Allow list rules in your adaptive application control policy should be updated

What does the recommendation "Allow list rules in your adaptive application control policy should be updated" check?

Flags machine groups managed by Microsoft Defender for Cloud's adaptive application controls where Defender's machine learning has spotted a new process running that is not yet covered by an allow list rule. It applies only to groups already configured in audit mode under Defender for Servers Plan 2, and it is about keeping the publisher, path and hash rules current as software changes. It does not check whether adaptive application controls are switched on in the first place (a separate recommendation covers that), it does not enforce blocking, and it does not extend to non-grouped machines or to App Control for Business (formerly WDAC) configured outside Defender for Cloud. Note that this recommendation and the underlying adaptive application controls feature are deprecated following retirement of the Log Analytics (MMA) agent, so treat findings as historical and plan a migration off it.

Why does "Allow list rules in your adaptive application control policy should be updated" matter?

An allow list is only as good as it is current. When developers ship a new build, patch a runtime or add a tool, the executable signature or path changes, and the stale policy starts generating noise: either legitimate work trips audit alerts, or operators quietly widen rules until the list no longer means anything. Both outcomes erode the control. The whole value of allowlisting is that anything unrecognised stands out as a candidate for malware, banned software or an outdated, vulnerable version, so a drifting list lets a genuinely malicious binary blend into the alert backlog. Keeping rules updated preserves a clean signal and the licence-compliance and oversight benefits that justified turning the feature on.

How do I fix "Allow list rules in your adaptive application control policy should be updated"?

1. In the Azure portal open Microsoft Defender for Cloud, go to Workload protections, then Adaptive application controls, and select the Configured tab to list the VM groups that have an allow list policy.
2. Open the flagged group and review the Recommended applications that Defender's machine learning has surfaced; confirm each is genuinely known-safe, then add it as a Publisher rule (preferred, for signed apps) or a Path or Hash rule for unsigned binaries, and select Save.
3. There is no built-in Azure Policy or 'az' command that updates allow list rules for you (only audit assessment and the REST API 'PUT applicationWhitelistings' exist), so script ongoing maintenance against that REST API, or migrate to App Control for Business and Defender for Endpoint, which is the supported successor now that this feature is deprecated.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled