This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 19 · How

Chapter 07 — Machine Configuration Packages

Building Azure Machine Configuration content from Learn’s own procedure and Microsoft’s pinned samples, then adding only what a federal pipeline needs on top: a MOF free of build-host data that compiles to the same bytes every time, a package and policy definition checked against a reviewed release registry, the owner tag that keeps two tools off one setting, Arc and Azure Government scope, and a provenance manifest, with labs offline and in a test subscription.

Learn’s cmdlets build a package and a policy definition; nothing in them says whether this package is the one you reviewed, whether it leaks the build host, or whether it will reach servers another tool owns. That check is the pipeline’s job.

NoteIn this chapter

How a server setting becomes Azure Machine Configuration content: a DSC configuration compiled to a MOF, packaged with New-GuestConfigurationPackage, tested, published, signed, and turned into an Azure Policy definition with New-GuestConfigurationPolicy. You follow Learn’s procedure and run Microsoft’s own sample project, which the repository keeps as a pinned copy, and see what the cmdlets do on their own. Then you build on examples/machine-configuration for what they leave to you: a cleaned, repeatable MOF, package and definition checks against a release registry, the owner tag filter, Arc and Azure Government scope, and a provenance manifest. Lab 1 runs offline on a laptop; Lab 2 uses a test subscription and a disposable server.

TipNarrated tour

Building the Attribute-Driven Migration, Chapter 07 — Machine Configuration Packages: narrated tour · 11 minutes · captions from the player's CC button · Download MP4 · All videos

Jump to a slide (18)

Deck · Narrated deck (about 11 minutes, captions) · Script · Captions. Recorded on October 31, 2026 from the approved chapter.

Goal and audience

Goal. By the end of this chapter you can take a server setting from a DSC configuration to an assigned policy using Learn’s cmdlets, you know what those cmdlets don’t check, and you can run, change and test the build that checks it. For every rule in the build you can say whether it is Microsoft’s contract, Microsoft’s procedure, or the program’s own design.

Audience. Developers and platform engineers who write server baselines for the Arc track, and the engineers and ISSOs who review them. You should be comfortable in PowerShell 7 and know what a DSC configuration is. You don’t need to know Azure Policy in depth: the chapter covers the parts machine configuration uses.

Where machine configuration sits

The Arc track puts each server under one owning tool per setting, recorded as config_owner in the CMDB and mirrored in the ConfigOwner tag (Ansible guide). For the settings machine configuration owns, the code is a DSC configuration, and Azure Policy delivers it.

Learn’s model has three parts.¹ A package (a .zip with the compiled MOF and the DSC resource modules it uses) says what the machine should look like. A policy definition in the category Guest Configuration points at the package by URI and hash. When the definition is assigned, the service creates a guest assignment (Microsoft.GuestConfiguration/guestConfigurationAssignments) on each machine in scope, and the agent on the machine downloads the package, evaluates it and reports compliance.² A machine can hold up to 50 guest assignments.³

Each assignment has one of three types, and the spelling is case sensitive:⁴

Assignment type	What the agent does
Audit	Reports; changes nothing
ApplyAndMonitor	Applies once, then reports drift without correcting it
ApplyAndAutoCorrect	Applies, and corrects drift at the next evaluation

Custom packages that audit and apply, and custom definitions with AuditIfNotExists or DeployIfNotExists, are generally available. Applying needs guest configuration extension 1.26.24 or later on Azure VMs, or Arc agent 1.10.0 or later.⁵

Start with Learn’s procedure and Microsoft’s sample

What Learn gives you

Learn documents the whole procedure, one page a step:⁶

Step	Learn’s command	What it produces
Set up	Install-Module GuestConfiguration; on Windows, PSDesiredStateConfiguration 2.0.77	The authoring environment, PowerShell 7.1.3 or later on Windows, 7.2.4 or later on Ubuntu 20+
Author	Configuration MyConfig { ... }, then dot-source the script8	localhost.mof
Package	New-GuestConfigurationPackage -Name -Configuration -Type Audit or AuditAndSet9	<Name>.zip with the MOF, a metaconfig.json holding type and version, and the modules
Test	Get-GuestConfigurationPackageComplianceStatus, then Start-GuestConfigurationPackageRemediation for AuditAndSet10	Compliance per resource, from the same agent the machines run
Publish	Set-AzStorageBlobContent, optionally New-AzStorageBlobSASToken11	An HTTPS URI the machines can read
Sign	Protect-GuestConfigurationPackage, and the GuestConfigPolicyCertificateValidation tag on machines12	A signed package that tagged machines will insist on
Define	New-GuestConfigurationPolicy -PolicyId -ContentUri -Mode -Platform -PolicyVersion13	Definition JSON, with contentHash filled in
Publish the definition	New-AzPolicyDefinition, with Resource Policy Contributor as the recommended role14	The definition in Azure, ready to assign

Learn is clear about some things you must not do. Don’t put secrets or confidential information in a package.¹⁵ The package can’t exceed 100 MB uncompressed.¹⁶ To release a new version, give the package a new name (Learn suggests PackageName_1.0.0), keep the same PolicyId, raise the version, and let the cmdlet recompute contentHash. If only the URI changes and not the hash, the extension rejects the package.¹⁷

The pinned sample

Learn’s overview lists Microsoft’s sample DSC resource modules among its machine configuration samples.¹⁸ The repository keeps an unmodified copy of that repository’s worked example project in examples/third_party/guest-configuration-samples, pinned at commit ca85d61 of August 4, 2021, with its MIT license.¹⁹ It is createPackage.ps1, a compiled AdministratorsGroupMembers.mof that audits the members of the local Administrators group, and the LocalGroup resource module it imports.

snapshot.json records the commit and the SHA-256 of every file, and a unit test fails if one changes. The weekly source watch reports new upstream commits, both to the samples and to the GuestConfiguration module’s own repository. Updating either is a reviewed pull request, the same pattern as Chapter 01.

The sample is five years older than the module the chapter uses (GuestConfiguration 4.12.0, published June 22, 2026, on the PowerShell Gallery; the gallery isn’t a Learn page).²⁰ Two things in it no longer hold. Its script calls Test-GuestConfigurationPackage, which 4.12.0 doesn’t export: the current name is Get-GuestConfigurationPackageComplianceStatus. It also appends to PSModulePath with :, the Linux separator. Its MOF and module still package with 4.12.0. tests/LearnBaseline.Tests.ps1 pins all three facts.

