VM Compliance: Windows machines should meet requirements of the Azure compute security baseline

[integyjc]

Hi All, im posting this here as i'm not sure if its an issue or something we are doing wrong!

We have three separate ALZ environments (different tenants), following ALZ deployment and creation of a VM within the ALZ, all end up with the following policy as non compliant

Initiative: Enforce Azure Compute Security Benchmark compliance auditing

Policy: Windows machines should meet requirements of the Azure compute security baseline

It seems this policy is looking for VMs to have the AzureWindowsBaseline Guest Assignment applied to them which they do not and the policy reports non compliant. I can't see anything in ALZDefault policies which is setup to configure this guest assignment.

Is this something people are handling separately to ALZ or are we expecting VMs to get the AzureWindowsBaseline guest assignment from an ALZ or DFC policy?

Any help much appreciated!