liveBook · Manning

Adaptive application control

As explained in Azure Security

Adaptive application control uses observed application execution and machine learning to define and enforce an allow list of permitted applications.

Adaptive application control uses machine learning to observe which applications run on machines, establish an allow list of safe applications, and enforce that permitted set. It helps reduce the risk of unauthorized or malicious software executing on Azure virtual machines. section 7.2.1

Table 7.1 Comparison of Defender for Servers plans (view table figure)

Defender for Servers plan 1

Defender for Servers plan 2

Microsoft Defender for Endpoint

Microsoft Defender Vulnerability Management

Auto-provisioning

Microsoft Defender for Endpoint

Microsoft Defender Vulnerability Management

Auto-provisioning

Agentless vulnerability scanning for machines

Just-in-time VM access for machine ports

Adaptive application control

File integrity monitoring

Adaptive network hardening

Network layer threat detections

Integrated vulnerability assessment powered by Qualys

Log Analytics 500 MB free data ingestion

Compare Defender for Servers plans to identify where adaptive application control is included alongside other layered protections. section 7.2.1

How Azure Security covers it

How deep it goes
Explains machine-learning observation and allow-list creation but does not detail configuration or enforcement mechanics.
Examples
Uses observed applications running on machines and the resulting safe-application allow list as its concrete artifacts.
What you can do after
Evaluate application execution and restrict machines to applications identified as safe.
How it connects
Connects Microsoft Defender for Servers with Microsoft Defender for Endpoint, vulnerability assessment, and layered VM protections.

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.