Read VM Application audit compliance within its operating-system filter

Source facts

Microsoft’s VM Application audit sample checks application-profile references with an operating-system condition. The guide explicitly treats a Linux application checked against Windows, or a Windows application against Linux, as compliant. In the matching population, missing applicationProfile data also counts as noncompliant. Audit reports presence; the separate modify design injects application references, and existing resources need remediation tasks. Microsoft Learn.

Applicability

Review the actual policy definition, assignment scope, application name, and osType parameter before presenting a rollout percentage. This article describes the supplied sample, not every custom policy. Identify the version and regional replication requirements separately from the sample’s presence check.

DSE recommendation

Report the intended operating-system cohort separately from resources that fall outside the application’s platform filter. Have the application owner agree which resources truly require the package. Preserve the distinction between observing absence and authorizing a change to existing machines. When remediation is approved, scope it gradually and include the assignment identity and required gallery access in the readiness review.

Verification

Evaluate representative matching and nonmatching operating systems, including a matching VM without an applicationProfile. Compare the policy outcome with the conditions in the definition rather than interpreting every compliant resource as an installed application. Verify a remediated target’s actual application state independently. Retain the policy version, parameters, target cohort, and observed results so a later platform-filter change does not silently alter the meaning of the score.

Official references

Microsoft Learn: Govern VM Applications with Azure Policy. Source reviewed September 9, 2026.