What it leaves to you

Running Learn’s commands offline, on the sample and on this chapter’s configuration, shows what the cmdlets don’t do. Each row is pinned by a test that runs the cmdlets.

Learn’s cmdlets, on their own	Why it matters in a federal pipeline	What examples/machine-configuration adds
The compiled MOF records the user name, host name, date and full script path (@GeneratedBy, @GenerationHost, SourceInfo)	That MOF goes into the package, and the package goes to a blob the machines read: it publishes who built it and where	ConvertTo-McCleanMof removes them; rule MC-PKG-04 refuses a package that still has them
Compiling writes each resource’s properties in a different order each run	The MOF’s hash changes with no change to the configuration, so a reviewer can’t tell a real change from noise	The cleaner sorts properties, so the same source gives the same MOF bytes on any host
New-GuestConfigurationPackage writes a different .zip each run, even from the same MOF	A rebuilt package doesn’t match the hash in the reviewed definition	Build once, check, publish those exact bytes; provenance.json records both hashes
Nothing checks for secrets, although Learn says not to include them	A credential in a MOF is readable by anyone who can read the blob	MC-PKG-05 scans the MOF for credential properties, SAS signatures, account keys and private keys
New-GuestConfigurationPolicy takes whatever -PolicyId and -PolicyVersion it’s given; Learn says to generate a GUID with New-Guid for a new definition and reuse it for updates, but nothing records it21	A new GUID creates a second definition instead of updating the first; a version that doesn’t rise breaks the release	config/releases.json holds the fixed policy ID, mode and published version; MC-POL-05 to MC-POL-07 compare against it
An enforcing definition reaches every machine in scope	Two tools on one setting flip it back and forth, each reporting success	MC-POL-08 requires the ConfigOwner tag filter on ApplyAnd* definitions, the same rule VK-ARC-07 checks after the fact
The generated definition’s IncludeArcMachines parameter defaults to "false"	An assignment made with defaults leaves every Arc-enabled server out of scope, and nothing reports it	MC-POL-09 reminds on every build meant for Arc
Learn’s SAS example lasts three years22	A read token in a definition outlives the package, the server and the people who made it	Managed identity by default; MC-POL-03 warns on any SAS and refuses one longer than 90 days (design guidance)
Module versions float	A rebuild a month later compiles against different resources	RequiredModules.psd1 pins them; the build stops if one is missing

Three smaller differences from Learn’s text, found by running 4.12.0 and pinned in the baseline test. The definition file is named <package>_AuditIfNotExists.json or <package>_DeployIfNotExists.json, not auditIfNotExists.json as Learn’s page says.²³ The -Tag parameter takes one hashtable; the array of hashtables Learn describes fails to bind. The package also holds only the configuration’s own resource module, not the GuestConfiguration and DscNativeResources folders Learn lists in a package’s expected contents.²⁴ The package works either way; the test pins what 4.12.0 does.

An enforcing definition also grants its remediation identity a role, and the generated DeployIfNotExists definition names it only by ID: 088ab73d-1256-47ae-bea9-9de8e7131f31. Learn’s built-in roles reference doesn’t list that ID. Microsoft’s own role tables name it Guest Configuration Resource Contributor, “Lets you read, write Guest Configuration Resource”,²⁵ and a Learn page for Azure Local tells you to pick that role by name for machine configuration policy definitions.²⁶ Before an assignment relies on it, read the definition in the test subscription with Get-AzRoleDefinition -Id 088ab73d-1256-47ae-bea9-9de8e7131f31 and record its name and actions. The test pins that 4.12.0 grants this one role and no other.

The verdict. Learn’s procedure is the procedure: the build calls its cmdlets in its order and replaces none of them. What the build adds sits between the steps: clean the MOF before packaging, check the package before defining, check the definition before publishing, and record what was built.

The code: what examples/machine-configuration adds

examples/machine-configuration has one configuration, one module of checks, one build script and two test files:

• configurations/TlsServerProtocols.ps1 audits that the server side of TLS 1.0 and TLS 1.1 is explicitly disabled in SCHANNEL, using the Registry resource from PSDscResources. It is audit only. It reports a machine with no explicit setting as non-compliant, which is the intent: the baseline wants the setting on record.
• powershell/McPipeline.psm1 holds the checks and the provenance manifest. None of it needs the GuestConfiguration module, Azure or a network.
• powershell/Invoke-McBuild.ps1 runs the whole build offline: compile, clean, package, define, check, write provenance.json. It exits 0 if the build passed (warnings allowed), 2 on findings, and 1 on error.

The release registry

config/releases.json is the reviewed record of what is in production, one entry per configuration:

"TlsServerProtocols": {
  "policyId": "ca593085-dfcb-425d-ac9c-12870a55bbaa",
  "platform": "Windows",
  "mode": "Audit",
  "published": "0.0.0",
  "identity": "system",
  "include_arc": true,
  "owner_tag": { "ConfigOwner": "ArcMachineConfiguration" }
}

The policy ID never changes; Learn says to reuse it so updates replace the definition.²⁷ mode is checked case-sensitively against the three assignment types. published moves up in the same pull request that publishes a new version, so a second build of 1.0.0 fails MC-POL-06. identity: system builds definitions that read the package with each machine’s system-assigned identity, which Learn says works for Arc-enabled servers; a user-assigned identity doesn’t.²⁸ The owner tag value is the one the Arc track uses.

Clean the MOF

ConvertTo-McCleanMof rewrites the compiled MOF into one canonical form. It drops the header comment and the configuration document’s Author, GenerationDate and GenerationHost. It keeps SourceInfo as ::line::column::resource, the form Microsoft’s own sample MOF uses. It sorts each instance’s properties and writes LF line endings. Compiled three times, the configuration gives three different MOFs and one cleaned MOF. The baseline test parses the compiled and cleaned files with DSC’s own MOF deserializer and checks that the resources and values are the same, apart from the fields removed on purpose.

Check the package

Test-McPackage opens the .zip in memory and applies seven rules. The MOF and metaconfig must be at the root (MC-PKG-01), and the type must be the one the registry mode needs (MC-PKG-02). The package must stay within the 100 MB limit (MC-PKG-03). The MOF must carry no build-host data (MC-PKG-04) and nothing that looks like a secret (MC-PKG-05). Every module the MOF imports must be in the package at the version it was compiled against (MC-PKG-06). The package name must carry a version (MC-PKG-07, a warning).

Check the definition

Test-McPolicy reads the definition New-GuestConfigurationPolicy wrote, with the package and the registry entry, and applies nine rules (MC-POL-01 to MC-POL-09; the README lists them). The one that catches the most is MC-POL-02. contentHash appears four times in an enforcing definition (once in the metadata, once per machine type in the deployment template), and every copy must be this package’s SHA-256. A hand-edited definition or a rebuilt package fails here, not on a server.

The provenance manifest

provenance.json follows the pattern of Book 13, Chapter 04: what was built, from what, and what shipped.

{
  "schema": "fmp-mc-provenance/1",
  "configuration": "TlsServerProtocols",
  "version": "1.0.0",
  "policy_id": "ca593085-dfcb-425d-ac9c-12870a55bbaa",
  "mode": "Audit",
  "mof":     { "file": "TlsServerProtocols_1.0.0.mof", "sha256": "ecffd795…" },
  "package": { "file": "TlsServerProtocols_1.0.0.zip", "sha256": "…", "bytes": 341673 },
  "policy":  { "file": "TlsServerProtocols_1.0.0_AuditIfNotExists.json", "sha256": "…" },
  "modules": { "GuestConfiguration": "4.12.0", "PSDesiredStateConfiguration": "2.0.7", "PSDscResources": "2.12.0.0" },
  "findings": { "Finding": 0, "Warn": 0, "Info": 1 }
}

The MOF hash is the reviewable one: it is the same for anyone who builds the same commit. The package and definition hashes identify the bytes that shipped; an ISSO can download the published blob, hash it, and match it here. Chapter 09 carries this file into the evidence package.

The tests

tests/McPipeline.Tests.ps1 has 49 fixture tests and needs no module: it zips packages in a temporary folder and uses two definitions 4.12.0 wrote, with the package hash replaced by a placeholder. tests/LearnBaseline.Tests.ps1 has 16 tests that run Learn’s cmdlets and the pinned sample offline. They skip unless the pinned module versions are found.

ImportantIllustrative code

The build runs Learn’s cmdlets as the module publishes them, and its checks are tested against fixtures and offline runs, not against a production subscription. The cleaned MOF parses the same with DSC’s deserializer, but its acceptance by the agent on a real machine is shown in Lab 2. Review the code, and run Lab 2, before it builds a production baseline.

Lab 1: offline, no subscription

You need Windows with PowerShell 7.1 or later and Pester 5. Nothing in this lab signs in, uploads, or installs the machine configuration agent.

NoteEvery command in Lab 1

Every command in this lab, in order. Each step below says what it does and what to look for.

# Step 1: Save the pinned modules
Save-Module GuestConfiguration -RequiredVersion 4.12.0 -Path ./mcmods
Save-Module PSDesiredStateConfiguration -RequiredVersion 2.0.7 -Path ./mcmods
Save-Module PSDscResources -RequiredVersion 2.12.0.0 -Path ./mcmods
$env:PSModulePath = (Resolve-Path ./mcmods).Path + ';' + $env:PSModulePath
Import-Module PSDesiredStateConfiguration -RequiredVersion 2.0.7

# Step 2: Follow Learn's steps by hand
. ./configurations/TlsServerProtocols.ps1
TlsServerProtocols -OutputPath ./lab/compiled
New-GuestConfigurationPackage -Name TlsServerProtocols -Configuration ./lab/compiled/localhost.mof -Type Audit -Path ./lab/p1 -Force
New-GuestConfigurationPackage -Name TlsServerProtocols -Configuration ./lab/compiled/localhost.mof -Type Audit -Path ./lab/p2 -Force
Get-FileHash ./lab/p1/TlsServerProtocols.zip, ./lab/p2/TlsServerProtocols.zip

# Step 2: Follow Learn's steps by hand
Select-String -Path ./lab/compiled/localhost.mof -Pattern '@GeneratedBy|@GenerationHost|SourceInfo'

# Step 3: See what the checks say about Learn's output
Import-Module ./powershell/McPipeline.psm1
Test-McPackage -Path ./lab/p1/TlsServerProtocols.zip -Name TlsServerProtocols -ExpectedType Audit

# Step 4: Run Microsoft's pinned sample with the current module
cd ../third_party/guest-configuration-samples/package-samples/.example-project
$env:PSModulePath = "$PWD/Modules;" + $env:PSModulePath
New-GuestConfigurationPackage -Name AdministratorsGroupMembers -Configuration ./AdministratorsGroupMembers.mof -Path $env:TEMP/ms -Force
Get-Command Test-GuestConfigurationPackage -ErrorAction SilentlyContinue   # nothing: renamed
cd ../../../../machine-configuration

# Step 4: Run Microsoft's pinned sample with the current module
Test-McMofText -Text (Get-Content ../third_party/guest-configuration-samples/package-samples/.example-project/AdministratorsGroupMembers.mof -Raw)

# Step 5: Run the checked build
pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 `
    -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./out

# Step 5: Run the checked build
Select-String -Path ./out/TlsServerProtocols_1.0.0/policy/TlsServerProtocols_1.0.0_AuditIfNotExists.json -Pattern 'contentHash|IncludeArcMachines'

# Step 5: Run the checked build
pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 `
    -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./out2
foreach ($o in './out', './out2') { $p = Get-Content "$o/TlsServerProtocols_1.0.0/provenance.json" -Raw | ConvertFrom-Json; '{0}  mof {1}  package {2}' -f $o, $p.mof.sha256, $p.package.sha256 }

# Step 6: Break something on purpose
(Get-Content -Raw ./config/releases.json).Replace('"published": "0.0.0"', '"published": "1.0.0"') | Set-Content -NoNewline ./lab/releases.json
pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
    -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

# Step 6: Break something on purpose
(Get-Content -Raw ./lab/releases.json).Replace('"mode": "Audit"', '"mode": "applyAndAutoCorrect"') | Set-Content -NoNewline ./lab/releases.json
pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
    -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

# Step 6: Break something on purpose
(Get-Content -Raw ./lab/releases.json).Replace('"mode": "applyAndAutoCorrect"', '"mode": "ApplyAndAutoCorrect"') -replace ',\r?\n\s*"owner_tag": \{[^}]*\}', '' | Set-Content -NoNewline ./lab/releases.json
pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
    -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

# Step 7: Run the tests
$env:MC_MODULE_PATH = (Resolve-Path ./mcmods).Path
Invoke-Pester ./tests

1. Save the pinned modules to a folder rather than installing them, from examples/machine-configuration:

   Save-Module GuestConfiguration -RequiredVersion 4.12.0 -Path ./mcmods
   Save-Module PSDesiredStateConfiguration -RequiredVersion 2.0.7 -Path ./mcmods
   Save-Module PSDscResources -RequiredVersion 2.12.0.0 -Path ./mcmods
   $env:PSModulePath = (Resolve-Path ./mcmods).Path + ';' + $env:PSModulePath
   Import-Module PSDesiredStateConfiguration -RequiredVersion 2.0.7

2. Follow Learn’s steps by hand. Compile the chapter’s configuration and package it the way Learn’s page does:²⁹

   . ./configurations/TlsServerProtocols.ps1
   TlsServerProtocols -OutputPath ./lab/compiled
   New-GuestConfigurationPackage -Name TlsServerProtocols -Configuration ./lab/compiled/localhost.mof -Type Audit -Path ./lab/p1 -Force
   New-GuestConfigurationPackage -Name TlsServerProtocols -Configuration ./lab/compiled/localhost.mof -Type Audit -Path ./lab/p2 -Force
   Get-FileHash ./lab/p1/TlsServerProtocols.zip, ./lab/p2/TlsServerProtocols.zip

   Two packages from one MOF, with two different hashes. Now look inside the MOF:

   Select-String -Path ./lab/compiled/localhost.mof -Pattern '@GeneratedBy|@GenerationHost|SourceInfo'

   Your user name and computer name are in the header, and your folder path is in every SourceInfo.

3. See what the checks say about Learn’s output:

   Import-Module ./powershell/McPipeline.psm1
   Test-McPackage -Path ./lab/p1/TlsServerProtocols.zip -Name TlsServerProtocols -ExpectedType Audit

   Three rows: two MC-PKG-04 findings (build-host data, absolute path) and the MC-PKG-07 warning (no version in the name).

4. Run Microsoft’s pinned sample with the current module. Still in examples/machine-configuration, package the example project’s MOF and module, and look for the cmdlet its script calls:

   cd ../third_party/guest-configuration-samples/package-samples/.example-project
   $env:PSModulePath = "$PWD/Modules;" + $env:PSModulePath
   New-GuestConfigurationPackage -Name AdministratorsGroupMembers -Configuration ./AdministratorsGroupMembers.mof -Path $env:TEMP/ms -Force
   Get-Command Test-GuestConfigurationPackage -ErrorAction SilentlyContinue   # nothing: renamed
   cd ../../../../machine-configuration

   The package builds. Now check Microsoft’s published MOF:

   Test-McMofText -Text (Get-Content ../third_party/guest-configuration-samples/package-samples/.example-project/AdministratorsGroupMembers.mof -Raw)

   It returns nothing: Microsoft’s published MOF carries no build-host data, which is the form the cleaner produces.

5. Run the checked build:

   pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 `
       -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./out

   It exits 0 with one information row, MC-POL-09: IncludeArcMachines defaults to false. Find contentHash and the IncludeArcMachines parameter in the policy definition:

   Select-String -Path ./out/TlsServerProtocols_1.0.0/policy/TlsServerProtocols_1.0.0_AuditIfNotExists.json -Pattern 'contentHash|IncludeArcMachines'

   Run the build again into ./out2 and compare the two provenance.json files:

   pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 `
       -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./out2
   foreach ($o in './out', './out2') { $p = Get-Content "$o/TlsServerProtocols_1.0.0/provenance.json" -Raw | ConvertFrom-Json; '{0}  mof {1}  package {2}' -f $o, $p.mof.sha256, $p.package.sha256 }

   The mof.sha256 values match (ecffd795…), and the package hashes don’t.

6. Break something on purpose. The first command writes a copy of config/releases.json to ./lab/releases.json with published changed to 1.0.0; the build passes it with -Registry and writes to ./lab/out-registry, leaving ./out alone:

   (Get-Content -Raw ./config/releases.json).Replace('"published": "0.0.0"', '"published": "1.0.0"') | Set-Content -NoNewline ./lab/releases.json
   pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
       -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

   Exit 2, MC-POL-06. Now change mode in the copy to applyAndAutoCorrect (lower-case a) and build again:

   (Get-Content -Raw ./lab/releases.json).Replace('"mode": "Audit"', '"mode": "applyAndAutoCorrect"') | Set-Content -NoNewline ./lab/releases.json
   pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
       -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

   Exit 1, because the mode is case sensitive. Change it to ApplyAndAutoCorrect, remove owner_tag, and build again:

   (Get-Content -Raw ./lab/releases.json).Replace('"mode": "applyAndAutoCorrect"', '"mode": "ApplyAndAutoCorrect"') -replace ',\r?\n\s*"owner_tag": \{[^}]*\}', '' | Set-Content -NoNewline ./lab/releases.json
   pwsh ./powershell/Invoke-McBuild.ps1 -Name TlsServerProtocols -Version 1.0.0 -Registry ./lab/releases.json `
       -ContentUri https://stcontosomc.blob.core.windows.net/machine-configuration -ModulePath ./mcmods -OutputPath ./lab/out-registry

   Exit 2, MC-POL-08.

7. Run the tests:

   $env:MC_MODULE_PATH = (Resolve-Path ./mcmods).Path
   Invoke-Pester ./tests

Expected result: 65 tests passing (49 if MC_MODULE_PATH isn’t set, with 16 skipped), and each difference in the table above seen with your own eyes.

Lab 2: test subscription and a disposable server

Use a test subscription and a server you can rebuild, never production. Learn says local testing runs the same agent as the machines, installs it under C:\ProgramData\GuestConfig\bin on first use, and needs elevation; Start-GuestConfigurationPackageRemediation changes the machine it runs on.³⁰ You’ll replace: <storage-account> and <container> (the test storage account and container you create in step 3).

NoteEvery command in Lab 2

Every command in this lab, in order. Each step below says what it does and what to look for.

# Step 1: Test the package on the disposable server
Get-GuestConfigurationPackageComplianceStatus -Path ./TlsServerProtocols_1.0.0.zip

# Step 1: Test the package on the disposable server
foreach ($p in 'TLS 1.0', 'TLS 1.1') { $k = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$p\Server"; New-Item -Path $k -Force | Out-Null; Set-ItemProperty -Path $k -Name Enabled -Value 0 -Type DWord }
Get-GuestConfigurationPackageComplianceStatus -Path ./TlsServerProtocols_1.0.0.zip

# Step 2: Sign in to the right cloud
Connect-AzAccount -Environment AzureCloud

# Step 2: Sign in to the right cloud
# Only for a test subscription in Azure Government
Connect-AzAccount -Environment AzureUSGovernment

# Step 3: Publish the exact bytes
$ctx = New-AzStorageContext -StorageAccountName <storage-account> -UseConnectedAccount
Set-AzStorageBlobContent -Container <container> -File ./out/TlsServerProtocols_1.0.0/TlsServerProtocols_1.0.0.zip -Blob TlsServerProtocols_1.0.0.zip -Context $ctx
New-Item -ItemType Directory -Force ./lab/download | Out-Null
Get-AzStorageBlobContent -Container <container> -Blob TlsServerProtocols_1.0.0.zip -Destination ./lab/download/ -Context $ctx
(Get-FileHash ./lab/download/TlsServerProtocols_1.0.0.zip -Algorithm SHA256).Hash.ToLowerInvariant()
(Get-Content ./out/TlsServerProtocols_1.0.0/provenance.json -Raw | ConvertFrom-Json).package.sha256

# Step 5: Publish the definition
New-AzPolicyDefinition -Name ca593085-dfcb-425d-ac9c-12870a55bbaa -Policy ./out/TlsServerProtocols_1.0.0/policy/TlsServerProtocols_1.0.0_AuditIfNotExists.json

1. Test the package on the disposable server. Copy TlsServerProtocols_1.0.0.zip from Lab 1 to it and, in an elevated PowerShell 7 session with the pinned modules, run:³¹

   Get-GuestConfigurationPackageComplianceStatus -Path ./TlsServerProtocols_1.0.0.zip

   Expect complianceStatus False on a default server, with a reason per registry key. The first command sets both Enabled values to 0 (the keys the configuration audits); then test again:

   foreach ($p in 'TLS 1.0', 'TLS 1.1') { $k = "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\$p\Server"; New-Item -Path $k -Force | Out-Null; Set-ItemProperty -Path $k -Name Enabled -Value 0 -Type DWord }
   Get-GuestConfigurationPackageComplianceStatus -Path ./TlsServerProtocols_1.0.0.zip

   Expect True. This is the step that shows the agent accepts the cleaned MOF.

2. Sign in to the right cloud. The program’s estate is a Microsoft 365 GCC tenant, whose Azure subscriptions are in commercial Azure: Learn says Office 365 GCC uses Microsoft Entra Public, and an Azure Government subscription can’t be associated with a directory there.³² So the lab’s default is the commercial cloud, AzureCloud:³³

   Connect-AzAccount -Environment AzureCloud

   Check the server can reach the cloud’s machine configuration endpoints. For commercial Azure, Learn lists *.guestconfiguration.azure.com for Arc-enabled servers,^{34 35} and for each region agentserviceapi.guestconfiguration.azure.com and a regional endpoint, such as eastus-gas.guestconfiguration.azure.com and eus-gas.guestconfiguration.azure.com for East US, with package storage in that region’s oaasguestconfig*.blob.core.windows.net accounts.³⁶

   If the test subscription is in Azure Government instead, the alternative for a GCC High or DoD estate, sign in to that cloud:

   # Only for a test subscription in Azure Government
   Connect-AzAccount -Environment AzureUSGovernment

   For Azure Government, Learn lists *.guestconfiguration.azure.us for Arc-enabled servers³⁷ and regional endpoints for US Gov Arizona, Texas and Virginia.³⁸

3. Publish the exact bytes. Create a storage account and container in the test subscription with anonymous blob access disabled, and upload the package Lab 1 built with Learn’s Set-AzStorageBlobContent step.³⁹ Don’t rebuild it. Download it back and compare its SHA-256 with package.sha256 in provenance.json. From examples/machine-configuration:

   $ctx = New-AzStorageContext -StorageAccountName <storage-account> -UseConnectedAccount
   Set-AzStorageBlobContent -Container <container> -File ./out/TlsServerProtocols_1.0.0/TlsServerProtocols_1.0.0.zip -Blob TlsServerProtocols_1.0.0.zip -Context $ctx
   New-Item -ItemType Directory -Force ./lab/download | Out-Null
   Get-AzStorageBlobContent -Container <container> -Blob TlsServerProtocols_1.0.0.zip -Destination ./lab/download/ -Context $ctx
   (Get-FileHash ./lab/download/TlsServerProtocols_1.0.0.zip -Algorithm SHA256).Hash.ToLowerInvariant()
   (Get-Content ./out/TlsServerProtocols_1.0.0/provenance.json -Raw | ConvertFrom-Json).package.sha256

   The two hashes match.

4. Grant read access to the machines, not a token. The definition uses each machine’s system-assigned identity, so assign Storage Blob Data Reader on the storage account to the test server’s identity, as Learn describes for this option.⁴⁰ No SAS token goes in the definition.

5. Publish the definition. With Resource Policy Contributor on the test subscription,⁴¹ run it with the registry’s policyId from config/releases.json as the name:

   New-AzPolicyDefinition -Name ca593085-dfcb-425d-ac9c-12870a55bbaa -Policy ./out/TlsServerProtocols_1.0.0/policy/TlsServerProtocols_1.0.0_AuditIfNotExists.json

   Using the registry’s policy ID as the name means the next version updates this definition.

6. Assign it to the test resource group with IncludeArcMachines set to true. If the test server is Arc-enabled and you leave the default, nothing happens and nothing says so.

7. Read the result. Within a few evaluation cycles the guest assignment appears with a compliance status. Read it in the portal’s guest assignments page or through Resource Graph, the way VK-ARC-03 and VK-ARC-07 in Chapter 03’s validation kit do. Record the assignment’s contentHash and compare it with provenance.json.

8. Back it out. Delete the policy assignment; Learn says that deletes the guest assignment it created, but a definition removed from an initiative leaves its guest assignments behind to delete by hand.⁴² Then delete the definition, the blob and the role assignment, and rebuild the disposable server.

To try an enforcing version, rebuild with the registry mode set to ApplyAndMonitor, a new version and a new package name. Tag the test server ConfigOwner = ArcMachineConfiguration; an untagged server stays out of scope, which is the point.

