Virtual Machine uses an approved custom machine image

Check ID: vm_ensure_using_approved_images
Provider: Azure
Service: vm
Severity: HIGH
Categories: software-supply-chain
Resource type: microsoft.compute/virtualmachines

What this check verifies

Azure VMs are evaluated for use of an approved custom image by inspecting the VM image reference. The expected format is a subscription-scoped ID like /subscriptions/.../providers/Microsoft.Compute/images/<image>, not marketplace, gallery, or community sources.

Risk

Using unapproved images undermines integrity and confidentiality by introducing unknown packages, misconfigurations, or malware. Attackers can implant backdoors, weaken hardening, and bypass baselines, enabling data exfiltration and lateral movement, and harming availability with unpatched software.

Recommendation

Standardize on golden images maintained in an Azure Compute Gallery or managed images.

Harden and patch each release; scan for vulnerabilities
Restrict who can create/publish images (least privilege)
Enforce deployments only from approved images via policy
Version, sign, and retire images regularly

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az vm create —resource-group <RESOURCE_GROUP> —name <VM_NAME> —image /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Compute/images/<IMAGE_NAME> —admin-username azureuser —generate-ssh-keys

# VM created from an approved custom managed image
resource "azurerm_windows_virtual_machine" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_id>"
  location            = "<example_resource_location>"
  size                = "Standard_DS1_v2"
  admin_username      = "<example_resource_name>"
  admin_password      = "<example_resource_id>"
  network_interface_ids = ["<example_resource_id>"]

  source_image_id = "/subscriptions/<subscription_id>/resourceGroups/<example_resource_id>/providers/Microsoft.Compute/images/<example_resource_name>" # CRITICAL: managed image ID ensures PASS

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }
}

// Create a VM using an approved custom managed image
param location string = resourceGroup().location
param nicId string
param adminUsername string
param adminPassword string

resource vm 'Microsoft.Compute/virtualMachines@2023-09-01' = {
  name: '<example_resource_name>'
  location: location
  properties: {
    hardwareProfile: { vmSize: 'Standard_DS1_v2' }
    storageProfile: {
      imageReference: {
        id: '/subscriptions/<subscription_id>/resourceGroups/<example_resource_id>/providers/Microsoft.Compute/images/<example_resource_name>' // CRITICAL: use managed image ID to pass check
      }
      osDisk: { createOption: 'FromImage' }
    }
    osProfile: {
      computerName: '<example_resource_name>'
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    networkProfile: {
      networkInterfaces: [{ id: nicId }]
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = vm_ensure_using_approved_images. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Unattached disk uses a customer-managed key Virtual Machine uses managed disks for OS and data disks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires