🛡️ Azure Virtual Machine Unapproved Extensions are installed🟢⚪

• Contextual name: 🛡️ Unapproved Extensions are installed🟢⚪
• ID: /ce/ca/azure/virtual-machine/uninstall-unapproved-extensions
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Similar Policies

• Cloud Conformity: Install Approved Extensions Only

Description

Open File

Description

For added security, only install organization-approved extensions on VMs.

Rationale

Azure virtual machine extensions are small applications that provide post-deployment configuration and automation tasks on Azure virtual machines. These extensions run with administrative privileges and could potentially access anything on a virtual machine. The Azure Portal and community provide several such extensions. Each organization should carefully evaluate these extensions and ensure that only those that are approved for use are actually implemented.

Impact

Functionality provided by unsupported extensions will be disabled.

Audit

From Azure Portal

1. Go to Virtual machines.
2. For each virtual machine, click the server name to open it.
3. In the new menu, under Settings, click Extensions + applications.
4. Ensure that all the listed extensions are approved by your organization for use.

From Azure CLI

Use the below command to list the extensions attached to a VM, and ensure the listed extensions are approved for use:

... see more

Remediation

Open File

Remediation

From Azure Portal

1. Go to Virtual machines.
2. For each virtual machine, go to Settings.
3. Click on Extensions + applications.
4. If there are unapproved extensions, uninstall them.

From Azure CLI

From the audit command identify the unapproved extensions, and use the below CLI command to remove an unapproved extension attached to VM:

az vm extension delete --resource-group {{resourceGroupName}} --vm-name {{vmName}} --name {{extensionName}}

From PowerShell

For each VM and each insecure extension from the Audit Procedure run the following command:

Remove-AzVMExtension -ResourceGroupName {{ResourceGroupName}} -Name {{ExtensionName}} -VMName {{VirtualMachineName}}

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v2.1.0 → 💼 7.5 Ensure that Only Approved Extensions Are Installed - Level 1 (Manual)			1		no data
💼 CIS Azure v3.0.0 → 💼 8.7 Ensure that Only Approved Extensions Are Installed (Manual)			1		no data
💼 Cloudaware Framework → 💼 Threat Protection			33		no data