Verified facts

Item	Value	Source
Release stage	Custom packages that audit and apply, and custom definitions with AuditIfNotExists or DeployIfNotExists, are generally available	43 44
Agent versions for apply	Azure VM guest configuration extension 1.26.24 or later; Arc agent 1.10.0 or later	45
Authoring environment	Windows with PowerShell 7.1.3 or later, or Ubuntu 20+ with 7.2.4 or later; PSDesiredStateConfiguration 2.0.7 for Windows configurations, the 3.0.0 prerelease for Linux	46 47
Package	.zip, at most 100 MB uncompressed; type Audit or AuditAndSet; no secrets	48 49
Assignment types	Audit, ApplyAndMonitor, ApplyAndAutoCorrect, case sensitive	50
Guest assignments per machine	Up to 50	51
Publish the definition	New-AzPolicyDefinition; recommended role Resource Policy Contributor	52
Role granted to an enforcing definition’s remediation identity	088ab73d-1256-47ae-bea9-9de8e7131f31, Guest Configuration Resource Contributor (name from Microsoft’s role tables, not Learn’s built-in roles reference; confirm with Get-AzRoleDefinition in Lab 2)	53 54
Package access	System-assigned identity works for Arc-enabled servers; user-assigned identity doesn’t, and needs -ExcludeArcMachines; either needs Storage Blob Data Reader and anonymous blob access disabled	55 56
Signing	Protect-GuestConfigurationPackage; public key in Trusted Publishers (Windows) or /usr/local/share/ca-certificates/gc (Linux); tag GuestConfigPolicyCertificateValidation = enabled on machines that must require it	57
Turning off remediation of custom content on one machine	Tag CustomGuestConfigurationSetPolicy = disable	58
Commercial Azure (the GCC estate)	Connect-AzAccount -Environment AzureCloud; Arc-enabled servers need *.guestconfiguration.azure.com; each region has agentserviceapi.guestconfiguration.azure.com and a regional endpoint, such as eastus-gas.guestconfiguration.azure.com	59 60 61 62
Azure Government	Arc-enabled servers need *.guestconfiguration.azure.us; machine configuration endpoints are listed for US Gov Arizona, Texas and Virginia	63 64
Cost on Arc	Included at no extra cost for Arc-enabled Windows servers with Software Assurance or a subscription license once attested, or enrolled in Windows Server pay-as-you-go; otherwise purchased separately. Activation isn’t available in US Gov Virginia or US Gov Arizona (Learn lists those and three China regions as the exceptions), so in those regions plan to buy it	65

The GuestConfiguration module version, its command list and its behavior described above come from the PowerShell Gallery and from running it, not from Learn.⁶⁶

Federal requirements and evidence

A machine configuration package is the server baseline in a file, so what was built, from what, and what shipped is the evidence. Each row names the file or command that proves it. Controls are from the Moderate baseline⁶⁷; indicators are from FedRAMP’s list⁶⁸. Which output supports which control is the program’s reading (design guidance).

What the output proves	Requirement it supports	KSI it aligns to	Who keeps it
The build compiles against pinned module versions (Lab 1, step 1: Save-Module ... -RequiredVersion; RequiredModules.psd1)	SR-3; SA-10 (Developer Configuration Management)	KSI-SCR-MIT	The repository
Learn’s cmdlets alone give two package hashes from one MOF, and the MOF carries the build host (step 2)	SA-11	KSI-CMT-VTD	The test results: LearnBaseline.Tests.ps1
The package check refuses build-host data (step 3: MC-PKG-04)	SA-11; CM-3(2)	KSI-CMT-VTD	The check output
Microsoft’s pinned sample still packages, and its MOF has no build-host data (step 4: Test-McMofText)	SR-3	KSI-SCR-MIT	The repository: snapshot.json
The checked build passes, and its findings are recorded (step 5: findings.json, exit 0)	CM-3(2)	KSI-CMT-VTD	The evidence store
The same commit gives the same cleaned MOF hash; the package and definition hashes identify what shipped (step 5: provenance.json)	SA-10; SI-7; CM-2	KSI-SVC-VRI; KSI-CMT-LMC	The evidence store; Chapter 09’s package
The definition carries the package’s contentHash, and the build reminds that Arc servers are out of scope by default (step 5: the _AuditIfNotExists.json definition, MC-POL-09)	CM-6; SI-7	KSI-SVC-ACM; KSI-SVC-VRI	The repository; the published definition
A version that didn’t rise, a mode in the wrong case and an enforcing definition with no owner filter are refused (step 6: MC-POL-06, exit 1, MC-POL-08)	CM-3; CM-6: one owning tool per setting	KSI-CMT-VTD	The pull request’s check run
The checks and the offline cmdlet runs pass (step 7: 65 tests)	SA-11	KSI-CMT-VTD	The repository’s test results
The agent reports non-compliant, then compliant once the setting is made (Lab 2, step 1: Get-GuestConfigurationPackageComplianceStatus)	CM-6; CA-7	KSI-MLA-EVC	The test record
The published blob is the built package, byte for byte (Lab 2, step 3: downloaded SHA-256 equals package.sha256)	SI-7	KSI-SVC-VRI	The change record
Machines read the package with their own identity, and no SAS goes in the definition (Lab 2, step 4: Storage Blob Data Reader)	AC-6; IA-5	KSI-IAM-ELP; KSI-IAM-SNU	The Azure role assignment record
The definition is published under the registry’s fixed ID, so the next version updates it (Lab 2, step 5: New-AzPolicyDefinition -Name <policyId>)	CM-3; CM-5	KSI-CMT-RMV	The Azure activity log
The assignment includes Arc-enabled servers (Lab 2, step 6: IncludeArcMachines true)	CM-6	KSI-SVC-ACM	The assignment’s parameters
Each machine reports compliance against the package whose hash is in provenance.json (Lab 2, step 7)	CA-7; SI-7	KSI-MLA-EVC; KSI-SVC-VRI	The guest assignment; Resource Graph; the evidence store
The assignment, its guest assignments, the definition and the blob are removed (Lab 2, step 8)	CM-3	KSI-CMT-LMC	The Azure activity log
Azure Policy and machine configuration run on cloud services with FedRAMP Marketplace listings69	SA-9 (External System Services); the agency confirms each service it uses is inside the listing’s scope (design guidance)	None: the provider reports against the indicators for its own offering	The system security plan’s list of external services

Key Security Indicators are FedRAMP 20x indicators for cloud service providers. The agency authorizes its own system: it lines this evidence up with what Microsoft report against the indicators, and doesn’t report KSIs itself (Book 00, Appendix B). The control-by-control mapping is in Book 13’s Appendix A and Book 14’s Appendix A; the indicator pairings follow Book 04, Chapter 10 and Book 05, Chapter 10.

