Skip to main content
emnode
Sign up
Compliance Medium severity MCSB ES-2

Microsoft Defender for Cloud · Compute

Endpoint protection health issues on machines should be resolved

Written and reviewed by Emnode · Last reviewed

What does the recommendation "Endpoint protection health issues on machines should be resolved" check?

Flags virtual machines where an endpoint protection solution is installed but reporting an unhealthy state. Defender for Cloud runs Get-MpComputerStatus on each machine and fails the check when any of AMServiceEnabled, AntispywareEnabled, RealTimeProtectionEnabled, BehaviorMonitorEnabled, IoavProtectionEnabled or OnAccessProtectionEnabled returns false, or when the definition signature age (AntispywareSignatureAge or AntivirusSignatureAge) is seven days or more. In other words it assesses the running health of an agent that already exists on the host. It does not detect machines that have no endpoint protection installed at all, which is covered by the separate 'Endpoint protection should be installed on machines' recommendation, and it does not validate the quality of detections the agent makes.

Why does "Endpoint protection health issues on machines should be resolved" matter?

An antivirus agent that is installed but disabled, paused or running on week-old signatures gives a false sense of cover: the portal shows protection present while real-time scanning is actually off or blind to current malware. Attackers exploit exactly this gap, because one stalled definition update, a service stopped during troubleshooting or a policy that quietly switched off behaviour monitoring can leave a whole fleet defenceless against ransomware that fresh signatures would otherwise catch. The business consequence is a breach that bypasses a control you believed was active, and an incident review that finds the protection had been silently degraded for days. Resolving the health issue restores active defence rather than just the appearance of it on the dashboard.

How do I fix "Endpoint protection health issues on machines should be resolved"?

  1. Open the recommendation, drill into each affected machine and read which health property failed, then re-enable the disabled component: turn real-time protection back on and restart the antimalware service (for Microsoft Defender Antivirus, 'Set-MpPreference -DisableRealtimeMonitoring $false' and restart the WinDefend service).
  2. For stale signatures, force an update ('Update-MpSignature' on Windows) and confirm the machine can reach its update source; recurring staleness usually means blocked outbound connectivity to the definition endpoints rather than a one-off failure.
  3. Stop the problem recurring by deploying the Defender for Endpoint integration or a managed antivirus configuration through Azure Policy, so agents are kept enabled and their definitions current from a central baseline instead of relying on per-machine fixes that quietly drift out of state again.

Remediation script · bash

# Install the Microsoft Antimalware extension on a Windows VM that has none.
# Microsoft Defender Antivirus is built into Windows Server 2016+; this extension
# adds managed configuration and covers older Windows such as Server 2012 R2.
az vm extension set \
  --resource-group rg-payments \
  --vm-name vm-payments-prod \
  --name IaaSAntimalware \
  --publisher Microsoft.Azure.Security \
  --version 1.5 \
  --settings '{"AntimalwareEnabled": true, "RealtimeProtectionEnabled": true, "ScheduledScanSettings": {"isEnabled": true, "scanType": "Quick", "day": 7, "time": 120}}'

# Ratchet it shut: auto-deploy the antimalware extension to any future Windows server.
az policy assignment create \
  --name deploy-antimalware-windows \
  --display-name "Deploy Microsoft Antimalware on Windows servers" \
  --policy 2835b622-407b-4114-9198-6f7064cbe0dc \
  --location uksouth \
  --assign-identity --identity-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --role Contributor --role-scope "/subscriptions/00000000-0000-0000-0000-000000000000" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

# On Linux, confirm Defender for Endpoint real-time protection is on; enable if not.
# mdatp health --field real_time_protection_enabled
# mdatp config real-time-protection --value enabled

Full walkthrough (console steps, edge cases and verification) in the lesson Ensure endpoint protection on Azure machines.

Is "Endpoint protection health issues on machines should be resolved" a false positive?

A machine can legitimately still show as failing immediately after you have fixed it, because it can take up to 24 hours for a remediated machine to move from the unhealthy list to the Healthy resources tab once the agent reports its new status. Treat a very recent fix as in progress rather than as a real failure. Separately, a non-Microsoft endpoint product that genuinely keeps the host protected may appear unhealthy if it does not surface its state in the way Defender for Cloud expects to read it; in that case confirm the protection is active through the vendor's own console before deciding the finding is a true exception, and prefer a documented exemption to disabling the check outright.

Full lesson Ensure endpoint protection on Azure machines Step-by-step remediation with CLI, code and persona-specific context.
Defender for Cloud recommendations ↗ Check your own account →
Part of the learning path Manage Azure posture and patching

More Compute controls