Azure Machine Configuration custom security baselines reach GA

Customizable security baseline policies in Azure Machine Configuration became generally available on May 28. The Azure Governance announcement says teams can alter Microsoft-provided baseline settings and package the result as a reusable JSON artifact. The release covers supported Windows Server generations and Linux baselines across public and sovereign Azure clouds.

Baselines can reflect an actual estate

Fixed benchmarks frequently contain controls that conflict with an application or operating model. Custom artifacts let platform teams record approved values once, distribute them through policy, and keep the configuration in source control. Microsoft documents CLI, ARM, and Bicep delivery paths, making reviews and staged deployment practical.

Customization also creates responsibility. Every disabled control needs a reason, owner, and review date. A passing Machine Configuration result shows conformance to the chosen artifact, not universal security or compliance.

Build a controlled artifact pipeline

Start from the baseline that matches the OS release. Diff proposed settings against vendor defaults and have service owners test authentication, networking, updates, and application startup. Store the generated artifact and assignment code together, with a version that appears in compliance output.

Deploy the customizable baseline as an audit assignment to a small machine ring, inspect conflicts, and distinguish unsupported checks from genuine drift. Microsoft documents the assignment effect as AuditIfNotExists; where a fix is required, use a separate supported configuration or remediation mechanism, with maintenance windows, testing, and rollback instructions. Validate extension installation, managed identity or permissions, and network access for Azure VMs and Arc-enabled servers.

Report exceptions alongside compliance percentages so dashboards do not hide deliberate risk acceptance. Revisit artifacts when the OS, benchmark, or application changes. The GA release supplies the mechanism; governance determines whether customization remains a controlled deviation or becomes an unreviewed collection of weakened settings.