Microsoft Defender Exploit Guard should be enabled on machines

What does the recommendation "Microsoft Defender Exploit Guard should be enabled on machines" check?

Audits whether Windows virtual machines have all four Microsoft Defender Exploit Guard components active: attack surface reduction, controlled folder access, network protection and exploit protection. The check runs through Azure Policy Guest Configuration, so it reads in-guest settings rather than the host. It only applies to Windows 10 1709, Windows Server 1803 and later, where Exploit Guard exists, so Linux machines and older Windows Server 2016 hosts fall outside its scope. It does not verify that Microsoft Defender for Endpoint is onboarded, that signatures are current, or that any specific attack surface reduction rule is set to block rather than audit. It only confirms the feature is switched on.

Why does "Microsoft Defender Exploit Guard should be enabled on machines" matter?

Exploit Guard is the layer that stops common intrusion behaviour before malware establishes itself: blocking Office macros that spawn child processes, ransomware that rewrites protected folders, and connections to known malicious domains. A machine that passes patching and antivirus checks can still be fully exposed here, because Exploit Guard ships disabled by default. If it is off, a phishing payload or a drive-by exploit hits a server with no behavioural defence, and the first signal you get is encrypted data or a beacon to a command-and-control host. Enabling it turns a class of opportunistic attacks into blocked events recorded for your security team instead of incidents.

How do I fix "Microsoft Defender Exploit Guard should be enabled on machines"?

1. Confirm the Azure Policy Guest Configuration extension and a system-assigned managed identity are present on the VM, then ensure Microsoft Defender Antivirus is the active antivirus with real-time protection on, because attack surface reduction and network protection will not run without it.
2. Turn the components on in the guest, for example with PowerShell: 'Set-MpPreference -EnableControlledFolderAccess Enabled' and 'Set-MpPreference -EnableNetworkProtection Enabled', and apply your attack surface reduction rules with 'Add-MpPreference -AttackSurfaceReductionRules_Ids <ruleId> -AttackSurfaceReductionRules_Actions Enabled'.
3. Audit your estate at scale by assigning the built-in definition by its display name rather than a hardcoded GUID: pid=$(az policy definition list --query "[?displayName=='Windows Defender Exploit Guard should be enabled on your machines'].name" -o tsv); az policy assignment create --name require-exploit-guard --policy "$pid" --scope <scope>. Note the older 'Deploy prerequisites to audit Windows VMs on which Windows Defender Exploit Guard is not enabled' definition is deprecated, so do not assign it; prerequisites are now handled by the central Guest Configuration onboarding.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled