# Sanitized Azure Machine Configuration evidence

- Scenario: **Final**
- Captured UTC: **2026-08-12T12:37:25.2043168Z**

## Resource inventory

```text
Name                                                                Type                                                   Location
------------------------------------------------------------------  -----------------------------------------------------  ----------
pip-nat-machine-config-we                                           Microsoft.Network/publicIPAddresses                    westeurope
nat-machine-config-we                                               Microsoft.Network/natGateways                          westeurope
nsg-machine-config-workload-we                                      Microsoft.Network/networkSecurityGroups                westeurope
vnet-machine-config-we                                              Microsoft.Network/virtualNetworks                      westeurope
id-machine-config-package-we                                        Microsoft.ManagedIdentity/userAssignedIdentities       westeurope
<storage-account-redacted>                                         Microsoft.Storage/storageAccounts                      westeurope
privatelink.blob.core.windows.net                                   Microsoft.Network/privateDnsZones                      global
privatelink.blob.core.windows.net/link-machine-config-vnet-we       Microsoft.Network/privateDnsZones/virtualNetworkLinks  global
pe-machine-config-blob-we                                           Microsoft.Network/privateEndpoints                     westeurope
pe-machine-config-blob-we.nic.<guid-redacted>  Microsoft.Network/networkInterfaces                    westeurope
law-machine-config-deep-dive-we                                     Microsoft.OperationalInsights/workspaces               westeurope
nic-vm-mc-ws2022-we                                                 Microsoft.Network/networkInterfaces                    westeurope
vm-mc-ws2022-we                                                     Microsoft.Compute/virtualMachines                      westeurope
vm-mc-ws2022-we_OsDisk_1_9f30cd96d26445dea31d7368f7b8900b           Microsoft.Compute/disks                                westeurope
nic-vm-mc-ws2025-we                                                 Microsoft.Network/networkInterfaces                    westeurope
vm-mc-ws2025-we                                                     Microsoft.Compute/virtualMachines                      westeurope
vm-mc-ws2025-we_disk1_73b5f6b6503949388ff722de86755733              Microsoft.Compute/disks                                westeurope
vm-mc-ws2022-we/ConfigurationforWindows                             Microsoft.Compute/virtualMachines/extensions           westeurope
vm-mc-ws2022-we/AzureMonitorWindowsAgent                            Microsoft.Compute/virtualMachines/extensions           westeurope
vm-mc-ws2025-we/AzureMonitorWindowsAgent                            Microsoft.Compute/virtualMachines/extensions           westeurope
dcr-machine-config-events-we                                        Microsoft.Insights/dataCollectionRules                 westeurope
vm-mc-ws2025-we/ConfigurationforWindows                             Microsoft.Compute/virtualMachines/extensions           westeurope
snap-vm-mc-ws2022-recovery-we                                       Microsoft.Compute/snapshots                            westeurope
```

## Private VM network state

```text
[
  {
    "Name": "vm-mc-ws2022-we",
    "Private": [
      "<ip-redacted>"
    ],
    "Public": []
  },
  {
    "Name": "vm-mc-ws2025-we",
    "Private": [
      "<ip-redacted>"
    ],
    "Public": []
  }
]
```

## VM tags and identities

```text
Name             Ring    Role         IdentityType
---------------  ------  -----------  ----------------------------
vm-mc-ws2022-we  Pilot   Baseline     SystemAssigned, UserAssigned
vm-mc-ws2025-we  Pilot   Application  SystemAssigned, UserAssigned
```

## NSG custom rules

```text

```

## Storage network posture

```text
{
  "AllowBlobPublic": false,
  "AllowSharedKey": false,
  "DefaultAction": "Deny",
  "MinimumTls": "TLS1_2",
  "PublicNetworkAccess": "Disabled"
}
```

## Private Endpoint connection

```text
{
  "Connection": "Approved",
  "GroupIds": [
    "blob"
  ],
  "State": "Succeeded"
}
```

## Machine Configuration extensions

```text
Name                      Version    State
------------------------  ---------  ---------
AzureMonitorWindowsAgent  1.44       Succeeded
ConfigurationforWindows   1.29       Succeeded
```

## Application VM extensions

```text
Name                      Version    State
------------------------  ---------  ---------
AzureMonitorWindowsAgent  1.44       Succeeded
ConfigurationforWindows   1.29       Succeeded
```

## Guestconfig CLI baseline assignment

```text
Name
----------------------------------------
WorkshopWindowsBaseline$pidwjsetk5gzfjrc
```

## Guestconfig CLI application assignment

```text
Name
----------------------------------------
WorkshopWindowsBaseline$pidj7g3lbs7erpey
```

## Policy assignments

```text
Name                 DisplayName                                    EnforcementMode
-------------------  ---------------------------------------------  -----------------
mc-workshop-enforce  Azure Workshopz Machine Configuration Enforce  Default
```

## Policy compliance states

```text
[
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountshoulduseaprivatelinkconnectionmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountshoulduseaprivatelinkconnectionexaromonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountshoulduseaprivatelinkconnectionexdatabricksmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldpreventsharedkeyaccessexdatabricks",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldpreventsharedkeyaccessexaro",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldpreventsharedkeyaccess",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldrestrictnetworkaccessusingvirtualnetworkrulesexdatabricksmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldrestrictnetworkaccessusingvirtualnetworkrulesexaromonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storageaccountsshouldrestrictnetworkaccessusingvirtualnetworkrulesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "storagedisallowpublicaccess",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "classicstorageaccountsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "securetransfertostorageaccountmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.storage/storageaccounts/<storage-account-redacted>",
    "State": "Compliant"
  },
  {
    "Assignment": "mc-workshop-enforce",
    "Reference": "enforce-application",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowsdefenderexploitguardmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowsguestconfigbaselinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowswebserversshouldbeconfiguredtousesecurecommunicationprotocolsmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcwindowsdiskencryptionmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "serversecretfindingsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "nextgenerationfirewallmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "disableipforwardingmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "azurebackupshouldbeenabledforvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "restrictaccesstomanagementportsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "serversqldbvulnerabilityassesmentmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "networksecuritygroupsoninternalvirtualmachinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "networksecuritygroupsonvirtualmachinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "servervulnerabilityassessment",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "systemupdatesv2monitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "virtualmachinesandvirtualmachinescalesetsshouldhaveencryptionathostenabled",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "previewsecurebootshouldbeenabledonsupportedwindowsvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "vtpmshouldbeenabledonsupportedvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "systemupdatesautoassessmentmode",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcextonvmmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "classiccomputevmsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "jitnetworkaccessmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcextonvmwithnosamimonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2025-we/extensions/configurationforwindows",
    "State": "Compliant"
  },
  {
    "Assignment": "mc-workshop-enforce",
    "Reference": "enforce-baseline",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowswebserversshouldbeconfiguredtousesecurecommunicationprotocolsmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowsguestconfigbaselinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcwindowsdiskencryptionmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "windowsdefenderexploitguardmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "serversecretfindingsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "serversqldbvulnerabilityassesmentmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "disableipforwardingmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "nextgenerationfirewallmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "azurebackupshouldbeenabledforvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "restrictaccesstomanagementportsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "networksecuritygroupsonvirtualmachinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "virtualmachinesandvirtualmachinescalesetsshouldhaveencryptionathostenabled",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "previewsecurebootshouldbeenabledonsupportedwindowsvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "servervulnerabilityassessment",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "vtpmshouldbeenabledonsupportedvirtualmachinesmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "jitnetworkaccessmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "systemupdatesautoassessmentmode",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "networksecuritygroupsoninternalvirtualmachinesmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "systemupdatesv2monitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "classiccomputevmsmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcextonvmmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "gcextonvmwithnosamimonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.compute/virtualmachines/vm-mc-ws2022-we/extensions/configurationforwindows",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "networkwatchershouldbeenabledmonitoringeffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.network/virtualnetworks/vnet-machine-config-we",
    "State": "Compliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "azurefirewalleffect",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.network/virtualnetworks/vnet-machine-config-we",
    "State": "NonCompliant"
  },
  {
    "Assignment": "SecurityCenterBuiltIn",
    "Reference": "vnetenableddosprotectionmonitoring",
    "Resource": "/subscriptions/<subscription-redacted>/resourcegroups/rg-machine-configuration-deep-dive-we/providers/microsoft.network/virtualnetworks/vnet-machine-config-we",
    "State": "Compliant"
  }
]
```

## Machine Configuration Resource Graph

```text
Vm               Assignment                                Compliance    Start                 End
---------------  ----------------------------------------  ------------  --------------------  --------------------
vm-mc-ws2025-we  AuditSecureProtocol                       Compliant     2026-08-12T09:23:47Z  2026-08-12T09:24:16Z
vm-mc-ws2022-we  AuditSecureProtocol                       Compliant     2026-08-12T09:58:45Z  2026-08-12T09:59:12Z
vm-mc-ws2025-we  AzureWindowsBaseline                      NonCompliant  2026-08-12T09:24:57Z  2026-08-12T09:49:02Z
vm-mc-ws2022-we  AzureWindowsBaseline                      NonCompliant  2026-08-12T10:02:09Z  2026-08-12T10:17:06Z
vm-mc-ws2022-we  AzureWindowsVMEncryptionCompliance        NonCompliant  2026-08-12T10:01:45Z  2026-08-12T10:02:07Z
vm-mc-ws2025-we  AzureWindowsVMEncryptionCompliance        NonCompliant  2026-08-12T09:49:08Z  2026-08-12T09:49:33Z
vm-mc-ws2025-we  WindowsDefenderExploitGuard               NonCompliant  2026-08-12T11:58:02Z  2026-08-12T11:58:37Z
vm-mc-ws2022-we  WindowsDefenderExploitGuard               NonCompliant  2026-08-12T11:55:02Z  2026-08-12T11:55:36Z
vm-mc-ws2025-we  WorkshopWindowsBaseline$pidj7g3lbs7erpey  Compliant     2026-08-12T12:15:56Z  2026-08-12T12:22:21Z
vm-mc-ws2022-we  WorkshopWindowsBaseline$pidwjsetk5gzfjrc  Compliant     2026-08-12T12:27:55Z  2026-08-12T12:29:58Z
```

