You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Microsoft Antimalware for Azure Cloud Services and Virtual Machines
@@ -27,15 +27,15 @@ When you deploy and enable Microsoft Antimalware for Azure for your applications
27
27
***Scheduled scanning** - Scans periodically to detect malware, including actively running programs.
28
28
***Malware remediation** - automatically takes action on detected malware, such as deleting or quarantining malicious files and cleaning up malicious registry entries.
29
29
***Signature updates** - automatically installs the latest protection signatures (virus definitions) to ensure protection is up-to-date on a pre-determined frequency.
30
-
***Antimalware Engine updates**– automatically updates the Microsoft Antimalware engine.
31
-
***Antimalware Platform updates**– automatically updates the Microsoft Antimalware platform.
30
+
***Antimalware Engine updates**- automatically updates the Microsoft Antimalware engine.
31
+
***Antimalware Platform updates**- automatically updates the Microsoft Antimalware platform.
32
32
***Active protection** - reports telemetry metadata about detected threats and suspicious resources to Microsoft Azure to ensure rapid response to the evolving threat landscape, as well as enabling real-time synchronous signature delivery through the Microsoft Active Protection System (MAPS).
33
33
***Samples reporting** - provides and reports samples to the Microsoft Antimalware service to help refine the service and enable troubleshooting.
34
-
***Exclusions**– allows application and service administrators to configure exclusions for files, processes, and drives.
34
+
***Exclusions**- allows application and service administrators to configure exclusions for files, processes, and drives.
35
35
***Antimalware event collection** - records the antimalware service health, suspicious activities, and remediation actions taken in the operating system event log and collects them into the customer's Azure Storage account.
36
36
37
37
> [!NOTE]
38
-
> Microsoft Antimalware can also be deployed using Microsoft Defender for Cloud. Read [Install Endpoint Protection in Microsoft Defender for Cloud](../../security-center/security-center-services.md#supported-endpoint-protection-solutions-) for more information.
38
+
> Microsoft Antimalware can also be deployed using Microsoft Defender for Cloud. Read [Install Endpoint Protection in Microsoft Defender for Cloud](../../defender-for-cloud/integration-defender-for-endpoint.md) for more information.
39
39
40
40
## Architecture
41
41
@@ -46,20 +46,20 @@ The Microsoft Antimalware Client and Service is installed by default in a disabl
46
46
When using Azure App Service on Windows, the underlying service that hosts the web app has Microsoft Antimalware enabled on it. This is used to protect Azure App Service infrastructure and does not run on customer content.
47
47
48
48
> [!NOTE]
49
-
> Microsoft Defender Antivirus is the built-in Antimalware enabled in Windows Server 2016. The Microsoft Defender Antivirus Interface is also enabled by default on some Windows Server 2016 SKU's [see here for more information](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows).
49
+
> Microsoft Defender Antivirus is the built-in Antimalware enabled in Windows Server 2016. The Microsoft Defender Antivirus Interface is also enabled by default on some Windows Server 2016 SKU's [see here for more information](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility).
50
50
> The Azure VM Antimalware extension can still be added to a Windows Server 2016 Azure VM with Microsoft Defender Antivirus, but in this scenario the extension will apply any optional [configuration policies](https://gallery.technet.microsoft.com/Antimalware-For-Azure-5ce70efe) to be used by Microsoft Defender Antivirus, the extension will not deploy any additional antimalware services.
51
51
> You can read more about this update [here](/archive/blogs/azuresecurity/update-to-azure-antimalware-extension-for-cloud-services).
52
52
53
53
### Microsoft antimalware workflow
54
54
55
55
The Azure service administrator can enable Antimalware for Azure with a default or custom configuration for your Virtual Machines and Cloud Services using the following options:
56
56
57
-
* Virtual Machines – In the Azure portal, under **Security Extensions**
58
-
* Virtual Machines – Using the Visual Studio virtual machines configuration in Server Explorer
59
-
* Virtual Machines and Cloud Services – Using the Antimalware [classic deployment model](/previous-versions/azure/ee460799(v=azure.100))
60
-
* Virtual Machines and Cloud Services – Using Antimalware PowerShell cmdlets
57
+
* Virtual Machines - In the Azure portal, under **Security Extensions**
58
+
* Virtual Machines - Using the Visual Studio virtual machines configuration in Server Explorer
59
+
* Virtual Machines and Cloud Services - Using the Antimalware [classic deployment model](/previous-versions/azure/ee460799(v=azure.100))
60
+
* Virtual Machines and Cloud Services - Using Antimalware PowerShell cmdlets
61
61
62
-
The Azure portal or PowerShell cmdlets push the Antimalware extension package file to the Azure system at a pre-determined fixed location. The Azure Guest Agent (or the Fabric Agent) launches the Antimalware Extension, applying the Antimalware configuration settings supplied as input. This step enables the Antimalware service with either default or custom configuration settings. If no custom configuration is provided, then the antimalware service is enabled with the default configuration settings. Refer to the *Antimalware configuration* section in the [Microsoft Antimalware for Azure – Code Samples](/samples/browse/?redirectedfrom=TechNet-Gallery"Microsoft Antimalware For Azure Cloud Services and VMs Code Samples") for more details.
