Question

A retail company runs 400 Windows and Linux VMs across Azure and AWS. Security leadership wants the architecture to (1) continuously assess each server's OS configuration against a recognized hardening standard, (2) surface deviations as actionable recommendations that roll up into a single organization-wide posture metric, and (3) do so without deploying a separate third-party configuration tool. Which design should the architect specify?

Accepted Answer

Enable Defender for Servers Plan 2 with the machine configuration (guest configuration) audit of the Microsoft Cloud Security Benchmark compute baselines, and track remediation through Defender for Cloud Secure Score.

Answer

Deploy Azure Update Manager to all machines and use its compliance dashboard as the authoritative posture metric for OS hardening.

Answer

Onboard all servers to Microsoft Sentinel and build a custom workbook that queries Syslog and SecurityEvent tables to compute a hardening score.

Answer

Apply Azure Policy deny effects that block VM creation unless a CIS-hardened marketplace image is used, relying on that gate as the posture measurement.