Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in Trend Vision One™ Cloud Risk Management. For details, please refer to Upgrade to Trend Vision One
Use the Knowledge Base AI to help improve your Cloud Posture

Check OS Image Version

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: High (not acceptable risk)

To get the latest security patches and the most up-to-date ML packages and drivers, ensure that your Azure Machine Learning compute instances are using the latest OS image version.

Security
Reliability
Performance
efficiency
Operational
excellence

Using the latest OS image version for Azure Machine Learning compute instances is important for several key reasons, primarily centered on security and functionality. The latest image version includes all applicable OS-related patches and security fixes sourced from the original publisher, which reduces vulnerabilities. Microsoft performs regular vulnerability scanning and fixes any unaddressed issues in the next monthly release. New images also contain the latest updates for system packages and pre-installed Machine Learning packages like the Azure Machine Learning SDK, ensuring access to the newest features and bug fixes. Regularly updating to the latest image (simply accomplished by recreating the compute instance) is a recommended part of the shared responsibility model for vulnerability management.


Audit

To determine if your Machine Learning compute instances are using the latest OS image version, perform the following operations:

Checking the Machine Learning compute instances for the latest OS image version using the Azure Console (Azure Portal) is not currently supported.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run ml workspace list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure Machine Learning workspace available in the current subscription:

az ml workspace list
	--output table
	--query '[*].{name:name, resourceGroup:resourceGroup}'

05 The command output should return the requested Azure Machine Learning workspace identifiers:

Name                           ResourceGroup
------------------------       ------------------------------
tm-ml-project5-workspace       cloud-shell-storage-westeurope
tm-ml-production-workspace     cloud-shell-storage-westeurope

06 Run ml compute list command (Windows/macOS/Linux) with custom output filters to list the name of each compute instance provisioned for the selected Azure Machine Learning workspace:

az ml compute list
	--resource-group cloud-shell-storage-westeurope
	--workspace-name tm-ml-project5-workspace
	--output table
	--query "[].{Name:name}"

07 The command output should return the requested compute instance identifiers (names):

Name
----------------------
project5-ml-instance01
project5-ml-instance02
project5-ml-instance03

08 Run ml compute show command (Windows/macOS/Linux) with the name of the Azure Machine Learning compute instance that you want to examine as the identifier parameter, to determine the status of the SSH Public Access feature for the selected compute instance:

az ml compute show
	--name project5-ml-instance01
	--workspace-name tm-ml-project5-workspace
	--resource-group cloud-shell-storage-westeurope
	--query "is_latest_os_image_version"

09 The command output should return the "is_latest_os_image_version" attribute value (true for enabled, false for disabled). "is_latest_os_image_version" indicates whether the verified compute instance is using the latest OS image version:

false

If the ml compute show command output returns false for the "is_latest_os_image_version" attribute, as shown in the example above, the selected Azure Machine Learning compute instance is not using the latest OS image version.

Remediation / Resolution

To ensure that your Azure Machine Learning compute instances are not using the standard port (22) for SSH access, perform the following operations:

Using Azure Console

01 Sign in to the Microsoft Azure Portal.

02 Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.

03 Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.

04 From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure Machine Learning workspace for Value, then choose Apply to list the Azure Machine Learning workspaces available in the selected subscription.

05 Click on the name (link) of the Machine Learning workspace that you want to access.

06 In the resource navigation panel, select Overview, and choose Launch studio to open the Azure Machine Learning Studio.

07 In the left navigation panel, under Manage, choose Compute, and select the Compute instances tab.

08 In Azure Machine Learning, compute instances receive the latest VM images at the time of provisioning. However, once a compute instance is deployed, it does not get actively updated, even though Microsoft releases new VM images on a monthly basis. While you can query an instance's operating system version, to stay up to date with the latest software updates and security patches, you must re-create your Machine Learning compute instances to get the latest OS image. Choose New and perform the following actions to create your new compute instance:

