Microsoft Azureintermediate

Microsoft Defender Vulnerability Assessment Guide

Complete guide to continuous vulnerability scanning with Microsoft Defender for Cloud, including scanner setup, recommendations, remediation, and Secure Score optimization.

11 min readUpdated 2026-01-14

Microsoft Defender for Cloud provides continuous vulnerability assessment across your Azure workloads, identifying security weaknesses before attackers can exploit them. This guide covers enabling vulnerability scanning, understanding recommendations, implementing remediation, and improving your Secure Score.

This article is part of our comprehensive guide on Cloud Security Tips for 2026, which covers essential security practices across all major cloud platforms.

Overview

Defender for Cloud vulnerability assessment includes:

  • Server vulnerability scanning: OS and application vulnerabilities on VMs
  • Container image scanning: Vulnerabilities in container registries
  • SQL vulnerability assessment: Database configuration weaknesses
  • Code scanning: Infrastructure-as-code misconfigurations
  • Agentless scanning: Assessment without deploying agents

Prerequisites

Before configuring vulnerability assessment, ensure you have:

  • Azure subscription with Security Admin or Owner role
  • Defender for Cloud enabled (specific plans vary by workload)
  • Azure CLI installed (version 2.50 or later)
  • Understanding of Defender plans and their features
  • Budget approval for enhanced Defender plans (paid features)

Step 1: Enable Defender Plans

Enable via Azure Portal

  1. Sign in to the Azure Portal
  2. Navigate to Microsoft Defender for Cloud
  3. Go to Environment settings
  4. Select your subscription
  5. Enable the following plans for vulnerability assessment:
PlanVulnerability Features
Defender for Servers P2MDVM, agentless scanning
Defender for ContainersContainer image scanning
Defender for SQLDatabase vulnerability assessment
Defender CSPMAgentless VM scanning, attack paths
  1. Click Save to enable selected plans

Enable via Azure CLI

# Get subscription ID
SUBSCRIPTION_ID=$(az account show --query id -o tsv)

# Enable Defender for Servers Plan 2 (includes vulnerability assessment)
az security pricing create \
  --name VirtualMachines \
  --tier Standard \
  --subplan P2

# Enable Defender for Containers
az security pricing create \
  --name Containers \
  --tier Standard

# Enable Defender for SQL
az security pricing create \
  --name SqlServers \
  --tier Standard

# Enable Defender CSPM (agentless scanning)
az security pricing create \
  --name CloudPosture \
  --tier Standard

# Verify enabled plans
az security pricing list \
  --query "[?pricingTier=='Standard'].{Name:name, SubPlan:subPlan}" \
  -o table

Configure Agentless Scanning

# Enable agentless scanning for VMs (requires Defender CSPM or Servers P2)
az rest \
  --method PUT \
  --url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/providers/Microsoft.Security/serverVulnerabilityAssessmentsSettings/default?api-version=2022-01-01-preview" \
  --body '{
    "properties": {
      "selectedProvider": "MdeTvm"
    }
  }'

Step 2: Configure Server Vulnerability Assessment

Enable MDVM on VMs

Microsoft Defender Vulnerability Management (MDVM) is automatically enabled when you activate Defender for Servers P2. For agent-based assessment:

# Check if Defender for Endpoint extension is installed
az vm extension list \
  --resource-group "rg-production" \
  --vm-name "vm-web-01" \
  --query "[?publisher=='Microsoft.Azure.AzureDefenderForServers'].name" \
  -o tsv

# Install Defender for Endpoint extension (if not auto-provisioned)
az vm extension set \
  --resource-group "rg-production" \
  --vm-name "vm-web-01" \
  --name "MDE.Windows" \
  --publisher "Microsoft.Azure.AzureDefenderForServers" \
  --settings '{"autoUpdate": true}'

# For Linux VMs
az vm extension set \
  --resource-group "rg-production" \
  --vm-name "vm-linux-01" \
  --name "MDE.Linux" \
  --publisher "Microsoft.Azure.AzureDefenderForServers" \
  --settings '{"autoUpdate": true}'

View Server Vulnerabilities via Portal

  1. In Defender for Cloud, go to Recommendations
  2. Filter by Resource type: Virtual machines
  3. Click Machines should have vulnerability findings resolved
  4. Select a VM to see:
    • CVE details and CVSS scores
    • Affected software versions
    • Remediation guidance
    • Exploit availability

Query Vulnerabilities via Azure CLI

# List VMs with vulnerability findings
az security sub-assessment list \
  --assessment-name "1195afff-c881-495e-9bc5-1486211ae03f" \
  --query "[].{VM:resourceDetails.id, Severity:status.severity, Finding:displayName}" \
  -o table

# Get vulnerability details for a specific VM
az security sub-assessment list \
  --assessment-name "1195afff-c881-495e-9bc5-1486211ae03f" \
  --query "[?contains(resourceDetails.id, 'vm-web-01')].{CVE:id, Severity:status.severity, Description:displayName}" \
  -o table

Step 3: Configure Container Image Scanning

Enable Registry Scanning

Container image scanning is automatic when Defender for Containers is enabled:

# Verify Defender for Containers is enabled
az security pricing show \
  --name Containers \
  --query '{Tier:pricingTier, Enabled:freeTrialRemainingTime}' \
  -o table

# Check registry scan status
az acr show \
  --name "mycontainerregistry" \
  --query "policies.quarantinePolicy.status" \
  -o tsv

Trigger Manual Image Scan

# Push an image to trigger scanning
az acr build \
  --registry "mycontainerregistry" \
  --image "myapp:v1.0" \
  --file Dockerfile .

# View scan results via Portal or Azure Resource Graph
az graph query -q "
  securityresources
  | where type == 'microsoft.security/assessments/subassessments'
  | where properties.assessedResourceType == 'ContainerRegistryVulnerability'
  | extend registryName = tostring(split(properties.resourceDetails.id, '/')[8])
  | extend imageName = properties.additionalData.repositoryName
  | extend severity = properties.status.severity
  | project registryName, imageName, severity, properties.displayName
  | summarize VulnCount=count() by registryName, imageName, severity
"

View Container Vulnerabilities

  1. In Defender for Cloud, go to Recommendations
  2. Filter by Resource type: Container registries
  3. Click Container registry images should have vulnerability findings resolved
  4. Review:
    • Vulnerable images and tags
    • CVE details per layer
    • Base image vulnerabilities
    • Remediation guidance

Step 4: Configure SQL Vulnerability Assessment

Enable SQL Assessment via Portal

  1. Navigate to your SQL database in Azure Portal
  2. Go to Microsoft Defender for Cloud
  3. Click Configure under Vulnerability Assessment
  4. Select storage account for scan results
  5. Enable periodic recurring scans

Enable SQL Assessment via Azure CLI

# Enable vulnerability assessment on SQL Server
az sql vm update \
  --resource-group "rg-databases" \
  --name "sql-server-01" \
  --sql-mgmt-type Full

# Enable on Azure SQL Database
SQL_SERVER="sql-myapp-prod"
DATABASE="db-myapp"

# Create storage for scan results
STORAGE_ACCOUNT="stvascanresults"
az storage account create \
  --name $STORAGE_ACCOUNT \
  --resource-group "rg-databases" \
  --sku Standard_LRS

# Configure vulnerability assessment
STORAGE_KEY=$(az storage account keys list \
  --account-name $STORAGE_ACCOUNT \
  --query "[0].value" -o tsv)

az sql db va-baseline set \
  --resource-group "rg-databases" \
  --server $SQL_SERVER \
  --database $DATABASE \
  --storage-account-access-key $STORAGE_KEY \
  --storage-account "https://$STORAGE_ACCOUNT.blob.core.windows.net" \
  --storage-container-path "vulnerability-assessment"

# Enable recurring scans
az sql db va update \
  --resource-group "rg-databases" \
  --server $SQL_SERVER \
  --database $DATABASE \
  --recurring-scans true \
  --email-subscription-admins true

Run Manual SQL Scan

# Trigger immediate vulnerability scan
az sql db va scan \
  --resource-group "rg-databases" \
  --server $SQL_SERVER \
  --database $DATABASE

# Get latest scan results
az sql db va list \
  --resource-group "rg-databases" \
  --server $SQL_SERVER \
  --database $DATABASE \
  --query "[].{Rule:ruleId, Severity:status, Status:status}" \
  -o table

Step 5: Review and Remediate Findings

Access Recommendations in Portal

  1. In Defender for Cloud, go to Recommendations
  2. Use filters:
    • Category: Vulnerability
    • Severity: Critical, High, Medium
    • Status: Unhealthy
  3. Click a recommendation to see affected resources

Understand Severity Ratings

CVSS ScoreSeverityAction Timeline
9.0 - 10.0CriticalRemediate within 24-48 hours
7.0 - 8.9HighRemediate within 7 days
4.0 - 6.9MediumRemediate within 30 days
0.1 - 3.9LowRemediate within 90 days

Export Findings for Remediation

# Export vulnerability findings to CSV
az security sub-assessment list \
  --assessment-name "1195afff-c881-495e-9bc5-1486211ae03f" \
  --query "[].{Resource:resourceDetails.id, CVE:id, Severity:status.severity, Description:displayName, Remediation:remediation}" \
  -o json > vulnerability-findings.json

# Query high and critical findings using Resource Graph
az graph query -q "
  securityresources
  | where type == 'microsoft.security/assessments/subassessments'
  | where properties.status.severity in ('High', 'Critical')
  | extend resource = tostring(properties.resourceDetails.id)
  | extend cve = properties.id
  | extend severity = properties.status.severity
  | extend description = properties.displayName
  | project resource, cve, severity, description
  | order by severity desc
" --output table

