You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn about the machine configuration extension feature of Azure Automanage, and audit and configure settings for Azure virtual machines.
4
4
ms.topic: article
5
5
ms.service: virtual-machines
6
6
ms.subservice: extensions
@@ -9,15 +9,15 @@ ms.author: migreene
9
9
ms.date: 04/05/2023
10
10
---
11
11
12
-
# Overview of the Guest Configuration extension
12
+
# Overview of the Azure Automanage machine configuration extension
13
13
14
-
The Guest Configuration extension is a component of Azure Policy that performs audit and configuration operations inside virtual machines (VMs).
14
+
The machine configuration extension is a feature of Azure Automanage that performs audit and configuration operations inside virtual machines (VMs).
15
15
16
-
To check policies inside VMs, such as security baseline definitions for [Linux](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc9b3da7-8347-4380-8e70-0a0361d8dedd) and [Windows](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F72650e9f-97bc-4b2a-ab5f-9781a9fcecbc), the Guest Configuration extension must be installed.
16
+
To check policies inside VMs, such as Azure compute security baseline definitions for [Linux](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ffc9b3da7-8347-4380-8e70-0a0361d8dedd) and [Windows](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F72650e9f-97bc-4b2a-ab5f-9781a9fcecbc), the machine configuration extension must be installed.
17
17
18
18
## Prerequisites
19
19
20
-
To enable your VM to authenticate to the Guest Configuration service, your VM must have a [system-assigned managed identity](/azure/active-directory/managed-identities-azure-resources/overview). You can satisfy the identity requirement for your VM by setting the `"type": "SystemAssigned"` property:
20
+
To enable your VM to authenticate to the machine configuration service, your VM must have a [system-assigned managed identity](/azure/active-directory/managed-identities-azure-resources/overview). You can satisfy the identity requirement for your VM by setting the `"type": "SystemAssigned"` property:
21
21
22
22
```json
23
23
"identity": {
@@ -27,46 +27,46 @@ To enable your VM to authenticate to the Guest Configuration service, your VM mu
27
27
28
28
### Operating systems
29
29
30
-
Operating system support for the Guest Configuration extension is the same as documented [operating system support for the end-to-end solution](/azure/governance/machine-configuration/overview#supported-client-types).
30
+
Operating system support for the machine configuration extension is the same as documented [operating system support for the end-to-end solution](/azure/governance/machine-configuration/overview#supported-client-types).
31
31
32
32
### Internet connectivity
33
33
34
-
The agent installed by the Guest Configuration extension must be able to reach content packages listed by Guest Configuration assignments,
35
-
and report status to the Guest Configuration service. The VM can connect by using outbound HTTPS over TCP port 443, or a connection provided through private networking.
34
+
The agent installed by the machine configuration extension must be able to reach content packages listed by guest configuration assignments,
35
+
and report status to the machine configuration service. The VM can connect by using outbound HTTPS over TCP port 443, or a connection provided through private networking.
36
36
37
37
To learn more about private networking, see the following articles:
38
38
39
-
-[Guest Configuration, Communicate over Azure Private Link](/azure/governance/machine-configuration/overview#communicate-over-private-link-in-azure)
39
+
-[Azure Automanage machine configuration, Communicate over Azure Private Link](/azure/governance/machine-configuration/overview#communicate-over-private-link-in-azure)
40
40
-[Use private endpoints for Azure Storage](/azure/storage/common/storage-private-endpoints)
41
41
42
42
## Install the extension
43
43
44
-
You can install and deploy the Guest Configuration extension directly from the Azure CLI or PowerShell. Deployment templates are also available for Azure Resource Manager (ARM), Bicep, and Terraform. For deployment template details, see [Microsoft.GuestConfiguration guestConfigurationAssignments](/azure/templates/microsoft.guestconfiguration/guestconfigurationassignments?pivots=deployment-language-arm-template).
44
+
You can install and deploy the machine configuration extension directly from the Azure CLI or PowerShell. Deployment templates are also available for Azure Resource Manager (ARM), Bicep, and Terraform. For deployment template details, see [Microsoft.GuestConfiguration guestConfigurationAssignments](/azure/templates/microsoft.guestconfiguration/guestconfigurationassignments?pivots=deployment-language-arm-template).
45
45
46
46
> [!NOTE]
47
47
> In the following deployment examples, replace `<placeholder>` parameter values with specific values for your configuration.
48
48
49
49
### Deployment considerations
50
50
51
-
Before you install and deploy the Guest Configuration extension, review the following considerations.
51
+
Before you install and deploy the machine configuration extension, review the following considerations.
52
52
53
-
-**Instance name**. When you install the Guest Configuration extension, the instance name of the extension must be set to `AzurePolicyforWindows` or `AzurePolicyforLinux`. The security baseline definition policies described earlier require these specific strings.
53
+
-**Instance name**. When you install the machine configuration extension, the instance name of the extension must be set to `AzurePolicyforWindows` or `AzurePolicyforLinux`. The security baseline definition policies described earlier require these specific strings.
54
54
55
-
-**Versions**. By default, all deployments update to the latest version. The value of the `autoUpgradeMinorVersion` property defaults to `true` unless otherwise specified. This feature helps to alleviate concerns about updating your code when new versions of the Guest Configuration extension are released.
55
+
-**Versions**. By default, all deployments update to the latest version. The value of the `autoUpgradeMinorVersion` property defaults to `true` unless otherwise specified. This feature helps to alleviate concerns about updating your code when new versions of the machine configuration extension are released.
56
56
57
-
-**Automatic upgrade**. The Guest Configuration extension supports the `enableAutomaticUpgrade` property. When this property is set to `true`, Azure automatically upgrades to the latest version of the extension as future releases become available. For more information, see [Automatic Extension Upgrade for VMs and Virtual Machine Scale Sets in Azure](/azure/virtual-machines/automatic-extension-upgrade).
