# Azure Machine Configuration custom security baselines reach GA > Teams can customize and deploy reusable Windows and Linux baseline artifacts through policy and infrastructure delivery workflows. Canonical URL: https://www.devobs.io/news/news-azure-machine-configuration-custom-baselines-ga/ By: Elias Brooks Published: 2026-09-06T11:58:54.638Z Updated: 2026-09-06T11:58:54.638Z Event date: 2026-05-28 Section: Security Customizable security baseline policies in Azure Machine Configuration became generally available on May 28. The [Azure Governance announcement](https://techcommunity.microsoft.com/blog/azuregovernanceandmanagementblog/now-generally-available-customizable-security-baseline-policies-in-machine-confi/4523429) says teams can alter Microsoft-provided baseline settings and package the result as a reusable JSON artifact. The release covers supported Windows Server generations and Linux baselines across public and sovereign Azure clouds. ## Baselines can reflect an actual estate Fixed benchmarks frequently contain controls that conflict with an application or operating model. Custom artifacts let platform teams record approved values once, distribute them through policy, and keep the configuration in source control. Microsoft documents CLI, ARM, and Bicep delivery paths, making reviews and staged deployment practical. Customization also creates responsibility. Every disabled control needs a reason, owner, and review date. A passing Machine Configuration result shows conformance to the chosen artifact, not universal security or compliance. ## Build a controlled artifact pipeline Start from the baseline that matches the OS release. Diff proposed settings against vendor defaults and have service owners test authentication, networking, updates, and application startup. Store the generated artifact and assignment code together, with a version that appears in compliance output. Deploy the customizable baseline as an audit assignment to a small machine ring, inspect conflicts, and distinguish unsupported checks from genuine drift. Microsoft documents the assignment effect as `AuditIfNotExists`; where a fix is required, use a separate supported configuration or remediation mechanism, with maintenance windows, testing, and rollback instructions. Validate extension installation, managed identity or permissions, and network access for Azure VMs and Arc-enabled servers. Report exceptions alongside compliance percentages so dashboards do not hide deliberate risk acceptance. Revisit artifacts when the OS, benchmark, or application changes. The GA release supplies the mechanism; governance determines whether customization remains a controlled deviation or becomes an unreviewed collection of weakened settings. ## Source references - -