Virtual Machine Scale Set has at least one VM instance

Check ID: vm_scaleset_not_empty
Provider: Azure
Service: vm
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.compute/virtualmachinescalesets

Risk

Orphaned scale sets degrade governance and can hide stale autoscale or permissive identities. If reactivated, they may launch VMs from outdated images, exposing vulnerable services and enabling lateral movement, impacting confidentiality and availability. They also create inventory sprawl and unnecessary spend.

Recommendation

Decommission empty scale sets or consolidate capacity. Apply resource lifecycle and governance policies to prevent drift; require tagging and owners, review regularly. Manage capacity through IaC, enforce least privilege on scale set identities, and use change control to avoid unintended autoscale activations. If retained temporarily, document purpose and review date.

Remediation

CLI
Terraform
Dashboard steps

az vmss scale —resource-group <resource-group> —name <scale-set-name> —new-capacity 1

# Patch the scale set to have at least one instance
resource "azapi_update_resource" "<example_resource_name>" {
  type        = "Microsoft.Compute/virtualMachineScaleSets@2024-03-01"
  resource_id = "<example_resource_id>"

  body = jsonencode({
    sku = {
      capacity = 1 # Critical: ensures the scale set has at least one VM instance
    }
  })
}

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = vm_scaleset_not_empty. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Virtual Machine Scale Set has at least one VM instance

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires