Select every intended distribution in a Machine Configuration CIS Linux baseline

Source facts

Microsoft’s CIS Benchmarks for Linux customization guidance allows one or more supported distributions to be enabled and a benchmark version chosen for each. Distributions left unselected are excluded from evaluation. This customization therefore carries both distribution and benchmark-version choices. Microsoft Learn.

Applicability

Use this review when preparing a customized Machine Configuration CIS Linux baseline. Establish the intended machine inventory and distributions before choosing settings. The source’s supported choices must be checked against the actual machines; this article does not claim every Linux release is supported. This distribution selection applies to CIS Benchmarks for Linux; the source says Azure Security Baselines for Windows and Linux do not require it.

DSE recommendation

DSE recommends making a distribution-to-benchmark worksheet part of baseline review. Ask the platform owner to account for each intended distribution and explicitly approve any exclusion. Keep the exported configuration artifact with that worksheet. Test representative machines from each selected population before treating the resulting report as coverage of the full intended estate.

Verification

Compare the exported settings with the approved distribution list and benchmark versions. Inspect evaluation evidence from one representative machine in each selected population, then confirm that deliberately excluded populations are documented as outside scope. Investigate an absent result before interpreting it as compliance. Retain the inventory snapshot and baseline artifact used for the coverage decision.

Official references

Microsoft Learn: Specify Custom Parameters For Baseline Policy.