Azure Local machine(s) should have consistently enforced application control policies

What does the recommendation "Azure Local machine(s) should have consistently enforced application control policies" check?

Flags any Azure Local (formerly Azure Stack HCI) instance whose nodes are not all running the Microsoft Application Control (WDAC) base policy in Enforced mode, or where the applied policies differ from node to node within the same cluster. Application Control is a software allowlist: in Enforced mode it permits only the drivers and binaries described by the policy and blocks everything else. The control checks the policy mode and consistency reported by the cluster, not whether your supplemental policies are well formed and not whether the underlying operating system is patched. A node sitting in Audit mode, where untrusted code still runs and only logs an event, is treated as non-compliant.

Why does "Azure Local machine(s) should have consistently enforced application control policies" matter?

Azure Local nodes host the storage and compute for every virtual machine on the cluster, so a single node that drops to Audit mode is an opening to run unsigned tooling, ransomware loaders or living-off-the-land binaries directly on the hypervisor. From there an attacker can reach the management plane and every guest workload at once. Inconsistent policies are just as dangerous: an admin pins one node to Audit to install software, forgets to switch it back, and that node quietly becomes the soft target the rest of the cluster was hardened to prevent. Keeping all nodes in Enforced mode with identical policies removes that drift and keeps the attack surface of the platform itself genuinely small.

How do I fix "Azure Local machine(s) should have consistently enforced application control policies"?

1. Connect to a node with local administrator or AzureStackLCMUser credentials and run 'Get-AsWdacPolicyMode' to see the current mode reported per node, confirming which nodes are in Audit rather than Enforced.
2. Bring the whole cluster back into line with 'Enable-AsWdacPolicy -Mode Enforced', which drives the change through the Orchestrator across all nodes (use 'Enable-ASLocalWDACPolicy' only when you deliberately need to change a single node), then re-run 'Get-AsWdacPolicyMode' to confirm every node now reports Enforced.
3. For legitimate non-Microsoft software that the base policy blocks, build a supplemental policy with 'New-CIPolicy -MultiplePolicyFormat -Level Publisher -ScanPath <dir>' and deploy it with 'Add-ASWDACSupplementalPolicy -Path <policy>.xml' rather than leaving any node in Audit mode, so the allowlist is extended deliberately instead of disabled.

# Step 1: give a machine the system-assigned identity the agent needs to authenticate.
az vm identity assign --resource-group prod-apps --name legacy-app-01

# Install the machine configuration agent (instance name MUST be AzurePolicyforWindows / AzurePolicyforLinux).
az vm extension set \
  --resource-group prod-apps --vm-name legacy-app-01 \
  --publisher Microsoft.GuestConfiguration \
  --name ConfigurationforLinux \
  --extension-instance-name AzurePolicyforLinux \
  --enable-auto-upgrade true

# Step 2: assign the deploy-prerequisites initiative so identity + agent self-heal across the scope.
# Look the initiative up by its EXACT display name rather than pasting a GUID.
scope="/subscriptions/00000000-0000-0000-0000-000000000000"
setid=$(az policy set-definition list \
  --query "[?displayName=='Deploy prerequisites to enable Guest Configuration policies on virtual machines'].name" -o tsv)
az policy assignment create \
  --name deploy-gc-prereqs \
  --policy-set-definition "$setid" \
  --scope "$scope" \
  --location uksouth \
  --mi-system-assigned

# Assign the Windows compute security baseline initiative (look it up by display name too).
baseid=$(az policy set-definition list \
  --query "[?displayName=='Windows machines should meet requirements for the Azure compute security baseline'].name" -o tsv)
az policy assignment create \
  --name assign-win-baseline \
  --policy-set-definition "$baseid" \
  --scope "$scope"