AzPolicyAdvertizer

last sync: 2025-Aug-11 17:27:45 UTC

Configure machines to receive a vulnerability assessment provider

Azure BuiltIn Policy definition

Source

Azure Portal

Display name

Configure machines to receive a vulnerability assessment provider

13ce0167-8ca6-4048-8e6b-f996402e3c1b

Version

4.0.0
Details on versioning

Versioning

Versions supported for Versioning: 1
4.0.0
Built-in Versioning [Preview]

Category

Security Center
Microsoft Learn

Description

Azure Defender includes vulnerability scanning for your machines at no extra cost. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Security Center. When you enable this policy, Azure Defender automatically deploys the Qualys vulnerability assessment provider to all supported machines that don't already have it installed.

Cloud environments

AzureCloud = true
AzureUSGovernment = unknown
AzureChinaCloud = unknown

Available in AzUSGov

Unknown, no evidence if Policy definition is/not available in AzureUSGovernment

Mode

Indexed

Type

BuiltIn

Preview

False

Deprecated

False

Effect

Default
DeployIfNotExists
Allowed
DeployIfNotExists, Disabled

RBAC role(s)

Role Name	Role Id
Security Admin	fb1c8493-542b-48eb-b624-b4c8fea62acd

Rule aliases

THEN-ExistenceCondition (2)

Alias	Namespace	ResourceType	Path	PathIsDefault	DefaultPath	Modifiable
Microsoft.Security/assessments/status.cause	Microsoft.Security	assessments	properties.status.cause	True		False
Microsoft.Security/assessments/status.code	Microsoft.Security	assessments	properties.status.code	True		False

Rule resource types

IF (2)

Microsoft.Compute/virtualMachines
Microsoft.HybridCompute/machines

THEN-Deployment (2)

Microsoft.compute/virtualmachines
Microsoft.hybridcompute/machines

Compliance

The following 6 compliance controls are associated with this Policy definition 'Configure machines to receive a vulnerability assessment provider' (13ce0167-8ca6-4048-8e6b-f996402e3c1b)

Rows: 1-6 / 6
Columns:
Select all:
Control Domain
Control
Name
MetadataId
Category
Title
Owner
Requirements
Description
Info
Policy#
Close
Columns▼Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, **[empty]**, **[nonempty]**, **rgx:**
Learn more
TableFilter v0.7.3
https://www.tablefilter.com/
©2015-2025 Max Guglielmi
Close
?
Page of 1
Control	Name	MetadataId	Requirements	Description	Policy#

op.exp.2 Security configuration	op.exp.2 Security configuration	404 not found	n/a	n/a	112
op.exp.3 Security configuration management	op.exp.3 Security configuration management	404 not found	n/a	n/a	123
op.exp.4 Security maintenance and updates	op.exp.4 Security maintenance and updates	404 not found	n/a	n/a	78
op.exp.5 Change management	op.exp.5 Change management	404 not found	n/a	n/a	71
op.exp.6 Protection against harmful code	op.exp.6 Protection against harmful code	404 not found	n/a	n/a	61
op.mon.3 Monitoring	op.mon.3 Monitoring	404 not found	n/a	n/a	51

Initiatives usage

Rows: 1-3 / 3
Records:
Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, **[empty]**, **[nonempty]**, **rgx:**
Learn more
TableFilter v0.7.3
https://www.tablefilter.com/
©2015-2025 Max Guglielmi
Close
?
Page of 1
Initiative DisplayName	Initiative Id	Initiative Category	State	Type	polSet in AzUSGov

[Deprecated]: Deploy Microsoft Defender for Cloud configuration	Deploy-MDFC-Config	Security Center	Deprecated	ALZ
Deploy Microsoft Defender for Cloud configuration	Deploy-MDFC-Config_20240319	Security Center	GA	ALZ
Spain ENS	175daf90-21e1-4fec-b745-7b4c909aa94c	Regulatory Compliance	GA	BuiltIn	unknown

History

Date/Time (UTC ymd) (i)	Change type	Change detail
2022-05-16 16:31:13	change	Major, old suffix: preview (3.1.0-preview > 4.0.0)
2022-05-06 16:29:23	change	Minor, suffix remains equal (3.0.0-preview > 3.1.0-preview)
2022-02-04 18:25:37	change	Major, suffix remains equal (2.2.0-preview > 3.0.0-preview)
2021-09-13 16:35:32	change	Minor, suffix remains equal (2.1.0-preview > 2.2.0-preview)
2021-05-04 14:34:06	change	Minor, suffix remains equal (2.0.0-preview > 2.1.0-preview)
2021-03-10 14:52:46	change	Major, suffix remains equal (1.0.0-preview > 2.0.0-preview)
2021-03-09 14:37:41	add	13ce0167-8ca6-4048-8e6b-f996402e3c1b

JSON compare

compare mode: version left: version right:

3.1.0-preview → 4.0.0 RENAMED Viewed

@@ -1,13 +1,12 @@
 {
-    "displayName": "[Preview]: Configure machines to receive a vulnerability assessment provider",
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Azure Defender includes vulnerability scanning for your machines at no extra cost. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Security Center. When you enable this policy, Azure Defender automatically deploys the Qualys vulnerability assessment provider to all supported machines that don't already have it installed.",
     "metadata": {
         "category": "Security Center",
-        "preview": true,
-        "version": "3.1.0-preview"
     },
     "parameters": {
         "effect": {
             "type": "String",
@@ -61,12 +60,25 @@
                 "type": "Microsoft.Security/assessments",
                 "name": "ffff0522-1e88-47fc-8382-2a80ba848f5d",
                 "evaluationDelay": "PT60M",
                 "existenceCondition": {
-                    "field": "Microsoft.Security/assessments/status.code",
-                    "in": [
-                        "NotApplicable",
-                        "Healthy"
                     ]
                 },
                 "deployment": {
                     "properties": {

