Endpoint protection should be installed on machines

What does the recommendation "Endpoint protection should be installed on machines" check?

Flags virtual machines and Arc-connected servers where Defender for Cloud cannot confirm a running endpoint protection agent. On Windows it runs Get-MpComputerStatus and marks the machine unhealthy when AMServiceEnabled returns false; a supported third-party antivirus or EDR product reported through Defender for Cloud counts as healthy too. It only checks that an agent is present and its core service is running. It does not assess whether real-time protection, signature freshness, behaviour monitoring or on-access scanning are healthy, because those live under the separate 'Endpoint protection health issues should be resolved' recommendation. Powered-off machines are a known gotcha: since the control was revised they drop out of the results entirely rather than sitting in the not-applicable or healthy lists, so a stopped VM is neither passing nor failing here.

Why does "Endpoint protection should be installed on machines" matter?

A server with no running endpoint agent has no signature scanning, no behavioural detection and no telemetry feeding Defender for Cloud, so commodity malware, ransomware loaders and post-exploitation tooling can execute unseen. These hosts are often the ones an attacker pivots to precisely because they are quiet, and the first signal you get is the encryption note rather than an alert. The gap also blinds your security operations team: without the agent there is no process tree, no command-line capture and nothing to hunt across, so even a known incident becomes hard to scope. Beyond the breach itself, missing endpoint protection is a direct finding against frameworks such as CIS, PCI DSS and ISO 27001, so an unhealthy fleet turns into audit exceptions and remediation deadlines that the business has to fund and explain.

How do I fix "Endpoint protection should be installed on machines"?

1. Enable the Microsoft Defender for Servers plan on the subscription, then turn on the Defender for Endpoint integration so the MDE.Windows or MDE.Linux extension is deployed automatically to every supported machine; this is the path that also gives Defender for Cloud the EDR telemetry it expects.
2. For Windows Server where you would rather not run a third-party product, confirm the built-in Microsoft Defender Antivirus service is enabled rather than in passive mode by checking Get-MpComputerStatus, since a passive or disabled service is what trips this control.
3. If you standardise on CrowdStrike, SentinelOne or another supported solution, install its agent and let the machine report through that product; bake the agent or the MDE extension into your golden image and Bicep or Terraform modules so new VMs are protected from first boot.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled