Explore Our Microsoft Cloud Security Training →
Microsoft Defender for Cloud provides agentless scanning for Azure Virtual Machines (VMs). However, there are instances when this scanning might miss certain VMs. This blog post will guide you through verifying the necessary configurations to ensure seamless agentless scanning and remediation of identified vulnerabilities.
How Agentless Scanning Works in Defender for Cloud
Agentless scanning evaluates VMs without requiring an installed agent. It relies on Azure Monitor Logs, a centralized logging service, to collect and process data.
Common Reasons Agentless Scanning Misses VMs
- VMs not registered with Azure Monitor Logs
- Insufficient permissions for Defender to access logs
- Exclusion of specific resources or IP ranges in scan scope settings
Verifying Defender for Servers Plan Includes Agentless Scanning
Ensure you have the Defender for Servers plan 2, which includes agentless scanning. To check your current plan:
> az account show --query 'subscriptions[0].offerings[?displayName=='Defender for Cloud (Plan 2)' && publisher=='Microsoft.Security'].id
Permissions Required for Agentless Scanning to Work
The following Azure roles must be assigned to the Defender for Cloud workspace: Log Analytics Contributor, Security Admin, and Security Reader.
Reviewing Scan Results and Vulnerability Findings
Navigate to Defender for Cloud > Vulnerabilities and review the scan results. Address any identified vulnerabilities to maintain a secure environment.
Conclusion
Secure your Azure VMs with Microsoft Defender for Cloud by ensuring agentless scanning is working correctly. Check out our Microsoft Cloud Security Training to learn more about Defender and other cloud security solutions.
Explore Our Microsoft Cloud Security Training →
Written by Mohammed Akhter
Founder of ITP Training. 50,000+ students trained across 30+ countries in Microsoft endpoint and cloud security. Learn more →