Dangers

Danger	What happens	The guard
Two tools on one setting	Under ApplyAndAutoCorrect, machine configuration and another tool flip a value back and forth, both reporting success	MC-POL-08 owner tag filter at build time; VK-ARC-07 after assignment
Rebuilding at release time	The package published isn’t the package reviewed, or its hash no longer matches the definition	Publish the bytes the build checked; MC-POL-02; compare the downloaded blob with provenance.json
Build-host data in a published package	User names, host names and folder paths in a blob the whole fleet can read	ConvertTo-McCleanMof; MC-PKG-04
A secret in a MOF	Learn says don’t; a credential compiled into a resource is in every copy of the package	MC-PKG-05; parameters through Azure Policy for values that vary
A long-lived SAS token	Learn’s example lasts three years; the URI in the definition is a standing read grant	System-assigned identity with Storage Blob Data Reader; MC-POL-03
Arc servers silently out of scope	IncludeArcMachines defaults to "false"	MC-POL-09 on every build; Lab 2 step 6
A new GUID for an update	A second definition, and two assignments on the same machines	Fixed policy ID in the registry; MC-POL-05
Enforcing by accident	An AuditAndSet package and an apply mode change servers that were only meant to be measured	Registry mode reviewed; MC-PKG-02 and MC-POL-07; the cmdlet itself refuses an apply mode for an audit-only package
Leftover guest assignments	Removing a definition from an initiative leaves its guest assignments in place70	Back-out step that lists and deletes them
A floating module	A rebuild compiles against different resources	RequiredModules.psd1; the baseline tests on every module update
Unsigned content where signing is required	Tagged machines refuse it71	Sign before publishing, as Learn says, and generate the definition from the file you publish, so contentHash is the hash of the signed package (design guidance)

Checklist

• The configuration is in Git, with the registry entry in the same pull request: fixed policy ID, mode, published version, owner tag, identity.
• The build ran from the pinned module versions and exited 0; findings.json has no findings.
• The cleaned MOF’s hash in provenance.json matches a rebuild of the same commit.
• The package was tested on a disposable server with Get-GuestConfigurationPackageComplianceStatus (and Start-GuestConfigurationPackageRemediation for AuditAndSet).
• The published blob’s SHA-256 matches package.sha256, and the definition’s contentHash matches it everywhere it appears.
• No SAS token in the definition, or one that expires within 90 days with a recorded reason.
• Enforcing definitions filter on ConfigOwner, and VK-ARC-07 is clean after assignment.
• The assignment sets IncludeArcMachines to true where Arc-enabled servers are in scope.
• Signed content, where required: signed after the checks, definition generated from the signed file, machines tagged.
• The pinned sample matches its manifest, and every upstream commit to the samples and the module since the pin has been reviewed.
• provenance.json and findings.json are in the evidence store.

TipContinue the book

← Previous: Chapter 06 — Moving Group Policy as Code · Workbook index · Next: Chapter 08 — Ansible Beside Arc →

---

1. Microsoft Learn, “What is Azure Machine Configuration?,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/01-overview-concepts (accessed Oct 30, 2026).

2. Microsoft Learn, “Understand machine configuration assignment resources,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/assignments (accessed Oct 30, 2026).

3. Microsoft Learn, “What is Azure Machine Configuration?,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/01-overview-concepts (accessed Oct 30, 2026).

4. Microsoft Learn, “Remediation options for machine configuration,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/remediation-options (accessed Oct 30, 2026).

5. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

6. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

7. Microsoft Learn, “How to set up a machine configuration authoring environment,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/1-set-up-authoring-environment (accessed Oct 30, 2026).

8. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

9. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

10. Microsoft Learn, “How to test machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package (accessed Oct 30, 2026).

11. Microsoft Learn, “How to publish custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/4-publish-package (accessed Oct 30, 2026).

12. Microsoft Learn, “How to sign machine configuration packages,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/6-sign-package (accessed Oct 30, 2026).

13. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

14. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

15. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

16. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

17. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

18. Microsoft Learn, “What is Azure Machine Configuration?,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/01-overview-concepts (accessed Oct 30, 2026).

19. Microsoft, Azure Policy samples, Azure/azure-policy, samples/GuestConfiguration/package-samples at commit ca85d6182e5a855bcdd1462421d5a1305c14c1df (August 4, 2021), MIT License, https://github.com/Azure/azure-policy/tree/ca85d6182e5a855bcdd1462421d5a1305c14c1df/samples/GuestConfiguration/package-samples (accessed Oct 30, 2026); pinned copy in examples/third_party/guest-configuration-samples.

20. PowerShell Gallery, “GuestConfiguration 4.12.0,” https://www.powershellgallery.com/packages/GuestConfiguration/4.12.0 (accessed Oct 30, 2026). Not a Learn page: Learn’s setup page installs the module from the gallery without naming a current version.

21. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

22. Microsoft Learn, “How to publish custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/4-publish-package (accessed Oct 30, 2026).

23. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

24. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

25. Microsoft, Azure/Azure-Sentinel, Sample Data/Feeds/AzureBuiltInRole.csv at commit 16a027b6208ceb97869df85ea2e1ce4d0cad3408 (August 28, 2026), row “Guest Configuration Resource Contributor”, and MicrosoftDocs/entra-docs, .docutune/dictionaries/known-guids.json at commit 4ed6827815ecbf4e021fc736d75fdda6a2fd6272 (October 28, 2026), both mapping the name to 088ab73d-1256-47ae-bea9-9de8e7131f31, read with gh api (accessed Oct 30, 2026). Not Learn pages: Learn’s “Azure built-in roles” and its Management and governance page don’t list the ID (searched Oct 30, 2026).

26. Microsoft Learn, “Enable Insights for Azure Local at scale using Azure policies,” https://learn.microsoft.com/azure/azure-local/manage/monitor-multi-azure-policies (accessed Oct 30, 2026); it names the role but not its ID.

27. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

28. Microsoft Learn, “How to provide secure access to custom machine configuration packages,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/5-access-package (accessed Oct 30, 2026).

29. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

30. Microsoft Learn, “How to test machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package (accessed Oct 30, 2026).

31. Microsoft Learn, “How to test machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package (accessed Oct 30, 2026).

32. Microsoft Learn, “Planning identity for Azure Government applications,” https://learn.microsoft.com/azure/azure-government/documentation-government-plan-identity (accessed Nov 9, 2026).

