• Ensure a supported update/monitoring agent
• Enforce risk-based SLAs, test in stages, keep backups, and use least privilege for patch tools

​

Remediation

Dashboard steps

1. In the Azure portal, go to Microsoft Defender for Cloud > Recommendations
2. Search for “Log Analytics agent should be installed on virtual machines”
   • Select affected VMs > Fix > choose a Log Analytics workspace > Apply
3. Search for “Machines should be configured to periodically check for missing system updates”
   • Select affected VMs > Fix > Apply
4. Search for “System updates should be installed on your machines” (may show as powered by Azure Update Manager)
   • Select affected VMs > Fix > Install updates now (or One-time update) > Install
5. Wait for installation to complete, then verify all three recommendations show Healthy for the subscription

​

References

• https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/VirtualMachines/apply-latest-os-patches.html
• https://learn.microsoft.com/en-us/azure/virtual-machines/updates-maintenance-overview
• https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-7-rapidly-and-automatically-remediate-software-vulnerabilities

​

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = defender_ensure_system_updates_are_applied. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Azure checks