 {
+    "displayName": "Configure machines to receive a vulnerability assessment provider",
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Azure Defender includes vulnerability scanning for your machines at no extra cost. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Security Center. When you enable this policy, Azure Defender automatically deploys the Qualys vulnerability assessment provider to all supported machines that don't already have it installed.",
     "metadata": {
         "category": "Security Center",
+        "version": "4.0.0"
     },
     "parameters": {
         "effect": {
             "type": "String",
                 "type": "Microsoft.Security/assessments",
                 "name": "ffff0522-1e88-47fc-8382-2a80ba848f5d",
                 "evaluationDelay": "PT60M",
                 "existenceCondition": {
+                    "anyOf": [
+                        {
+                            "field": "Microsoft.Security/assessments/status.code",
+                            "equals": "NotApplicable"
+                        },
+                        {
+                            "allOf": [
+                                {
+                                    "field": "Microsoft.Security/assessments/status.code",
+                                    "equals": "Healthy"
+                                },
+                                {
+                                    "field": "Microsoft.Security/assessments/status.cause",
+                                    "equals": "[parameters('vaType')]"
+                                }
+                            ]
+                        }
                     ]
                 },
                 "deployment": {
                     "properties": {

JSON

api-version=2021-06-01
EPAC

{7 itemsdisplayName: "Configure machines to receive a vulnerability assessment provider",
policyType: "BuiltIn",
mode: "Indexed",
description: "Azure Defender includes vulnerability scanning for your machines at no extra cost. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Security Center. When you enable this policy, Azure Defender automatically deploys the Qualys vulnerability assessment provider to all supported machines that don't already have it installed.",
metadata: {2 itemscategory: "Security Center",
version: "4.0.0"
},
parameters: {2 itemseffect: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Effect",
description: "Enable or disable the execution of the policy"
},
allowedValues: [2 items"DeployIfNotExists",
"Disabled"
],
defaultValue: "DeployIfNotExists"
},
vaType: {4 itemstype: "String",
metadata: {2 itemsdisplayName: "Vulnerability assessment provider type",
description: "Select the vulnerability assessment solution to provision to machines."
},
allowedValues: [2 items"default",
"mdeTvm"
],
defaultValue: "default"
}
},
policyRule: {2 itemsif: {1 itemanyof: [2 items{2 itemsfield: "type",
equals: "Microsoft.Compute/virtualMachines"
},
{1 itemallOf: [2 items{2 itemsfield: "type",
equals: "Microsoft.HybridCompute/machines"
},
{2 itemsfield: "tags",
notContainsKey: "MDFCSecurityConnector"
}
]
}
]
},
then: {2 itemseffect: "[parameters('effect')]",
details: {6 itemstype: "Microsoft.Security/assessments",
name: "ffff0522-1e88-47fc-8382-2a80ba848f5d",
evaluationDelay: "PT60M",
existenceCondition: {1 itemanyOf: [2 items{2 itemsfield: "Microsoft.Security/assessments/status.code",
equals: "NotApplicable"
},
{1 itemallOf: [2 items{2 itemsfield: "Microsoft.Security/assessments/status.code",
equals: "Healthy"
},
{2 itemsfield: "Microsoft.Security/assessments/status.cause",
equals: "[parameters('vaType')]"
}
]
}
]
},
deployment: {1 itemproperties: {3 itemsmode: "Incremental",
template: {5 itemscontentVersion: "1.0.0.0",
$schema: "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
parameters: {3 itemsvmName: {1 itemtype: "String"
},
resourceType: {1 itemtype: "string"
},
vaType: {1 itemtype: "string"
}
},
variables: {1 itemresourceNameAndVaType: 🔍"[
    concat(
        parameters('vmName'),
       '/Microsoft.Security/',
         parameters('vaType')
    )
]"
},
resources: [2 items{4 itemscondition: 🔍"[
    equals(
        toLower(
            parameters('resourceType')
        ),
        toLower(
           'microsoft.compute/virtualmachines'
        )
    )
]",
type: "Microsoft.Compute/virtualMachines/providers/serverVulnerabilityAssessments",
name: "[variables('resourceNameAndVaType')]",
apiVersion: "2020-01-01"
},
{4 itemscondition: 🔍"[
    equals(
        toLower(
            parameters('resourceType')
        ),
        toLower(
           'microsoft.hybridcompute/machines'
        )
    )
]",
type: "Microsoft.HybridCompute/machines/providers/serverVulnerabilityAssessments",
name: "[variables('resourceNameAndVaType')]",
apiVersion: "2020-01-01"
}
]
},
parameters: {3 itemsvmName: {1 itemvalue: "[field('name')]"
},
resourceType: {1 itemvalue: "[field('type')]"
},
vaType: {1 itemvalue: "[parameters('vaType')]"
}
}
}
},
roleDefinitionIds: [1 item"/providers/Microsoft.Authorization/roleDefinitions/fb1c8493-542b-48eb-b624-b4c8fea62acd" Security Admin 
]
}
}
}
}

Configure machines to receive a vulnerability assessment provider

Azure BuiltIn Policy definition

TableFilter v0.7.3

TableFilter v0.7.3