cis-azure-foundations-8-5

name	cis-azure-foundations-8.5
description	Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","security","defender","vulnerability-assessment"]
cis_id	8.5
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

8.5 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On' (Automated)

Description

Ensure that the auto provisioning setting for vulnerability assessment for machines is enabled in Microsoft Defender for Cloud, allowing automatic deployment of a vulnerability assessment solution to all supported virtual machines.

Rationale

Vulnerability assessment is a critical component of any security program. Without automated vulnerability scanning, organizations rely on manual or ad-hoc scanning, which often results in incomplete coverage and delayed identification of vulnerabilities. Enabling auto provisioning ensures that a vulnerability assessment agent is automatically deployed to all supported virtual machines as they are created or discovered, providing consistent and comprehensive vulnerability coverage across the environment. This ensures no machine is missed and vulnerabilities are identified promptly.

Impact

Enabling auto provisioning deploys a vulnerability assessment agent (Microsoft Defender Vulnerability Management or a qualified third-party solution) to all supported virtual machines. This may consume additional compute resources on each VM. The agent will perform regular vulnerability scans, which may generate network traffic and consume I/O resources during scan windows. Organizations should be aware that scan results will be reported to Microsoft Defender for Cloud.

Audit Procedure

From Azure Portal:

1. Go to Microsoft Defender for Cloud.
2. Under Management, click Environment settings.
3. Click the name of a subscription.
4. Select the Settings & monitoring blade (or Auto provisioning).
5. Locate Vulnerability assessment for machines.
6. Verify that the toggle is set to On.

From Azure CLI:

az security auto-provisioning-setting list --query "[?name=='default'].{Name:name, AutoProvision:autoProvision}" -o table

Check the auto-provisioning settings. Then verify the specific vulnerability assessment configuration:

az rest --method get --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/serverVulnerabilityAssessmentsSettings?api-version=2022-01-01-preview"

Verify that the vulnerability assessment setting shows auto-provisioning is enabled.

From PowerShell:

Get-AzSecurityAutoProvisioningSetting | Select-Object Name, AutoProvision