62
+
The Azure portal or PowerShell cmdlets push the Antimalware extension package file to the Azure system at a pre-determined fixed location. The Azure Guest Agent (or the Fabric Agent) launches the Antimalware Extension, applying the Antimalware configuration settings supplied as input. This step enables the Antimalware service with either default or custom configuration settings. If no custom configuration is provided, then the antimalware service is enabled with the default configuration settings. Refer to the *Antimalware configuration* section in the [Microsoft Antimalware for Azure - Code Samples](/samples/browse/?redirectedfrom=TechNet-Gallery"Microsoft Antimalware For Azure Cloud Services and VMs Code Samples") for more details.
63
63
64
64
Once running, the Microsoft Antimalware client downloads the latest protection engine and signature definitions from the Internet and loads them on the Azure system. The Microsoft Antimalware service writes service-related events to the system OS events log under the "Microsoft Antimalware" event source. Events include the Antimalware client health state, protection and remediation status, new and old configuration settings, engine updates and signature definitions, and others.
65
65
@@ -70,7 +70,7 @@ The deployment workflow including configuration steps and options supported for
70
70

71
71
72
72
> [!NOTE]
73
-
> You can however use PowerShell/APIs and Azure Resource Manager templates to deploy Virtual Machine Scale Sets with the Microsoft Anti-Malware extension. For installing an extension on an already running Virtual Machine, you can use the sample Python script [vmssextn.py](https://github.com/gbowerman/vmsstools). This script gets the existing extension config on the Scale Set and adds an extension to the list of existing extensions on the VM Scale Sets.
73
+
> You can however use PowerShell/APIs and Azure Resource Manager templates to deploy Virtual Machine Scale Sets with the Microsoft Anti-Malware extension. For installing an extension on an already running Virtual Machine, you can use the sample Python script [vmssextn.py](https://github.com/gbowerman/vmsstools#vmssextn). This script gets the existing extension config on the Scale Set and adds an extension to the list of existing extensions on the VM Scale Sets.
74
74
>
75
75
>
76
76
@@ -215,8 +215,8 @@ The following code sample is available:
215
215
### Enable and configure Antimalware using PowerShell cmdlets for Azure Arc-enabled servers
216
216
To enable and configure Microsoft Antimalware for Azure Arc-enabled servers using PowerShell cmdlets:
217
217
218
-
1.Set up your PowerShell environment using this [documentation](https://github.com/Azure/azure-powershell) on GitHub.
219
-
2.Use the [New-AzConnectedMachineExtension](../../azure-arc/servers/manage-vm-extensions-powershell.md) cmdlet to enable and configure Microsoft Antimalware for your Arc-enabled servers.
218
+
1.Set up your PowerShell environment using this [documentation](https://github.com/Azure/azure-powershell) on GitHub.
219
+
2.Use the [New-AzConnectedMachineExtension](../../azure-arc/servers/manage-vm-extensions-powershell.md) cmdlet to enable and configure Microsoft Antimalware for your Arc-enabled servers.
Copy file name to clipboardExpand all lines: articles/virtual-machines/extensions/iaas-antimalware-windows.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -162,4 +162,4 @@ Microsoft Antimalware extension logs are available at - %Systemdrive%\WindowsAzu
162
162
163
163
### Support
164
164
165
-
If you need more help at any point in this article, you can contact the Azure experts on the [MSDN Azure and Stack Overflow forums](https://azure.microsoft.com/support/forums/). Alternatively, you can file an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/), and select Get support. For information about using Azure Support, read the [Microsoft Azure support FAQ](https://azure.microsoft.com/support/faq/).
165
+
If you need more help at any point in this article, you can contact the Azure experts on the [Azure and Stack Overflow forums](https://azure.microsoft.com/support/forums/). Alternatively, you can file an Azure support incident. Go to the [Azure support site](https://azure.microsoft.com/support/options/), and select Get support. For information about using Azure Support, read the [Microsoft Azure support FAQ](https://azure.microsoft.com/support/faq/).
0 commit comments