EDR configuration issues should be resolved on virtual machines

What does the recommendation "EDR configuration issues should be resolved on virtual machines" check?

Uses Defender for Cloud agentless scanning to read the live settings of the Microsoft Defender for Endpoint sensor already running on a VM and flags health problems such as 'Signature out of date', 'Anti-virus is off or partially configured', and 'Both full and quick scans are out of 7 days'. It assesses configuration of an EDR that is present, not whether one is installed: missing-sensor coverage is a separate recommendation ('EDR solution should be installed on Virtual Machines'). It only evaluates machines where Defender for Endpoint is the detected EDR and needs Defender for Servers Plan 2 or Defender CSPM with agentless scanning on; it does not validate non-Microsoft EDR products or on-premises servers.

Why does "EDR configuration issues should be resolved on virtual machines" matter?

An EDR sensor that is registered but running with stale signatures, real-time protection disabled, or scans days overdue gives a false sense of coverage: the agent reports as installed while its detection surface is degraded, so a ransomware loader or fileless payload it should catch slips through during the exact window an attacker needs. Because the gap is silent, it tends to persist across a whole fleet until an incident exposes it. Resolving these findings restores the behavioural and signature detection you are already paying for, and keeps the machine's posture honest in audit evidence rather than passing on the mere presence of an agent.

How do I fix "EDR configuration issues should be resolved on virtual machines"?

1. In Defender for Cloud open Recommendations, select 'EDR configuration issues should be resolved on virtual machines', then expand each security check (for example 'Signature out of date') to see the affected resources and the per-finding remediation steps.
2. Fix each finding on the machine or in Microsoft Defender for Endpoint: turn real-time protection back on and force a signature update with 'Update-MpSignature', re-enable Microsoft Defender Antivirus where it was switched off or left in passive mode without active protection, and run an overdue scan with 'Start-MpScan -ScanType FullScan'. Confirm with 'Get-MpComputerStatus'.
3. Prevent regression by enforcing these settings centrally with Azure Policy Machine Configuration (Guest Configuration) or your antivirus baseline so signatures auto-update and real-time protection stays on; after remediation it can take up to 24 hours for the VM to move to the Healthy resources tab.

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled