# Azure VM Antimalware Not Enabled

> ZopNight marks a Linux Azure VM unprotected only when the discoverer fetched the IaaSAntimalware/Defender lookup set and the VM was provably absent from it. That is an authoritative false, never a missing-signal default. Windows VMs are skipped entirely, because Windows Server 2016 and later ship Microsoft Defender Antivirus built in.

Source: https://zop.dev/integrations/azure/recommendations/azure-vm-antimalware-not-enabled
Updated: 2026-08-19

---

## A lookup-set absence that counts as evidence

The Azure discoverer queries which VMs carry the IaaSAntimalware extension or a Microsoft
Defender for Endpoint onboarding, then stamps `antimalware_enabled` true or false per VM. The
crucial property: `"false"` is written only when that lookup set was successfully fetched and
the VM was not in it. So a false here is a positive statement rather than an inference from
missing data: the fleet was enumerated and this machine has no endpoint protection. When the
enricher has not run or the lookup failed, the key is absent and the rule abstains.

## Why no Windows VM ever appears in these findings

Windows Server 2016 and later ship Microsoft Defender Antivirus in the base image. Flagging a
Windows VM for lacking the IaaSAntimalware extension would accuse a protected machine of being
unprotected, so the rule checks the discoverer's `os_family` key (falling back to `os_type`)
and skips anything Windows. The guard deliberately fails open in the other direction: an
absent OS attribute does not assume Windows, because that assumption would silently suppress
genuine Linux findings.

## What an unprotected Linux host means in practice

Linux has no built-in equivalent of Defender AV. A flagged VM is running with no real-time
malware detection, no ransomware behavioural blocking, and nothing feeding endpoint telemetry
into Defender for Cloud. An auditor working through CIS or PCI-DSS endpoint-protection
controls will treat it as a straightforward gap, and an attacker who lands on the box operates
unobserved. Severity is high for that reason, though the finding itself carries no dollar
figure.

## Enumerate a VM's security extensions

```bash
az vm extension list -g <rg> --vm-name <vm> \
  --query "[].{name:name, publisher:publisher, state:provisioningState}" -o table
```

Look for `MDE.Linux` or a third-party endpoint agent in the list; an empty result on a Linux
VM corroborates the finding.

## Closing the gap

Onboard Microsoft Defender for Endpoint for Linux (the `MDE.Linux` extension) through Defender
for Cloud, or deploy the endpoint agent your organisation has standardised on, then enable
real-time protection and scheduled scans. Detection is reproducible with Reader alone;
ZopNight installs nothing on the machine.