# Cis Azure Compute 20.7

> Ensure that Endpoint Protection for all Virtual Machines is installed

- Skill: `cyberstrikeus/cis-azure-compute-20-7` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-compute-20-7`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-compute-20-7/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-compute-20-7

---


# Ensure that Endpoint Protection for all Virtual Machines is installed

## Description

Install endpoint protection for all virtual machines.

## Rationale

Installing endpoint protection systems (like anti-malware for Azure) provides for real-time protection capability that helps identify and remove viruses, spyware, and other malicious software. These also offer configurable alerts when known-malicious or unwanted software attempts to install itself or run on Azure systems.

## Impact

Endpoint protection will incur an additional cost to you.

## Audit Procedure

### Using Azure Portal

1. Go to `Security Center`
2. Click the `Recommendations` blade
3. Ensure that there are no recommendations for `Endpoint Protection not installed on Azure VMs`

### Using Azure CLI

```bash
az vm show -g <MyResourceGroup> -n <MyVm> -d --query "resources[?type=='Microsoft.Compute/virtualMachines/extensions'].{ExtensionName:name}" -o table
```

If extensions are installed, it will list the installed extensions.

Look for extensions such as:
`EndpointSecurity || TrendMicroDSA* || Antimalware || EndpointProtection || SCWPAgent || PortalProtectExtension* || FileSecurity*`

Alternatively, you can employ your own endpoint protection tool for your OS.

## Expected Result

All virtual machines should have at least one endpoint protection extension installed, or an equivalent endpoint protection tool deployed.

## Remediation

### Using Azure Portal

Follow Microsoft Azure documentation to install endpoint protection from the security center. Alternatively, you can employ your own endpoint protection tool for your OS.

## Default Value

By default Endpoint Protection is disabled.

## References

1. https://docs.microsoft.com/en-us/azure/security-center/security-center-install-endpoint-protection
2. https://docs.microsoft.com/en-us/azure/security/azure-security-antimalware
3. https://docs.microsoft.com/en-us/cli/azure/vm/extension?view=azure-cli-latest#az_vm_extension_list
4. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-endpoint-security#es-1-use-endpoint-detection-and-response-edr

## Profile

Level 2 | Manual