EDR solution should be installed on Virtual Machines

What does the recommendation "EDR solution should be installed on Virtual Machines" check?

Flags any Azure virtual machine that Defender for Cloud cannot confirm is running a supported endpoint detection and response (EDR) agent, such as Microsoft Defender for Endpoint or an approved non-Microsoft solution. The assessment is agentless: it reads the disk and machine metadata gathered when Defender for Servers Plan 2 or Defender CSPM is enabled, so it depends on agentless scanning being switched on rather than on any in-guest agent reporting back. It checks only that an EDR product is present; it does not verify that signatures are current, that the sensor is actively communicating, or that real-time protection is enabled. Separate 'EDR configuration issues should be resolved' recommendations cover those health and misconfiguration gaps.

Why does "EDR solution should be installed on Virtual Machines" matter?

A VM without EDR is a blind spot. Antivirus and network controls catch known patterns, but EDR is what surfaces the behaviour modern intrusions rely on: fileless payloads, living-off-the-land use of PowerShell and certutil, lateral movement and hands-on-keyboard ransomware staging. With no sensor on the host, an attacker who lands on that machine can dwell, escalate and stage exfiltration with nothing recording the process tree, and your responders have no telemetry to scope the breach afterwards. For a regulated organisation that turns one compromised server into an undetected incident with a far larger notification, downtime and recovery bill.

How do I fix "EDR solution should be installed on Virtual Machines"?

1. Enable Defender for Servers Plan 2 on the subscription in Microsoft Defender for Cloud (Environment settings > Defender plans), which keeps the native Defender for Endpoint integration on and auto-onboards the EDR sensor to supported Windows and Linux VMs as they appear. Plan 1 also delivers the EDR integration if you do not need Plan 2 posture features.
2. For VMs that are not picked up automatically, for example those built from generalised images, deploy the agent directly with the VM extension: 'az vm extension set --name MDE.Windows --publisher Microsoft.Azure.AzureDefenderForServers --vm-name <vm> --resource-group <rg>' on Windows, or '--name MDE.Linux' on Linux. Bicep authors add the same extension as a 'Microsoft.Compute/virtualMachines/extensions' resource so new VMs ship onboarded.
3. Enforce coverage at scale by assigning the built-in policy by its exact display name rather than a hardcoded GUID: pid=$(az policy definition list --query "[?displayName=='Endpoint Detection and Response (EDR) solution should be installed on Virtual Machines'].name" -o tsv); then 'az policy assignment create --name require-edr --policy "$pid" --scope <scope>' so unprotected machines are reported continuously.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled