Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)

What does the recommendation "Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)" check?

Compares the in-guest operating system configuration of each Linux VM and Azure Arc-enabled server against the Linux compute security baseline in the Microsoft Cloud Security Benchmark, covering hardening rules such as file permissions, kernel parameters, password policy and service settings. The reading is taken inside the machine by the Azure machine configuration extension (formerly the Guest Configuration extension) and surfaced through the built-in audit policy 'Linux machines should meet requirements for the Azure compute security baseline'. It only evaluates OS-level baseline rules: it does not scan for missing software patches or CVEs, and it does not assess Windows hosts, network exposure or the Azure control-plane configuration of the VM.

Why does "Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)" matter?

An unhardened Linux host gives an attacker who lands a foothold an easier path to escalate and persist: world-writable files, weak SSH and sudo defaults or permissive kernel settings turn a single compromised account into root. These deviations rarely show up in patch reports, so a fully patched fleet can still be quietly non-compliant for months. Because the baseline mirrors recognised CIS-style controls, unresolved findings also break the evidence you need for SOC 2, ISO 27001 and similar audits, turning a technical gap into a failed control and a remediation deadline.

How do I fix "Vulnerabilities in security configuration on your Linux machines should be remediated (powered by Guest Configuration)"?

1. Confirm the assessment can run: enable Microsoft Defender for Servers Plan 2 on the subscription, then install the machine configuration extension with a system-assigned managed identity, for example 'az vm extension set --publisher Microsoft.GuestConfiguration --name ConfigurationforLinux --extension-instance-name AzurePolicyforLinux --resource-group <rg> --vm-name <vm> --enable-auto-upgrade true' and 'az vm identity assign --resource-group <rg> --name <vm>'.
2. Deploy the prerequisites across the fleet rather than per VM by looking up and assigning the built-in initiative: 'pid=$(az policy set-definition list --query "[?displayName=='Deploy prerequisites to enable Guest Configuration policies on virtual machines'].name" -o tsv)' then 'az policy assignment create --name gc-prereqs --policy-set-definition "$pid" --scope <subscription-scope> --location <region> --mi-system-assigned'.
3. Open the recommendation in Defender for Cloud, expand the failed findings to see each rule and its expected value, then remediate inside the OS (correct the file permission, sudoers entry or sysctl setting) and re-run; bake the fixes into your golden image or configuration management so rebuilt machines start compliant.

# Step 1: give a machine the system-assigned identity the agent needs to authenticate.
az vm identity assign --resource-group prod-apps --name legacy-app-01

# Install the machine configuration agent (instance name MUST be AzurePolicyforWindows / AzurePolicyforLinux).
az vm extension set \
  --resource-group prod-apps --vm-name legacy-app-01 \
  --publisher Microsoft.GuestConfiguration \
  --name ConfigurationforLinux \
  --extension-instance-name AzurePolicyforLinux \
  --enable-auto-upgrade true

# Step 2: assign the deploy-prerequisites initiative so identity + agent self-heal across the scope.
# Look the initiative up by its EXACT display name rather than pasting a GUID.
scope="/subscriptions/00000000-0000-0000-0000-000000000000"
setid=$(az policy set-definition list \
  --query "[?displayName=='Deploy prerequisites to enable Guest Configuration policies on virtual machines'].name" -o tsv)
az policy assignment create \
  --name deploy-gc-prereqs \
  --policy-set-definition "$setid" \
  --scope "$scope" \
  --location uksouth \
  --mi-system-assigned

# Assign the Windows compute security baseline initiative (look it up by display name too).
baseid=$(az policy set-definition list \
  --query "[?displayName=='Windows machines should meet requirements for the Azure compute security baseline'].name" -o tsv)
az policy assignment create \
  --name assign-win-baseline \
  --policy-set-definition "$baseid" \
  --scope "$scope"