Description:
Ensures that virtual machines run only organization-approved extensions, preventing unauthorized software from being installed through VM extensions and reducing configuration, security, and compliance risks.
Rationale:
VM extensions execute code inside the VM. Restricting extensions to an approved list prevents malicious or untested tools from being deployed and helps maintain a secure, standardized VM environment.
Impact:
Limiting VM extensions improves security and stability by blocking unauthorized or risky software. It reduces exposure to malware, minimizes configuration drift, and ensures workloads comply with security standards while maintaining control over what executes inside virtual machines.
Default value:
By default, no extensions are added to the virtual machines.
Test plan:
Log in to the Microsoft Azure Portal https://portal.azure.com
Navigate to Virtual machines.
Select a virtual machine.
Under Settings, select Extensions + applications.
Review the list of installed extensions.
Compare the installed extensions against the organization’s approved extension list.
Verify that no unapproved or unknown extensions are installed.
Repeat the above steps for all virtual machines in scope.
If any unapproved extensions are found, follow the Implementation Steps
Implementation Steps:
Log in to the Microsoft Azure Portal https://portal.azure.com
Navigate to Virtual machines.
Select a virtual machine.
Under Settings, select Extensions + applications.
Review the list of installed extensions.
Compare each installed extension against the organization’s approved extension list.
Select any extension that is not approved.
Click Uninstall to remove the unapproved extension.
Confirm the extension is removed successfully.
Repeat these steps for all virtual machines in scope.
Backout plan:
Log in to the Microsoft Azure Portal https://portal.azure.com
Navigate to Virtual machines.
Select the virtual machine where an extension was removed.
Under Settings, select Extensions + applications.
Click Add to install a new extension.
Select the required extension from the list.
Re-enter any required configuration details or credentials.
Click Create or Install to reinstall the extension.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensionsfeatures
https://docs.microsoft.com/en-us/powershell/module/az.compute/?view=azps7.5.0#vm-extensions