Back to Checks
azure

All virtual machines in the subscription have system updates applied

defender_ensure_system_updates_are_applied
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilitieslogging
Resource Type:microsoft.compute/virtualmachines

Azure VMs are evaluated for:

  • Presence of a monitoring agent
  • Periodic checks for missing updates
  • Installation of the latest security and critical OS updates on Windows and Linux
Prowler logoProwlerprowler-provider-azure

Risk

Unpatched VMs are exposed to known exploits (RCE, privilege escalation), enabling initial access and lateral movement. This endangers confidentiality (data theft), integrity (tampering), and availability (ransomware, outages). Lapses in periodic assessment prolong exposure to critical vulnerabilities.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_ensure_system_updates_are_applied

Recommendation

Adopt automated patching for all VMs:

  • Schedule recurring assessments
  • Deploy security/critical updates promptly using maintenance windows and rings
  • Ensure a supported update/monitoring agent
  • Enforce risk-based SLAs, test in stages, keep backups, and use least privilege for patch tools

Remediation

Other

1In the Azure portal, go to Microsoft Defender for Cloud > Recommendations
2Search for "Log Analytics agent should be installed on virtual machines"
3- Select affected VMs > Fix > choose a Log Analytics workspace > Apply
4Search for "Machines should be configured to periodically check for missing system updates"
5- Select affected VMs > Fix > Apply
6Search for "System updates should be installed on your machines" (may show as powered by Azure Update Manager)
7- Select affected VMs > Fix > Install updates now (or One-time update) > Install
8Wait for installation to complete, then verify all three recommendations show Healthy for the subscription

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_ensure_system_updates_are_applied(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            assessments,
        ) in defender_client.assessments.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if (
                "Log Analytics agent should be installed on virtual machines"
                in assessments
                and "Machines should be configured to periodically check for missing system updates"
                in assessments
                and "System updates should be installed on your machines" in assessments
            ):
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=assessments[
                        "System updates should be installed on your machines"
                    ],
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"System updates are applied for all the VMs in the subscription {subscription_name} ({subscription_id})."

                if (
                    assessments[
                        "Log Analytics agent should be installed on virtual machines"
                    ].status
                    == "Unhealthy"
                    or assessments[
                        "Machines should be configured to periodically check for missing system updates"
                    ].status
                    == "Unhealthy"
                    or assessments[
                        "System updates should be installed on your machines"
                    ].status
                    == "Unhealthy"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"System updates are not applied for all the VMs in the subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References