Question

A financial services company must continuously verify that operating system-level settings inside hundreds of Azure Windows and Linux VMs comply with internal security baselines (for example, password complexity and specific registry values). They need centralized reporting of compliant versus non-compliant machines within Azure Policy dashboards, without deploying a separate third-party configuration tool. Which solution should you recommend?

Accepted Answer

Assign Azure Policy definitions that use the guest configuration (machine configuration) feature with an installed extension and managed identity on each VM.

Answer

Enable Azure Monitor VM insights and build a Log Analytics workbook that queries OS setting metrics.

Answer

Deploy Microsoft Defender for Cloud secure score recommendations and remediate flagged VMs manually.

Answer

Use Azure Automation State Configuration (DSC) to enforce settings and view drift in the Automation account.