Adaptive application controls for defining safe applications should be enabled on your machines

What does the recommendation "Adaptive application controls for defining safe applications should be enabled on your machines" check?

Flags machines onboarded to Defender for Servers that do not have adaptive application controls configured. The feature uses machine learning to watch which executables run on a group of similar VMs, then proposes an allowlist of known-safe applications and raises a security alert whenever anything outside that list runs. Important: it is audit and alert only. On Windows it builds AppLocker rules in audit mode, so it logs unexpected applications rather than blocking them, and it does not apply to Windows machines that already have AppLocker set through Group Policy or Local Security Policy. It is not anti-malware, not a vulnerability scan, and not enforcement. Note that this feature depends on the retired Log Analytics agent and Microsoft has deprecated it, so on current subscriptions the recommendation may no longer appear or be actionable.

Why does "Adaptive application controls for defining safe applications should be enabled on your machines" matter?

An allowlist of known-good binaries is one of the strongest defences against attacker tooling, living-off-the-land binaries and ransomware droppers, because anything unrecognised running on a server is exactly the signal you want surfaced fast. Without it, a malicious payload that lands on a production VM runs silently alongside legitimate workloads and your first sign of compromise is often the impact itself: encrypted disks, exfiltrated data or a foothold used to move laterally. The business consequence is a longer dwell time and a wider blast radius, which is the difference between containing one host and disclosing a breach. Because the original feature is deprecated, the real risk today is leaving a coverage gap: relying on a control that no longer reports while assuming application execution is still being watched.

How do I fix "Adaptive application controls for defining safe applications should be enabled on your machines"?

1. Recognise that adaptive application controls is deprecated with the Log Analytics agent (MMA) retirement, so do not invest in re-enabling it. Confirm the gap by checking Defender for Cloud recommendations for any remaining 'Adaptive application controls' entry and treat it as informational only.
2. Enable the supported replacement: turn on Defender for Servers Plan 2 on the subscription, then enable the Microsoft Defender for Endpoint integration and agentless machine scanning under Environment settings. These deliver behavioural execution detection and posture findings without the legacy agent. Assign the relevant built-in policy by exact name rather than a hardcoded GUID, for example: pid=$(az policy definition list --query "[?displayName=='Configure machines to receive a vulnerability assessment provider'].name" -o tsv); az policy assignment create --name aac-replacement --policy "$pid" --scope /subscriptions/<sub-id> (substitute the precise definition your standard requires).
3. Where you genuinely need execution control on Windows servers, implement Windows Defender Application Control (WDAC) or AppLocker directly through Intune or Group Policy and move from audit to enforce once your allowlist is validated, since Defender for Cloud no longer manages this for you.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled