Maybe this will save someone else a few hours of their life.
We recently enabled the Azure CIS 1.1.0 (New) Policy which includes an Only approved VM extensions should be installed recommendation. This recommendation relies on a parameter set when adding the policy called List of virtual machine extensions that are approved for use. It is a semicolon separated list of approved extensions.
Attempt #1 - Use VM Extension Name (Incorrect)
We use several extensions not in the default list, and I thought this list showed extension names, so I added this to the default values:
- joindomain;Microsoft.PowerShell.DSC;WindowsAgent.AzureSecurityCenter
However, only WindowsAgent.AzureSecurityCenter was being reported as Healthy
Attempt #2 - Use VM Extension Type from VM Extensions Pane (Incorrect)
Looking at the VM Extensions pane, there is a type column, so I tried replacing the names from before with these type values.
- Microsoft.Compute.JsonADDomainExtension;Microsoft.PowerShell.DSC;Qualys.WindowsAgent.AzureSecurityCenter
None of these were reported as Healthy.
Attempt #3 - Use last segment of Type from VM Extensions Pane (incorrect)
Taking a closer look at the default values that worked, I noticed that only the last segment from the Type column on the VM Extensions pane was in the default value list. So I replace the previous values with:
- JsonADDomainExtension;DSC;AzureSecurityCenter
This time, the first two showed Healthy, but WindowsAgent.AzureSecurityCenter was showing Unhealthy.
Attempt #4 - Use Get-AzVMExtensionImage (RTFM?) - Correct
I finally saw the tooltip when adding the policy that said "To see a complete list of virtual machine extensions, use Get-AzVMExtensionImage". I may not be looking the right place, but I am not aware of this crucial documentation being written anywhere else.
It turns out that the Type column on the VM Extensions pane appears to be a combination of Publisher + Type, but that Type can be more than just the last segment. The Publisher for WindowsAgent.AzureSecurityCenter is actually just Qualys and the Type is WindowsAgent.AzureSecurityCenter
So replacing the above with:
- JsonADDomainExtension;DSC;WindowsAgent.AzureSecurityCenter
All are showing as Healthy finally.
