Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)

What does the recommendation "Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)" check?

Flags Azure Container Registry images that Microsoft Defender Vulnerability Management has scanned and found to contain known CVEs in their OS packages or bundled application libraries. Defender scans each image when it is pushed and when it is imported, typically within a few hours, then re-scans daily any image that has been pushed or pulled in the last 30 days or is currently running in a monitored Kubernetes cluster, so the finding reflects current vulnerability data for the images you actually use rather than dormant tags. It covers Azure Resource Manager-based registries and the layers Defender can inventory: OS-level packages and recognised language ecosystems. It assesses static images sitting in the registry, not the workloads already running on your Kubernetes clusters, which is the separate 'running container images' recommendation, and it does not catch flaws that live only in your application code, configuration or secrets baked into a layer.

Why does "Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)" matter?

A registry is the supply point for every cluster that pulls from it, so a single vulnerable base image can seed the same flaw across dozens of deployments before anyone notices. Critical CVEs in an image, such as remote code execution in a web framework or a privilege escalation in a libc package, give an attacker a route from a pulled container into the wider environment, and because the image is shared the blast radius scales with how popular that base layer is. Fixing the image once in the registry stops the vulnerability propagating on the next deploy, which is far cheaper than chasing it across hundreds of live pods after an incident. It also keeps you defensible against the supply-chain due-diligence that customers, regulators and auditors increasingly expect, where an unresolved high-severity CVE in a shipping image is a finding in its own right.

How do I fix "Azure registry container images should have vulnerabilities resolved (powered by Microsoft Defender Vulnerability Management)"?

1. Open Microsoft Defender for Cloud, go to Recommendations, select this recommendation and use the Findings tab to see the affected images and the specific CVEs, severity and whether a fix is available.
2. Patch at the source: update the base image or upgrade the offending package in your Dockerfile, then rebuild and push a new tag so the registry holds a clean image. Defender re-scans the new image automatically.
3. Stop the flaw recurring by pinning base images to patched digests and adding image scanning to the pipeline, for example an 'az acr build' step plus a build-time gate that fails on high or critical findings before the image is pushed.

# Step 1: close coverage gaps. Enable the scanning plans on the subscription.
SUB="/subscriptions/00000000-0000-0000-0000-000000000000"

az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name SqlServers       --tier Standard
az security pricing create --name Containers       --tier Standard

# Step 2: list the machines that still have no assessment solution attached.
az security assessment list \
  --query "[?metadata.displayName=='Machines should have a vulnerability assessment solution' && status.code=='Unhealthy'].resourceDetails.id" \
  -o tsv

# Step 3: ratchet it shut. Enforce that the plans stay enabled estate-wide,
# so no new subscription can become an unscanned blind spot. Assign the
# built-in initiative 'Configure Microsoft Defender for Cloud plans'
# (DeployIfNotExists), which turns the Servers, SQL and Containers plans
# back on wherever they are missing.
az policy assignment create \
  --name enable-defender-plans \
  --display-name "Configure Microsoft Defender for Cloud plans" \
  --policy-set-definition f08c57cd-dbd6-49a4-a85e-9ae77ac959b0 \
  --scope "$SUB" \
  --mi-system-assigned --location uksouth