Azure Machine Configuration

What it is

Azure Machine Configuration is an Azure Policy feature for checking or configuring settings inside supported machines. It can work with Azure VMs and hybrid machines enabled with Azure Arc. Think of it as a way to ask, “Does this server’s operating system and application setup match our declared rule?”

Why it exists

Creating a VM defines its Azure resource properties—such as size, network, and disk—but does not prove its guest operating system remains configured correctly. Machine Configuration extends compliance and desired-state management into operating-system, application, and environment settings.

Key ideas

• Choose an enforcement mode deliberately. Audit only reports state. Apply and Monitor applies a configuration then reports later changes. Apply and Autocorrect brings a changed setting back into conformance. Autocorrection is powerful and should be used only after the configuration and its operational effect are tested.
• A configuration is not a policy definition. The configuration describes the machine setting; Azure Policy can dynamically assign it at scale or it can be assigned per machine. Compliance results show the evaluated setting-level outcome.
• The feature has prerequisites and scope. Supported operating systems, VM/scale-set types, Azure Arc setup, extension behavior, identity, and network access need checking before a broad assignment. A custom configuration should be tested on a non-production machine first.
• It complements resource IaC. Bicep, ARM templates, and Terraform can define Azure resources. Machine Configuration governs settings inside the guest OS; neither layer automatically proves the other is correct.

Northwind example

Northwind requires its supported order-service VMs to use an approved TLS setting. Maya first assigns an audit configuration to a test scope and reviews the per-machine results. After validating the configuration and the application behavior, Northwind chooses Apply and Monitor for production. It does not enable Autocorrect until the team has tested that reapplying the setting cannot interrupt the order service unexpectedly.

Common confusion

• Azure Policy can govern Azure resource configuration without inspecting a VM’s operating system. Machine Configuration is the guest-OS extension of that governance model.
• A compliant machine-configuration result does not prove the application is secure, backed up, patched in every respect, or reachable over the network.
• Autocorrect is not a substitute for incident investigation: understand why a machine drifted before repeatedly forcing it back.

Related

desired-state · configuration-drift · azure-policy · managed-identity

Source: Azure Machine Configuration documentation