Back to Checks
azure

All virtual machines in the subscription have endpoint protection installed

defender_assessments_vm_endpoint_protection_installed
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/assessments/governanceassignments

Azure virtual machines are assessed for the presence of an endpoint protection (antimalware) solution and its reported health across the subscription

Prowler logoProwlerprowler-provider-azure

Risk

Absent or unhealthy endpoint protection lets malware execute on VMs, risking:

  • Data exfiltration (confidentiality)
  • Tampering and credential theft (integrity)
  • Ransomware, cryptomining, and outages (availability)

It also enables persistence and lateral movement to other cloud resources.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_assessments_vm_endpoint_protection_installed

Recommendation

Enforce an endpoint protection/EDR baseline on every VM. Enable real-time protection, automatic updates, and alerting; use tamper protection and keep exclusions minimal. Apply least privilege, keep OS and agents patched, and continuously monitor coverage and health via Defender for Cloud.

Remediation

Terraform

# Install Microsoft Antimalware (endpoint protection) on a VM
resource "azurerm_virtual_machine_extension" "<example_resource_name>" {
  name                 = "IaaSAntimalware"
  virtual_machine_id   = "<example_resource_id>"
  publisher            = "Microsoft.Azure.Security"  # Critical: Antimalware extension publisher
  type                 = "IaaSAntimalware"           # Critical: installs endpoint protection
  type_handler_version = "1.5"
}

NativeIaC

// Install Microsoft Antimalware (endpoint protection) on a VM
param vmName string = '<example_resource_name>'
param location string = '<LOCATION>'

resource antimalware 'Microsoft.Compute/virtualMachines/extensions@2022-11-01' = {
  name: '${vmName}/IaaSAntimalware'
  location: location
  properties: {
    publisher: 'Microsoft.Azure.Security'  // Critical: publisher for Antimalware extension
    type: 'IaaSAntimalware'                // Critical: installs endpoint protection
    typeHandlerVersion: '1.5'
  }
}

Other

1In Azure Portal, go to Microsoft Defender for Cloud
2Open Recommendations and search for "Install endpoint protection solution on virtual machines"
3Select the recommendation, click Fix
4Select all affected VMs and click Remediate (or Apply)
5Wait for remediation to complete and the recommendation status to turn Healthy

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_assessments_vm_endpoint_protection_installed(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            assessments,
        ) in defender_client.assessments.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if (
                "Install endpoint protection solution on virtual machines"
                in assessments
            ):
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=assessments[
                        "Install endpoint protection solution on virtual machines"
                    ],
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Endpoint protection is set up in all VMs in subscription {subscription_name} ({subscription_id})."

                if (
                    assessments[
                        "Install endpoint protection solution on virtual machines"
                    ].status
                    == "Unhealthy"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Endpoint protection is not set up in all VMs in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References