Azure audit securitycenter monitor system updates disabled remediation

Using Console

To remediate the “Monitor System Updates setting is not enabled” misconfiguration in Azure using the Azure console, follow these steps:

Log in to the Azure portal (https://portal.azure.com/).
Navigate to the virtual machine that needs to be remediated.
Click on the “Security” tab in the left-hand menu.
Click on the “Security Center” link.
This will open the Azure Security Center. Click on the “Recommendations” tab.
Find the recommendation “Enable monitoring of system updates on virtual machines” and click on it.
This will open the recommendation details page. Click on the “Remediate” button.
In the “Remediate recommendation” window, select the virtual machine that needs to be remediated and click on the “Remediate” button.
Wait for the remediation to complete. This may take several minutes.
Once the remediation is complete, refresh the page to ensure that the “Monitor System Updates” setting is now enabled.

Following these steps will remediate the “Monitor System Updates setting is not enabled” misconfiguration in Azure using the Azure console.

Using CLI

To remediate the “Monitor System Updates setting is not enabled” misconfiguration in Azure using Azure CLI, follow the steps below:

Open the Azure CLI on your local machine or in the Azure Portal.
Run the following command to check the current status of the “Monitor System Updates” setting:
az vm get-instance-view --resource-group <resource-group-name> --name <vm-name> --query "instanceView.extensions[?type=='Microsoft.Azure.Security.AzureSecurityCenter'].settings"
Replace <resource-group-name> and <vm-name> with the name of the resource group and virtual machine that you want to check.
If the “Monitor System Updates” setting is not enabled, run the following command to enable it:
az vm extension set --resource-group <resource-group-name> --vm-name <vm-name> --name AzureSecurityCenter --publisher Microsoft.Azure.Security --settings "{'monitorWindowsUpdates': true, 'monitorLinuxUpdates': true}"
Replace <resource-group-name> and <vm-name> with the name of the resource group and virtual machine that you want to remediate.
Once the command is executed successfully, the “Monitor System Updates” setting will be enabled for the virtual machine.

Note: The Azure Security Center must be enabled for the subscription and the virtual machine for this remediation to work.

Using Python

To remediate the “Monitor System Updates setting is not enabled” misconfiguration in Azure using Python, you can use the Azure SDK for Python. Here are the step by step instructions:

Install the Azure SDK for Python using the following command:
pip install azure-mgmt-monitor

Authenticate with Azure using your Azure credentials. You can use the following code to authenticate:

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.resource import SubscriptionClient

credential = DefaultAzureCredential()
subscription_client = SubscriptionClient(credential)
subscription = next(subscription_client.subscriptions.list())
monitor_client = MonitorManagementClient(credential, subscription.subscription_id)

Get the current configuration for the Monitor System Updates setting using the following code:

settings = monitor_client.diagnostic_settings.list(resource_uri='/', metric_namespace='Microsoft.Insights', metric_name='Heartbeat')
for setting in settings:
    if setting.workspace_id:
        print(f"Workspace ID: {setting.workspace_id}")
        print(f"Log Analytics Solution Enabled: {setting.enabled}")

If the “Log Analytics Solution Enabled” value is False, then the Monitor System Updates setting is not enabled. To remediate this, you can enable the setting using the following code:

from azure.mgmt.monitor.models import LogAnalyticsDestinationDetails, DiagnosticSettingsCategoryResource

workspace_id = "<your workspace ID>"
log_analytics_destination = LogAnalyticsDestinationDetails(workspace_id=workspace_id)
category = DiagnosticSettingsCategoryResource(enabled=True, name='Heartbeat', destinations=[log_analytics_destination])
monitor_client.diagnostic_settings.create_or_update(resource_uri='/', settings_name='Heartbeat', parameters={'categories': [category]})

Replace <your workspace ID> with the ID of your Log Analytics workspace.

After running the remediation code, you can verify that the setting is enabled by running the code in step 3 again and checking that the “Log Analytics Solution Enabled” value is True.

Using Terraform

resource "azurerm_policy_assignment" "monitor_system_updates" {
  name                 = "monitor-system-updates"
  scope                = "/subscriptions/${var.SUBSCRIPTION_ID}" # replace var.SUBSCRIPTION_ID
  location             = "LOCATION_FOR_MANAGED_IDENTITY"         # e.g. "westeurope" if required
  display_name         = "Monitor system updates on virtual machines"
  description          = "Enable Security Center system updates recommendations for VMs"
  enforcement_mode     = "Default"
  identity {
    type = "SystemAssigned"
  }

  # Replace POLICY_DEFINITION_ID with the ID of the built‑in (or custom) policy/initiative
  # that controls 'Monitor system updates' in Microsoft Defender for Cloud
  policy_definition_id = "POLICY_DEFINITION_OR_INITIATIVE_ID"

  # The parameters block must match the definition's schema.
  # Replace PARAMETER_NAME and VALUE_WITH_SYSTEM_UPDATES_ENABLED
  parameters = jsonencode({
    "PARAMETER_NAME_FOR_SYSTEM_UPDATES" = {
      "value" = "VALUE_THAT_ENABLES_SYSTEM_UPDATES" # e.g. "On" or true, per policy definition
    }
  })
}

There is no dedicated Terraform argument to toggle “Monitor System Updates” directly on a security center resource; it is controlled via a policy/initiative assignment, so you must attach the correct built‑in (or custom) policy that enables this recommendation and set its parameter(s) accordingly in parameters.This change updates the existing assignment in place (no forced replacement) as long as name and scope stay the same; only the policy and/or parameters will change.To verify, terraform plan should show an update to the azurerm_policy_assignment.monitor_system_updates resource with changes to policy_definition_id and/or parameters, and no resources marked -/+ (destroy/create).

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Azure audit securitycenter monitor system updates disabled remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation