# Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' .

- Source: https://support.icompaas.com/support/solutions/articles/62000229846-ensure-that-auto-provisioning-of-vulnerability-assessment-for-machines-is-set-to-on-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Automatic Provisioning of Vulnerability Assessment (VA) for Machines enables Microsoft Defender for Cloud to automatically deploy vulnerability assessment extensions on Azure Virtual Machines and hybrid/on-premises servers connected through Azure Arc.

  
Rationale:

This check verifies that Vulnerability assessment for machines is on under Microsoft Defender for Cloud, Environment Settings. When enabled, Defender for Cloud automatically installs the VA agent, performs recurring vulnerability scans, and generates recommendations for OS misconfigurations, missing updates, insecure settings, and exposed weaknesses. If this setting is Off, machines do not receive automated scanning, resulting in incomplete security visibility and weakened compliance posture across Azure and hybrid environments.

  

Impact:

-   Enables automated vulnerability scanning for Azure and Arc-enabled machines
    
-   Reduces manual onboarding and operational overhead
    
-   Improves detection of OS vulnerabilities, insecure configurations, and missing patches
    
-   Supports compliance with CIS, NIST, Azure Security Benchmark, and regulatory controls
    

  

Default Value:

By default, automatic provisioning of the Vulnerability Assessment agent is off. Manual configuration is required to achieve full vulnerability assessment coverage.

  

Pre-Requisites:

-   Defender for Servers Plan 1 or Plan 2 (VA requires these plans)
    
-   Azure Arc configured for non-Azure machines (optional but required for hybrid)
    
-   RBAC permissions, including:
    
    -   Microsoft.Security/\*
        
    -   Microsoft.HybridCompute/\*
        
    -   Microsoft.Compute/\*
        

Test Plan:

1.  Sign in to the Azure portal [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Search for  Microsoft Defender for Cloud
    
3.  Under the management section, Select Environment Settings
    
4.  Choose the Subscription
    
5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    
7.  Verify that Vulnerability assessment for machines is set to On.
    
8.  If it is off, follow the Implementation Steps.
    

![](https://support.icompaas.com/assets/kb/9f083bf42e353e3e.png)

Implementation Steps:

1.  Sign in to the Azure portal [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Search for Microsoft Defender for Cloud
    
3.  Under the management section, select Environment Settings
    
4.  Choose the target Subscription
    

![](https://support.icompaas.com/assets/kb/7b3021cc98df6dc5.png)

5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    

![](https://support.icompaas.com/assets/kb/795e232ff8bbd75b.png)

7.  Set Vulnerability assessment for machines to On.
    

![](https://support.icompaas.com/assets/kb/5e4ac109fb5abae5.png)

8.  Click continue to the Save changes
    

Backout Plan:

1.  Sign in to the Azure portal [https://portal.azure.com](https://portal.azure.com/) 
    
2.  Search for Microsoft Defender for Cloud
    
3.  Under the management section, select Environment Settings
    
4.  Select the subscription
    
5.  Under the settings, click Defender plans
    
6.  In the Defender plans page, click Settings & Monitoring 
    
7.  Set Vulnerability assessment for machines is off.
    
8.  Click continue to the Save changes
    

References:

-   [https://learn.microsoft.com/azure/defender-for-cloud/enable-datacollection?tabs=autoprovision-va](https://learn.microsoft.com/azure/defender-for-cloud/enable-datacollection?tabs=autoprovision-va)
    
-   [https://msdn.microsoft.com/en-us/library/mt704062.aspx](https://msdn.microsoft.com/en-us/library/mt704062.aspx)
    
-   [https://msdn.microsoft.com/en-us/library/mt704063.aspx](https://msdn.microsoft.com/en-us/library/mt704063.aspx) 
    
-   [https://learn.microsoft.com/rest/api/securitycenter/autoprovisioningsettings/list](https://msdn.microsoft.com/en-us/library/mt704063.aspx)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.