33. Microsoft Learn, “Connect-AzAccount” (Az.Accounts), parameter -Environment and examples showing the AzureCloud environment, https://learn.microsoft.com/powershell/module/az.accounts/connect-azaccount (accessed Nov 9, 2026).

34. Microsoft Learn, “Connected Machine agent network requirements,” https://learn.microsoft.com/azure/azure-arc/servers/network-requirements (accessed Oct 30, 2026).

35. Microsoft Learn, “Azure Machine Configuration network requirements,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/03-network-requirements (accessed Oct 30, 2026).

36. Microsoft Learn, “Azure Machine Configuration network requirements,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/03-network-requirements (accessed Oct 30, 2026).

37. Microsoft Learn, “Connected Machine agent network requirements,” https://learn.microsoft.com/azure/azure-arc/servers/network-requirements (accessed Oct 30, 2026).

38. Microsoft Learn, “Azure Machine Configuration network requirements,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/03-network-requirements (accessed Oct 30, 2026).

39. Microsoft Learn, “How to publish custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/4-publish-package (accessed Oct 30, 2026).

40. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

41. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

42. Microsoft Learn, “Understand machine configuration assignment resources,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/assignments (accessed Oct 30, 2026).

43. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

44. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

45. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

46. Microsoft Learn, “How to set up a machine configuration authoring environment,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/1-set-up-authoring-environment (accessed Oct 30, 2026).

47. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

48. Microsoft Learn, “How to create custom machine configuration package artifacts,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/2-create-package (accessed Oct 30, 2026).

49. Microsoft Learn, “How to develop a custom machine configuration package,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/overview (accessed Oct 30, 2026).

50. Microsoft Learn, “Remediation options for machine configuration,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/remediation-options (accessed Oct 30, 2026).

51. Microsoft Learn, “What is Azure Machine Configuration?,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/01-overview-concepts (accessed Oct 30, 2026).

52. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

53. Microsoft, Azure/Azure-Sentinel, Sample Data/Feeds/AzureBuiltInRole.csv at commit 16a027b6208ceb97869df85ea2e1ce4d0cad3408 (August 28, 2026), row “Guest Configuration Resource Contributor”, and MicrosoftDocs/entra-docs, .docutune/dictionaries/known-guids.json at commit 4ed6827815ecbf4e021fc736d75fdda6a2fd6272 (October 28, 2026), both mapping the name to 088ab73d-1256-47ae-bea9-9de8e7131f31, read with gh api (accessed Oct 30, 2026). Not Learn pages: Learn’s “Azure built-in roles” and its Management and governance page don’t list the ID (searched Oct 30, 2026).

54. Microsoft Learn, “Enable Insights for Azure Local at scale using Azure policies,” https://learn.microsoft.com/azure/azure-local/manage/monitor-multi-azure-policies (accessed Oct 30, 2026); it names the role but not its ID.

55. Microsoft Learn, “How to create custom machine configuration policy definitions,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/create-policy-definition (accessed Oct 30, 2026).

56. Microsoft Learn, “How to provide secure access to custom machine configuration packages,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/5-access-package (accessed Oct 30, 2026).

57. Microsoft Learn, “How to sign machine configuration packages,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/6-sign-package (accessed Oct 30, 2026).

58. Microsoft Learn, “Remediation options for machine configuration,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/remediation-options (accessed Oct 30, 2026).

59. Microsoft Learn, “Planning identity for Azure Government applications,” https://learn.microsoft.com/azure/azure-government/documentation-government-plan-identity (accessed Nov 9, 2026).

60. Microsoft Learn, “Connect-AzAccount” (Az.Accounts), parameter -Environment and examples showing the AzureCloud environment, https://learn.microsoft.com/powershell/module/az.accounts/connect-azaccount (accessed Nov 9, 2026).

61. Microsoft Learn, “Connected Machine agent network requirements,” https://learn.microsoft.com/azure/azure-arc/servers/network-requirements (accessed Oct 30, 2026).

62. Microsoft Learn, “Azure Machine Configuration network requirements,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/03-network-requirements (accessed Oct 30, 2026).

63. Microsoft Learn, “Connected Machine agent network requirements,” https://learn.microsoft.com/azure/azure-arc/servers/network-requirements (accessed Oct 30, 2026).

64. Microsoft Learn, “Azure Machine Configuration network requirements,” https://learn.microsoft.com/azure/governance/machine-configuration/overview/03-network-requirements (accessed Oct 30, 2026).

65. Microsoft Learn, “Windows Server Management enabled by Azure Arc,” https://learn.microsoft.com/azure/azure-arc/servers/windows-server-management-overview, section “Requirements” (accessed Oct 31, 2026).

66. PowerShell Gallery, “GuestConfiguration 4.12.0,” https://www.powershellgallery.com/packages/GuestConfiguration/4.12.0 (accessed Oct 30, 2026). Not a Learn page: Learn’s setup page installs the module from the gallery without naming a current version.

67. National Institute of Standards and Technology, SP 800-53B Moderate baseline, release 5.2.0 OSCAL profile, last modified October 22, 2026 (includes AC-6, CA-7, CM-2, CM-3, CM-3(2), CM-5, CM-6, IA-5, SA-9, SA-10, SA-11, SI-7 and SR-3), https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_MODERATE-baseline_profile.json (accessed Nov 2, 2026).

68. FedRAMP, “Key Security Indicators,” FedRAMP Consolidated Rules for 2026 (indicators KSI-CMT-LMC, KSI-CMT-RMV, KSI-CMT-VTD, KSI-IAM-ELP, KSI-IAM-SNU, KSI-MLA-EVC, KSI-SCR-MIT, KSI-SVC-ACM and KSI-SVC-VRI; control mappings updated October 13, 2026), https://www.fedramp.gov/2026/reference/key-security-indicators/ (accessed Nov 2, 2026).

69. FedRAMP Marketplace product data, https://www.fedramp.gov/marketplace/products.json, last_change 2026-11-01T05:02:56Z (accessed Nov 2, 2026): F1209051525, Azure Commercial Cloud, FedRAMP Certified, Class D, High; F1603087869, Azure Government (includes Dynamics 365), FedRAMP Certified, Class D, High.

70. Microsoft Learn, “Understand machine configuration assignment resources,” https://learn.microsoft.com/azure/governance/machine-configuration/concepts/assignments (accessed Oct 30, 2026).

71. Microsoft Learn, “How to sign machine configuration packages,” https://learn.microsoft.com/azure/governance/machine-configuration/how-to/develop-custom-package/6-sign-package (accessed Oct 30, 2026).