Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
vm_scaleset_associated_with_load_balancerProvider: Azure
Service:
vmSeverity: MEDIUM
Categories:
resilienceResource type:
microsoft.compute/virtualmachinescalesetsWhat this check verifies
Azure VM scale sets are associated with at least one load balancer backend pool. The evaluation looks for a backend pool link on each scale set’s network configuration.Risk
Without a load balancer, traffic targets instances directly, bypassing health-based distribution. This degrades availability (overloads, no failover) and reliability (dropped sessions, uneven scaling) and can amplify DoS impact by concentrating flows on fewer nodes, increasing outage risk.Recommendation
Associate VM scale sets with a Standard Load Balancer backend pool to enforce health-probed, even distribution and seamless failover. Design for high availability: run multiple instances across zones, enable autoscale, and apply defense in depth with limited exposure and NSG controls. Prefer SKUStandard over legacy Basic.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/azure/virtual-network/network-overview
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/azure/VirtualMachines/associated-load-balancers.html
- https://learn.microsoft.com/ms-my/azure/load-balancer/load-balancer-multiple-virtual-machine-scale-set?tabs=azureportal
- https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = vm_scaleset_associated_with_load_balancer. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks