Steps:

1. In the Azure Portal, open Policy (search “Policy”).

2. Go to Authoring → Definitions and click + Policy definition.

   • For Definition location, select the subscription covering your PMC VM.

   • Enter a name (for example: Prevent Defender extensions installation).

   • Under Category, select Compute. 
     

   • 

   • 

3. Under Policy Rule, paste the following JSON:

   {
     "mode": "All",
     "policyRule": {
       "if": {
         "allOf": [
           {
             "field": "type",
             "equals": "Microsoft.Compute/virtualMachines/extensions"
           },
           {
             "field": "Microsoft.Compute/virtualMachines/extensions/type",
             "in": "[parameters('notAllowedExtensions')]"
           }
         ]
       },
       "then": {
         "effect": "deny"
       }
     },
     "parameters": {
       "notAllowedExtensions": {
         "type": "Array",
         "metadata": {
           "description": "The list of extensions that will be denied."
         }
       }
     }
   }
   

4. Save the new Policy definition.

5. Now assign the policy: go to Authoring → Assignments → Assign policy.

   • Under Scope, choose the subscription and the Resource Group dedicated for your PMC virtual machine(s).

   • Under Policy definition, select the one you just created. Set Enforcement to Enabled.

6. On the Parameters tab of the assignment, set the Denied extension parameter value to:

   ["MDE.Linux", "OmsAgentForLinux"]
   

7. Review + create to save the policy assignment.

8. Within the Resource Group containing the PMC VM(s), verify under Settings → Policies that the assignment appears.

5. Upgrade Recommendation

If you are currently running PMC version prior to 4.2.1, we strongly recommend upgrading to version 4.2.1 or newer. By upgrading, you will benefit from:

• The switch to a Debian 12-based OS, which resolves the compatibility concern with Defender for Cloud extensions.

• The fact that the workaround described in Section 4 is no longer required.

• Improved long-term support and stability for new deployments.

See the release notes for version 4.2.1 for full details.