Machines should have a vulnerability assessment solution

What does the recommendation "Machines should have a vulnerability assessment solution" check?

Flags any virtual machine, scale set instance or Azure Arc-connected server that Defender for Cloud cannot see reporting from a vulnerability assessment solution. A healthy resource is covered either by the built-in Microsoft Defender Vulnerability Management engine, by agentless scanning under Defender for Servers Plan 2, or by a Bring Your Own Licence scanner such as Qualys or Rapid7 connected through the BYOL path. It checks that a scanner is present and reporting back, not that the findings it returns have been triaged or fixed, so a machine riddled with critical CVEs still counts as healthy here as long as something is scanning it. It does not assess containers, registry images, SQL databases or managed PaaS hosts, which are governed by their own separate recommendations.

Why does "Machines should have a vulnerability assessment solution" matter?

A machine with no scanner is a blind spot: you have no inventory of the unpatched CVEs an attacker can use to move from an initial foothold to full compromise, and you cannot prioritise patching what you cannot see. Microsoft retired the built-in Qualys offering on 1 May 2024, so tenants that enabled it years ago but never migrated to Defender Vulnerability Management can fail this control silently while still believing they are covered. Without a working solution, exposed software keeps drifting further out of patch compliance, audit evidence for the PV-5 control cannot be produced, and the first you learn of an exploitable flaw is often when it is already being abused in your environment.

How do I fix "Machines should have a vulnerability assessment solution"?

1. Enable the Defender for Servers Plan 2 on the subscription, then under Defender for Cloud environment settings turn on the Microsoft Defender Vulnerability Management integration so that the scanner auto-provisions to in-scope machines without per-VM work.
2. For machines that should be scanned without installing anything on the guest, switch on 'Agentless scanning for machines' in the Defender for Servers settings; it takes a snapshot of the disk and analyses it out of band, which also reaches powered-on but agent-less and isolated hosts.
3. Where the estate is large or partly offline, push remediation at scale using the Defender for Cloud Logic App template named 'Enable the built-in vulnerability assessment solution on virtual machines' rather than enabling resources one by one in the portal, and bake the same setting into your landing-zone Bicep so new subscriptions inherit it.

# Step 1: close coverage gaps. Enable the scanning plans on the subscription.
SUB="/subscriptions/00000000-0000-0000-0000-000000000000"

az security pricing create --name VirtualMachines --tier Standard
az security pricing create --name SqlServers       --tier Standard
az security pricing create --name Containers       --tier Standard

# Step 2: list the machines that still have no assessment solution attached.
az security assessment list \
  --query "[?metadata.displayName=='Machines should have a vulnerability assessment solution' && status.code=='Unhealthy'].resourceDetails.id" \
  -o tsv

# Step 3: ratchet it shut. Enforce that the plans stay enabled estate-wide,
# so no new subscription can become an unscanned blind spot. Assign the
# built-in initiative 'Configure Microsoft Defender for Cloud plans'
# (DeployIfNotExists), which turns the Servers, SQL and Containers plans
# back on wherever they are missing.
az policy assignment create \
  --name enable-defender-plans \
  --display-name "Configure Microsoft Defender for Cloud plans" \
  --policy-set-definition f08c57cd-dbd6-49a4-a85e-9ae77ac959b0 \
  --scope "$SUB" \
  --mi-system-assigned --location uksouth