57
+
-**Automatic upgrade**. The machine configuration extension supports the `enableAutomaticUpgrade` property. When this property is set to `true`, Azure automatically upgrades to the latest version of the extension as future releases become available. For more information, see [Automatic Extension Upgrade for VMs and Virtual Machine Scale Sets in Azure](/azure/virtual-machines/automatic-extension-upgrade).
58
58
59
-
-**Azure Policy**. To deploy the latest version of the Guest Configuration extension at scale including identity requirements, follow the steps in [Create a policy assignment to identify noncompliant resources](/azure/governance/policy/assign-policy-portal#create-a-policy-assignment) to create the following assignment with Azure Policy:
59
+
-**Azure Policy**. To deploy the latest version of the machine configuration extension at scale including identity requirements, follow the steps in [Create a policy assignment to identify noncompliant resources](/azure/governance/policy/assign-policy-portal#create-a-policy-assignment). Create the following assignment with Azure Policy:
60
60
-[Deploy prerequisites to enable Guest Configuration policies on virtual machines](https://github.com/Azure/azure-policy/blob/master/built-in-policies/policySetDefinitions/Guest%20Configuration/GuestConfiguration_Prerequisites.json)
61
61
62
-
-**Other properties**. You don't need to include any settings or protected-settings properties on the Guest Configuration extension. The agent retrieves this class of information from [Guest Configuration assignment](/rest/api/guestconfiguration/guestconfigurationassignments) resources. For example, the [`ConfigurationUri`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#guestconfigurationnavigation), [`Mode`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#configurationmode), and [`ConfigurationSetting`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#configurationsetting) properties are each managed per-configuration rather than on the VM extension.
62
+
-**Other properties**. You don't need to include any settings or protected-settings properties on the machine configuration extension. The agent retrieves this class of information from the Azure REST API[Guest Configuration assignment](/rest/api/guestconfiguration/guestconfigurationassignments) resources. For example, the [`ConfigurationUri`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#guestconfigurationnavigation), [`Mode`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#configurationmode), and [`ConfigurationSetting`](/rest/api/guestconfiguration/guestconfigurationassignments/createorupdate#configurationsetting) properties are each managed per-configuration rather than on the VM extension.
63
63
64
64
### Azure CLI
65
65
66
66
To deploy the extension for Linux:
67
67
68
68
```azurecli
69
-
az vm extension set --publisher Microsoft.GuestConfiguration --name ConfigurationforLinux --extension-instance-name AzurePolicyforLinux --resource-group <myResourceGroup> --vm-name <myVM> --enable-auto-upgrade true
69
+
az vm extension set --publisher Microsoft.GuestConfiguration --name ConfigurationForLinux --extension-instance-name AzurePolicyforLinux --resource-group <myResourceGroup> --vm-name <myVM> --enable-auto-upgrade true
70
70
```
71
71
72
72
To deploy the extension for Windows:
@@ -218,17 +218,17 @@ The following table lists possible error messages related to enabling the Guest
218
218
| Error code | Description |
219
219
|---|---|
220
220
|**NoComplianceReport**| The VM hasn't reported the compliance data. |
221
-
|**GCExtensionMissing**| The Guest Configuration extension is missing. |
221
+
|**GCExtensionMissing**| The machine configuration (guest configuration) extension is missing. |
222
222
|**ManagedIdentityMissing**| The managed identity is missing. |
223
223
|**UserIdentityMissing**| The user-assigned identity is missing. |
224
-
|**GCExtensionManagedIdentityMissing**| The Guest Configuration extension and managed identity are missing. |
225
-
|**GCExtensionUserIdentityMissing**| The Guest Configuration extension and user-assigned identity are missing. |
226
-
|**GCExtensionIdentityMissing**| The Guest Configuration extension, managed identity, and user-assigned identity are missing. |
224
+
|**GCExtensionManagedIdentityMissing**| The machine configuration (guest configuration) extension and managed identity are missing. |
225
+
|**GCExtensionUserIdentityMissing**| The machine configuration (guest configuration) extension and user-assigned identity are missing. |
226
+
|**GCExtensionIdentityMissing**| The machine configuration (guest configuration) extension, managed identity, and user-assigned identity are missing. |
227
227
228
228
## Next steps
229
229
230
-
- For more information about Azure Policy's guest configuration, see [Understand Azure Policy's Guest Configuration](../../governance/machine-configuration/overview.md).
231
-
- For more information about how the Linux Agent and extensions work, see [Azure VM extensions and features for Linux](features-linux.md).
232
-
- For more information about how the Windows Guest Agent and extensions work, see [Azure VM extensions and features for Windows](features-windows.md).
233
-
- To install the Windows Guest Agent, see [Azure Windows Virtual Machine Agent Overview](agent-windows.md).
234
-
- To install the Linux Agent, see [Azure Linux Virtual Machine Agent Overview](agent-linux.md).
230
+
- For more information about the machine configuration extension, see [Understand the machine configuration feature of Azure Automanage](/azure/virtual-machines/extensions/guest-configuration).
231
+
- For more information about how the Linux Agent and extensions work, see [Virtual machine extensions and features for Linux](features-linux.md).
232
+
- For more information about how the Windows Guest Agent and extensions work, see [Virtual machine extensions and features for Windows](features-windows.md).
233
+
- To install the Windows Guest Agent, see [Azure Virtual Machine Agent overview](agent-windows.md).
234
+
- To install the Linux Agent, see [Understanding and using the Azure Linux Agent](agent-linux.md).
0 commit comments