Configure Governance Rules

Assign owners and due dates to vulnerability findings:

  1. In Defender for Cloud, go to Environment settings
  2. Select Governance rules
  3. Click + Create rule
  4. Configure:
    • Rule name: High severity vulnerabilities
    • Priority: 1
    • Conditions: Severity equals High or Critical
    • Owner: [email protected]
    • Remediation timeframe: By specific date or SLA
  5. Click Create

Step 6: Improve Secure Score

Understand Score Impact

  1. In Defender for Cloud, click Secure Score
  2. View score breakdown by control:
    • Remediate vulnerabilities (high impact)
    • Enable endpoint protection
    • Apply system updates
  3. Click each control to see recommendations

Track Progress with PowerShell

# Get Secure Score over time
$subscriptionId = (Get-AzContext).Subscription.Id

$secureScore = Get-AzSecuritySecureScore -Name "ascScore"
Write-Host "Current Secure Score: $($secureScore.CurrentScore) / $($secureScore.MaxScore)"
Write-Host "Percentage: $([math]::Round($secureScore.Percentage * 100, 1))%"

# Get top recommendations by score impact
$recommendations = Get-AzSecurityTask | Where-Object { $_.State -eq "Active" }
$recommendations | Sort-Object -Property RecommendationTypeScoreImpact -Descending | Select-Object -First 10 | Format-Table Name, RecommendationTypeScoreImpact, State

Set Score Improvement Targets

# Query current score and potential improvement
az security secure-score-controls list \
  --query "[].{Control:displayName, Current:score.current, Max:score.max, Unhealthy:unhealthyResourceCount}" \
  -o table

# Calculate potential score improvement from vulnerability remediation
az security secure-score-controls show \
  --name "Remediate vulnerabilities" \
  --query '{CurrentScore:score.current, MaxScore:score.max, PotentialGain:score.max - score.current}' \
  -o table

Best Practices

  1. Prioritize by exploitability: Focus on CVEs with known exploits first
  2. Enable agentless scanning: Cover VMs without agent deployment overhead
  3. Integrate with CI/CD: Scan container images before deployment
  4. Set governance rules: Ensure accountability with owners and deadlines
  5. Baseline accepted risks: Document and track accepted vulnerabilities
  6. Monitor score trends: Track Secure Score weekly to measure progress
  7. Use Azure Resource Graph: Build dashboards for vulnerability reporting
  8. Export to SIEM: Stream findings to your security operations center

Troubleshooting

Vulnerabilities not appearing for VMs:

  • Verify Defender for Servers P2 is enabled
  • Check VM guest agent is running
  • Confirm MDE extension is installed
  • Wait 24 hours for initial scan completion

Container scan results missing:

  • Verify Defender for Containers is enabled
  • Check registry is in a supported region
  • Confirm image was pushed after enablement
  • Review scan status in registry settings

SQL assessment failing:

  • Verify storage account permissions
  • Check network connectivity to storage
  • Confirm SQL Defender is enabled on server
  • Review diagnostic logs for errors

Secure Score not improving after remediation:

  • Allow 4-24 hours for score recalculation
  • Verify all instances of the issue are fixed
  • Check if new vulnerabilities offset improvements

Next Steps

After configuring vulnerability assessment, enhance your security:

  • Implement just-in-time VM access to reduce attack surface
  • Configure adaptive application controls for workload protection
  • Enable attack path analysis in Defender CSPM
  • Review Cloud Security Tips for 2026 for comprehensive cloud security guidance

Frequently Asked Questions

Find answers to common questions

Defender for Cloud supports multiple scanners depending on the workload type. For servers, it offers Microsoft Defender vulnerability management (MDVM) as the default built-in scanner, with Qualys available as an alternative. For containers, it uses built-in image scanning. For SQL databases, it has native vulnerability assessment. MDVM is recommended as it provides agentless scanning and integrates with Defender for Endpoint.

Azure Infrastructure Experts

Comprehensive Azure management including architecture, migration, security, and 24/7 operations.

Learn About Cloud Infrastructure ManagementExplore Cloud Migration

Related Articles

Microsoft Defender for Cloud CIS Benchmark Compliance Guide

Complete guide to implementing CIS Azure Foundations Benchmark compliance with Microsoft Defender for Cloud, including compliance dashboard, controls, remediation, and Secure Score.

Read More →

Azure Global Administrator Best Practices: Securing Privileged Accounts

Learn how to secure Azure Global Administrator accounts with emergency access, Privileged Identity Management (PIM), MFA enforcement, and least-privilege principles for enterprise security.

Read More →

Azure Key Vault Tutorial

Step-by-step tutorial for creating Azure Key Vault, storing secrets and keys, configuring access policies with RBAC, and integrating with Azure services for secure secret management.

Read More →
Back to Microsoft Azure