| name | cis-azure-foundations-8.1.11 |
| description | Ensure That Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","security","defender","system-updates"] |
| cis_id | 8.1.11 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
8.1.11 Ensure That Microsoft Defender Recommendation for 'Apply system updates' status is 'Completed' (Automated)
Description
Ensure that the Microsoft Defender for Cloud recommendation for applying system updates has been resolved and its status shows as 'Completed', indicating all virtual machines have the latest security and critical updates installed.
Rationale
Keeping virtual machines up to date with the latest security and critical updates is essential for maintaining a strong security posture. Unpatched systems are a primary attack vector for adversaries. Microsoft Defender for Cloud continuously assesses the update status of machines and generates recommendations when updates are missing. Ensuring the 'Apply system updates' recommendation is completed confirms that all monitored machines have been patched.
Impact
Applying system updates may require maintenance windows and can cause temporary service disruption during reboots. Organizations should plan update schedules to minimize impact on production workloads. Automatic update mechanisms (e.g., Azure Update Management) can help streamline this process.
Audit Procedure
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
- Under
General, click Recommendations.
- In the search box, type
Apply system updates.
- Verify that the recommendation status shows
Completed (green checkmark).
- If the status is
Not Completed, click the recommendation to see which resources are missing updates.
From Azure CLI:
az security assessment list --query "[?displayName=='System updates should be installed on your machines'].{Name:displayName, Status:status.code}" -o table
Ensure Status shows Healthy for all assessments.
From PowerShell:
Get-AzSecurityAssessment | Where-Object {$_.DisplayName -like "*System updates*"} | Select-Object DisplayName, @{N="Status";E={$_.Status.Code}}
Ensure all results show Healthy.
Expected Result
The 'Apply system updates' recommendation should show status Completed or all assessments should return Healthy.
Remediation
From Azure Portal:
- Go to
Microsoft Defender for Cloud.