  1. For Required settings, enter a name for the new instance in the Compute name box, select the instance type from the Virtual machine type, choose Select from all options under Virtual machine size, and select the appropriate VM size for your instance. Choose Next to continue the setup process.
  2. (Optional) For Scheduling, choose whether to schedule the compute to start or stop on a recurring basis. You can also configure instance auto shutdown on this step. Choose Next to continue.
  3. For Security, configure security settings such as SSH access, virtual network injection, root access, Single Sign-On (SSO), and managed identity for your new compute instance. Choose Next to continue the setup.
  4. (Optional) For Applications, choose Add application, and add custom applications you may want to use on your compute instance. You can also choose to provision the new instance with a creation and/or startup script on this step. Choose Next to continue.
  5. (Optional) For Tags, use the Name and Value text fields to create the tagging schema for your compute instance. Choose Next to continue the setup.
  6. For Review, review the instance configuration and choose Create to deploy your new compute instance.

09 (Optional) To remove the outdated compute instance from your Azure Machine Learning workspace, select the instance that you want to remove, select Delete, and choose again Delete in the confirmation box.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to access as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run ml workspace list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure Machine Learning workspace available in the current subscription:

az ml workspace list
	--output table
	--query '[*].{name:name, resourceGroup:resourceGroup}'

05 The command output should return the requested Azure Machine Learning workspace identifiers:

Name                           ResourceGroup
------------------------       ------------------------------
tm-ml-project5-workspace       cloud-shell-storage-westeurope
tm-ml-production-workspace     cloud-shell-storage-westeurope

06 Machine Learning compute instances get the latest VM images at the time of provisioning. However, once a compute instance is deployed, it does not get actively updated, even though Microsoft releases new VM images on a monthly basis. While you can query an instance's operating system version, to stay up to date with the latest software updates and security patches, you must re-create your Machine Learning compute instances to get the latest OS image. Run ml compute create command (Windows/macOS/Linux) to create your new compute instance:

az ml compute create
	--name project5-new-instance01
	--size Standard_DS3_v2
	--type ComputeInstance
	--workspace-name tm-ml-project5-workspace
	--resource-group cloud-shell-storage-westeurope

07 The command output should return the configuration information available for the new compute instance:

{
	"created_on": "2025-10-02T12:30:43.855643+0000",
	"enable_node_public_ip": true,
	"enable_os_patching": false,
	"enable_root_access": true,
	"enable_sso": true,
	"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.MachineLearningServices/workspaces/tm-ml-project5-workspace/computes/project5-new-instance01",
	"last_operation": {
		"operation_name": "Create",
		"operation_status": "Succeeded",
		"operation_time": "2025-10-02T12:30:51.837Z",
		"operation_trigger": "User"
	},
	"location": "westeurope",
	"name": "project5-new-instance01",
	"network_settings": {
		"private_ip_address": "10.0.0.4",
		"public_ip_address": "xxx.xxx.xxx.xxx"
	},
	"os_image_metadata": {
		"current_image_version": "25.07.12",
		"is_latest_os_image_version": true,
		"latest_image_version": "25.07.12"
	},
	"provisioning_state": "Succeeded",
	"release_quota_on_stop": false,
	"resourceGroup": "cloud-shell-storage-westeurope",
	"services": [
		{
			"display_name": "Jupyter",
			"endpoint_uri": "https://project5-new-instance01.westeurope.instances.azureml.ms/tree/"
		},
		{
			"display_name": "Jupyter Lab",
			"endpoint_uri": "https://project5-new-instance01.westeurope.instances.azureml.ms/lab"
		}
	],
	"size": "Standard_DS3_v2",
	"ssh_public_access_enabled": false,
	"ssh_settings": {
		"admin_username": "azureuser",
		"ssh_port": "50000"
	},
	"state": "Running",
	"type": "computeinstance"
	}

08 (Optional) To remove the non-compliant compute instance from your Azure Machine Learning workspace, run ml compute delete command (Windows/macOS/Linux) to delete the specified compute instance (the command does not produce an output):

az ml compute delete
	--name project5-ml-instance01
	--workspace-name tm-ml-project5-workspace
	--resource-group cloud-shell-storage-westeurope
	--yes

References

Publication date Oct 13, 2025