Machines should have vulnerability findings resolved

What does the recommendation "Machines should have vulnerability findings resolved" check?

Flags virtual machines that have unresolved software vulnerability findings raised by Microsoft Defender Vulnerability Management, the scanner built into Defender for Servers Plan 2 (running either agentless or through the Defender for Endpoint integration). It evaluates installed packages and applications against known CVEs and lists every machine with an open finding. It does not check operating-system patch level on its own (that is the separate 'System updates should be installed' recommendation powered by Azure Update Manager), and it cannot report anything on a machine where the Defender for Servers Plan 2 scanner has never run, so a clean result on an unscanned fleet is silence, not safety.

Why does "Machines should have vulnerability findings resolved" matter?

Unpatched software is the route attackers reach for first, because a published CVE arrives with a ready-made exploit and a scan to find every host still exposed. A single VM left on a vulnerable library, web server or language runtime gives an intruder remote code execution, then a foothold to harvest credentials and move laterally into the rest of the subscription. The findings are ranked by severity and CVSS, so leaving them open is a measurable, auditable gap rather than a vague worry: it drags down your secure score, and a long tail of unresolved findings is exactly the kind of overdue remediation that surfaces in a breach post-mortem or a regulatory audit. Resolving them promptly, prioritising the highest CVSS scores on your most valuable machines, is the single clearest way to shrink the window in which a known weakness can be used against you.

How do I fix "Machines should have vulnerability findings resolved"?

1. Open Defender for Cloud, go to Recommendations, select 'Machines should have vulnerability findings resolved', and use the Affected resources section to filter findings to a specific VM and read the CVE, CVSS score and the software version that resolves it.
2. Update or remove the affected software: patch the package or runtime directly on the VM, or schedule the upgrade through Azure Update Manager (Check for updates, then Schedule updates) so the fix is applied consistently across the fleet rather than by hand.
3. Let the next scan run (agentless scanning runs roughly every 24 hours) and confirm the finding clears; bake the fixed software versions into your VM images or Bicep deployments so freshly provisioned machines do not reintroduce the same vulnerability.

# Step 1: close coverage gaps. Enable the scanning plans on the subscription.
SUB="/subscriptions/00000000-0000-0000-0000-000000000000"

az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name SqlServers       --tier Standard
az security pricing create --name Containers       --tier Standard

# Step 2: list the machines that still have no assessment solution attached.
az security assessment list \
  --query "[?metadata.displayName=='Machines should have a vulnerability assessment solution' && status.code=='Unhealthy'].resourceDetails.id" \
  -o tsv

# Step 3: ratchet it shut. Enforce that the plans stay enabled estate-wide,
# so no new subscription can become an unscanned blind spot. Assign the
# built-in initiative 'Configure Microsoft Defender for Cloud plans'
# (DeployIfNotExists), which turns the Servers, SQL and Containers plans
# back on wherever they are missing.
az policy assignment create \
  --name enable-defender-plans \
  --display-name "Configure Microsoft Defender for Cloud plans" \
  --policy-set-definition f08c57cd-dbd6-49a4-a85e-9ae77ac959b0 \
  --scope "$SUB" \
  --mi-system-assigned --location uksouth