## Policy remediation state

```text
Name                                         State      Created                       Completed
-------------------------------------------  ---------  ----------------------------  ----------------------------
mc-remediate-final-application-dd832b7b      Succeeded  2026-08-12T12:18:04.4032049Z  2026-08-12T12:19:23.7058403Z
mc-remediate-final-baseline-a06ef75f         Succeeded  2026-08-12T12:18:02.5092185Z  2026-08-12T12:19:28.8476552Z
mc-remediate-final-application-0f73f5d3      Succeeded  2026-08-12T11:57:43.76578Z    2026-08-12T11:59:03.4994999Z
mc-remediate-final-baseline-4293dc92         Succeeded  2026-08-12T11:57:41.8695951Z  2026-08-12T11:59:00.6718415Z
mc-remediate-final-application-3047df91      Succeeded  2026-08-12T11:30:03.9728708Z  2026-08-12T11:31:24.6516107Z
mc-remediate-final-baseline-67469f20         Succeeded  2026-08-12T11:30:01.6502121Z  2026-08-12T11:31:20.2367501Z
mc-remediate-corrected-application-19240de0  Canceled   2026-08-12T11:16:15.4870953Z  2026-08-12T11:29:34.6461809Z
mc-remediate-corrected-baseline-bd0ce7c1     Canceled   2026-08-12T11:16:12.6463177Z  2026-08-12T11:29:31.6730441Z
mc-remediate-application-refresh             Succeeded  2026-08-12T10:22:54.7423408Z  2026-08-12T10:37:18.8836123Z
mc-remediate-baseline-refresh                Succeeded  2026-08-12T10:22:53.4864401Z  2026-08-12T10:37:17.4673815Z
```

## Guest desired-state proof for vm-mc-ws2022-we

```text
Hostname        : vm-mc-ws2022-we
Compliant       : True
RegistryValue   : 1.1.0
MarkerPresent   : True
EventLogState   : Running
EventLogStartup : Auto
IisInstalled    : False
```

## Guest desired-state proof for vm-mc-ws2025-we

```text
Hostname        : vm-mc-ws2025-we
Compliant       : True
RegistryValue   : 1.1.0
MarkerPresent   : True
EventLogState   : Running
EventLogStartup : Auto
IisInstalled    : True
```

## Log Analytics workshop events

```text
Column1                       Column2          Column3    Column4
----------------------------  ---------------  ---------  ------------------------------------------------------------------------------------
2026-08-12T09:32:16.8274115Z  vm-mc-ws2025-we  4101       Workshop drift introduced safely on vm-mc-ws2025-we at 2026-08-12T09:32:16.7771715Z.
2026-08-12T09:49:25.2898027Z  vm-mc-ws2022-we  4101       Workshop drift introduced safely on vm-mc-ws2022-we at 2026-08-12T09:49:25.2585513Z.
2026-08-12T10:51:48.6973681Z  vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T10:51:48.6661176Z.
2026-08-12T11:02:58.0989016Z  vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T11:02:58.0676296Z.
2026-08-12T11:33:32.5026756Z  vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T11:33:32.4714140Z.
2026-08-12T11:33:40.0080413Z  vm-mc-ws2025-we  4102       Workshop desired state verified on vm-mc-ws2025-we at 2026-08-12T11:33:39.9834465Z.
2026-08-12T11:35:19.0094101Z  vm-mc-ws2022-we  4101       Workshop drift introduced safely on vm-mc-ws2022-we at 2026-08-12T11:35:18.9781660Z.
2026-08-12T11:39:08.3221062Z  vm-mc-ws2025-we  4101       Workshop drift introduced safely on vm-mc-ws2025-we at 2026-08-12T11:39:08.2971576Z.
2026-08-12T12:23:17.9573931Z  vm-mc-ws2025-we  4102       Workshop desired state verified on vm-mc-ws2025-we at 2026-08-12T12:23:17.9358876Z.
2026-08-12T12:32:28.5147125Z  vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T12:32:28.4834918Z.
2026-08-12T12:34:15.0199811Z  vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T12:34:14.9887293Z.
2026-08-12T12:34:50.0543973Z  vm-mc-ws2025-we  4102       Workshop desired state verified on vm-mc-ws2025-we at 2026-08-12T12:34:50.0336667Z.
2026-08-12T12:38:15.892387Z   vm-mc-ws2022-we  4102       Workshop desired state verified on vm-mc-ws2022-we at 2026-08-12T12:38:15.8767632Z.
```

