--- title: Protecting Windows Azure Web and Worker roles from malware description: Microsoft released a Customer Technology Preview of Endpoint Protection for Windows Azure, bringing virus scanning, real-time protection, scheduled scans, and... canonical: https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Protecting Windows Azure Web and Worker roles from malware | daily.dev og:description: Microsoft released a Customer Technology Preview of Endpoint Protection for Windows Azure, bringing virus scanning, real-time protection, scheduled scans, and... og:url: https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml og:image: https://api.daily.dev/og/posts/oLth3LzmL.png og:image:alt: Protecting Windows Azure Web and Worker roles from malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Protecting Windows Azure Web and Worker roles from malware **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 3 min read · 0 upvotes · 0 comments ## Summary Microsoft released a Customer Technology Preview of Endpoint Protection for Windows Azure, bringing virus scanning, real-time protection, scheduled scans, and malware remediation to Azure Web and Worker roles. It can be enabled with a single XML import line in ServiceDefinition.csdef, and configured via ServiceConfiguration.cscfg settings covering scan scheduling, exclusions, and datacenter location. Logs are written to the Windows System event log and to local installation folders, which can be surfaced through Azure Diagnostics by adding the appropriate data sources, enabling monitoring via tools like Cerebrata's Diagnostics Monitor. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable Microsoft Endpoint Protection anti-malware on a Windows Azure web role? Add an Antimalware import to the ServiceDefinition.csdef file using the line , alongside other imports like Diagnostics. Once deployed, Windows Azure automatically installs, enables, and configures Microsoft Endpoint Protection on the virtual machines running that role, providing real-time protection, scheduled scanning, and malware remediation. _Developers hardening azure deployments can track platform security plugins like this through daily.dev._ ### How can I monitor Microsoft Endpoint Protection alerts on Windows Azure instances? Endpoint Protection writes its logs to the Windows System event log under the 'Microsoft Antimalware' provider, so you can add a WindowsEventLog data source filtering on that provider and severity levels to your DiagnosticMonitor configuration. Additionally, EP logs details to %programdata%\Microsoft Endpoint Protection and %programdata%\Microsoft\Microsoft Security Client, which can be added as directory data sources and viewed with tools such as Cerebrata's Diagnostics Monitor. _daily.dev helps engineers stay on top of practical azure diagnostics techniques like these._ ### What configuration options are available for the Windows Azure Antimalware plugin? The plugin exposes settings in ServiceConfiguration.cscfg including ServiceLocation (datacenter region), EnableAntimalware, EnableRealtimeProtection, EnableWeeklyScheduledScans, DayForWeeklyScheduledScans, TimeForWeeklyScheduledScans, and pipe-delimited exclusion lists for ExcludedExtensions, ExcludedPaths, and ExcludedProcesses. These can be edited via the service configuration file, management portal, management API, or PowerShell. _Teams fine-tuning azure security plugins can follow configuration changes like these via daily.dev._ ## Similar posts on daily.dev - [Dev Machine Guard Now Supports Windows](https://daily.dev/posts/dev-machine-guard-now-supports-windows-zeykgixzl) · StepSecurity · 0 upvotes · 0 comments - [Building an end-to-end monitoring solution with Azure Arc, Log Analytics and Workbooks–Part 1: Overview & Architecture](https://daily.dev/posts/building-an-end-to-end-monitoring-solution-with-azure-arc-log-analytics-and-workbooks-part-1-overv-nbcudlw0l) · The Art of Simplicity · 0 upvotes · 0 comments - [Azure cloud security: Detect cloud ransomware with Tenable One](https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg) · Tenable Blog · 0 upvotes · 0 comments - [Enforcing Real-Time Cloud App Protection with Conditional Access and Defender for Cloud Apps](https://daily.dev/posts/enforcing-real-time-cloud-app-protection-with-conditional-access-and-defender-for-cloud-apps-q1ym9flou) · InfoSec Write-ups · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Protecting Windows Azure Web and Worker roles from malware","url":"https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml"},"datePublished":"2026-10-04T13:04:20.093Z","dateModified":"2026-10-04T13:06:05.812Z","description":"Microsoft released a Customer Technology Preview of Endpoint Protection for Windows Azure, bringing virus scanning, real-time protection, scheduled scans, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15255982d235d35d0defef6a93d76666?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15255982d235d35d0defef6a93d76666?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,powershell","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Protecting Windows Azure Web and Worker roles from malware"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/protecting-windows-azure-web-and-worker-roles-from-malware-olth3lzml#faq","mainEntity":[{"@type":"Question","name":"How do I enable Microsoft Endpoint Protection anti-malware on a Windows Azure web role?","acceptedAnswer":{"@type":"Answer","text":"Add an Antimalware import to the ServiceDefinition.csdef file using the line , alongside other imports like Diagnostics. Once deployed, Windows Azure automatically installs, enables, and configures Microsoft Endpoint Protection on the virtual machines running that role, providing real-time protection, scheduled scanning, and malware remediation. Developers hardening azure deployments can track platform security plugins like this through daily.dev."}},{"@type":"Question","name":"How can I monitor Microsoft Endpoint Protection alerts on Windows Azure instances?","acceptedAnswer":{"@type":"Answer","text":"Endpoint Protection writes its logs to the Windows System event log under the 'Microsoft Antimalware' provider, so you can add a WindowsEventLog data source filtering on that provider and severity levels to your DiagnosticMonitor configuration. Additionally, EP logs details to %programdata%\\Microsoft Endpoint Protection and %programdata%\\Microsoft\\Microsoft Security Client, which can be added as directory data sources and viewed with tools such as Cerebrata's Diagnostics Monitor. daily.dev helps engineers stay on top of practical azure diagnostics techniques like these."}},{"@type":"Question","name":"What configuration options are available for the Windows Azure Antimalware plugin?","acceptedAnswer":{"@type":"Answer","text":"The plugin exposes settings in ServiceConfiguration.cscfg including ServiceLocation (datacenter region), EnableAntimalware, EnableRealtimeProtection, EnableWeeklyScheduledScans, DayForWeeklyScheduledScans, TimeForWeeklyScheduledScans, and pipe-delimited exclusion lists for ExcludedExtensions, ExcludedPaths, and ExcludedProcesses. These can be edited via the service configuration file, management portal, management API, or PowerShell. Teams fine-tuning azure security plugins can follow configuration changes like these via daily.dev."}}]} ```