File integrity monitoring should be enabled on machines

What does the recommendation "File integrity monitoring should be enabled on machines" check?

Flags Azure virtual machines and Arc-enabled servers that are in scope for Defender for Servers Plan 2 but do not have file integrity monitoring (FIM) reporting change data. FIM watches a defined set of operating system binaries, the Windows registry, application files and Linux system files, and records when one is created, deleted or modified, including changes to size, content hash or access control lists. It is a detection control only: it does not block, quarantine or roll back a change, and it tells you nothing about machines outside Plan 2, files outside the configured monitoring rules, or running process and memory activity, which other Defender for Servers signals cover.

Why does "File integrity monitoring should be enabled on machines" matter?

When an attacker gains a foothold they usually touch the file system: dropping a web shell, swapping a signed binary, editing a startup script or planting a registry run key for persistence. Without FIM those edits leave no security trail, so the change is invisible until it is exploited and the incident is already under way. FIM gives you a tamper-evidence record that feeds threat detection and post-incident investigation: a known-good baseline, a timestamped log of every deviation and the alerts an analyst needs to scope a breach. Losing that record means slower detection, a weaker forensic position and a likely gap against PCI DSS, HIPAA, NIST and SOX, all of which expect file integrity monitoring on systems handling regulated data.

How do I fix "File integrity monitoring should be enabled on machines"?

1. Confirm Defender for Servers Plan 2 is active on the subscription, because FIM is a Plan 2 feature and is off by default: az security pricing create -n VirtualMachines --tier Standard --subplan P2. The legacy FIM built on the Log Analytics agent (MMA) has been retired and AMA-based onboarding is discontinued, so target the current Microsoft Defender for Endpoint based experience and migrate any old configuration rather than re-enabling the deprecated agent.
2. Ensure each machine runs the Defender for Endpoint agent (Windows client 10.8799 or later, Linux 30.124082 or later) and that non-Azure servers are connected through Azure Arc, since FIM collects change data through MDE.
3. In the Azure portal open Microsoft Defender for Cloud, then Environment settings, select the subscription, open Settings on the Defender for Servers plan, switch File Integrity Monitoring to On, choose Edit configuration, select the Log Analytics workspace that will store the change data and enable the recommended file and registry rules. There is no built-in Azure Policy for this recommendation, so do not try to assign one: the plan-level toggle is the enforcement point and it cascades to every in-scope machine under the subscription that has the Defender for Endpoint agent, so enable it once per subscription rather than per machine.

# 1. Ensure the subscription is on Defender for Servers Plan 2 (subplan P2).
#    FIM is a Plan 2 capability; Plan 1 cannot satisfy the recommendation.
az security pricing create \
  --name VirtualMachines \
  --tier standard \
  --subplan P2

# 2. Enable file integrity monitoring and select the workspace that stores
#    change events. This is configured in the Defender for Servers plan
#    settings (Azure portal or the Microsoft.Security/pricings REST API);
#    there is no dedicated 'az' flag to toggle FIM itself. Point it at a
#    Log Analytics workspace the security team actually reviews, and confirm
#    the Defender for Endpoint agent meets the minimum version on each host
#    (Windows down-level 10.8799+, Linux 30.124082+).

# 3. Ratchet it shut: assign the built-in policy by EXACT display name so the
#    fleet is continuously assessed for FIM coverage. Look the id up at
#    runtime rather than hardcoding a definition GUID.
pid=$(az policy definition list \
  --query "[?displayName=='File integrity monitoring should be enabled on machines'].name" \
  -o tsv)

az policy assignment create \
  --name require-fim-on-machines \
  --display-name "Require file integrity monitoring on machines" \
  --policy "$pid" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"