Microsoft Defender for Cloud: Azure Resource Graph Not Returning VM Vulnerability Assessment Coverage

Question

Microsoft Defender for Cloud: Azure Resource Graph Not Returning VM Vulnerability Assessment Coverage

Joshua Li 0

Problem description

I am experiencing an issue where Azure Resource Graph is not returning the vulnerability coverage assessment for my virtual machines in Microsoft Defender for Cloud. Specifically, when querying for the assessment by its ID, no results are returned, even though other assessments are visible in Resource Graph.

Environment

Microsoft Defender for Cloud assessment data queried through Azure Resource Graph for one Azure subscription; no specific subscription name, resource group, VM name, or region provided.

What I've already tried

I used the following query to look for the assessment:

securityresources
| where type =~ 'microsoft.security/assessments'
| where name =~ '{assessment-id}'

This query returned no rows. I also ran a broader query:

microsoft.security/assessments

which returned other Defender for Cloud assessments, confirming that assessment data exists in Resource Graph generally.

Current status

The issue persists: the specific VM vulnerability coverage assessment is missing from Resource Graph, while other assessments are present. I am seeking guidance on potential causes and steps to resolve or troubleshoot further.

Saravana Kumar D 170 Reputation points Microsoft External Staff Moderator

2026-09-28T10:10:08.2166667+00:00
Hello @Joshua Li

Greetings!

The behavior where Azure Resource Graph does not return VM vulnerability assessment coverage is typically related to the way vulnerability assessment data is populated and synchronized into Microsoft Defender for Cloud.

To troubleshoot the issue, please perform the following steps:

Verify that Microsoft Defender for Servers Plan 2 is enabled for the subscription containing the virtual machines.

Confirm that a vulnerability assessment solution is deployed on the VMs and reporting successfully. Supported solutions include Microsoft Defender Vulnerability Management and Qualys.

Navigate to Microsoft Defender for Cloud > Recommendations and ensure that the vulnerability assessment recommendation is visible and has completed evaluation for the affected VMs.

Review the Azure Resource Graph query and ensure it references the correct assessment identifier currently used by Defender for Cloud, as assessment IDs may differ between recommendations and vulnerability assessment solutions.

Run a broader Azure Resource Graph query against the SecurityResources table to verify whether vulnerability assessment records are being populated before applying additional filters.

If Defender for Cloud was recently enabled or vulnerability assessment was recently deployed, allow sufficient time for assessment data to be generated and synchronized into Azure Resource Graph.

Confirm that the VMs are actively reporting assessment results and do not have any agent, connectivity, or onboarding issues that could prevent vulnerability data from being uploaded.

After the assessment data is available in Defender for Cloud recommendations, rerun the Azure Resource Graph query to validate that the vulnerability assessment records are returned as expected.

Microsoft documentation references:

Azure Resource Graph can query security assessments and recommendations generated by Microsoft Defender for Cloud: Query recommendations with Azure Resource Graph.

Security assessments are stored within the SecurityResources dataset and are populated by Defender for Cloud evaluations: Security assessments in Microsoft Defender for Cloud.

Vulnerability assessment recommendations and coverage depend on Defender for Servers and supported vulnerability assessment solutions being properly configured: Vulnerability assessment for machines.

In most cases, the issue is resolved by validating that vulnerability assessment data is successfully generated in Defender for Cloud and that the Azure Resource Graph query is referencing the correct assessment records. Once the assessment results are available in the SecurityResources dataset, the query should return the expected VM coverage information.

Regards,
Saravana.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Joshua Li 0 Reputation points

2026-09-28T22:09:05.37+00:00
Hi @Saravana Kumar D

I confirm I have Defender for Servers Plan 2.

I confirm "Vulnerability assessment for machines" component is ON. "Microsoft Defender vulnerability management" is selected.

I confirm there are recommendations in the Recommendations area for these VMs

This is where the script deviate: But I am looking for a specific type "Machines should have a vulnerability assessment solution" with id "ffff0522-1e88-47fc-8382-2a80ba848f5d". And there is none of this type

I confirm a broader search returns other results for the VMs.

This is not a recent deployment. Defender has been on >1 year. But "A vulnerability assessment solution should be enabled on your virtual machines" type has only gone missing in the last 2 months

VMs are reporting assessments (based on search in #4)

I have run the query a few times. The "Machines should have a vulnerability assessment solution" is always missing.

Any idea what happened to "Machines should have a vulnerability assessment solution" ffff0522-1e88-47fc-8382-2a80ba848f5d?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Joshua Li 0 Reputation points

2026-09-28T22:09:05.37+00:00

Hi @Saravana Kumar D

I confirm I have Defender for Servers Plan 2.

I confirm "Vulnerability assessment for machines" component is ON. "Microsoft Defender vulnerability management" is selected.

I confirm there are recommendations in the Recommendations area for these VMs

This is where the script deviate: But I am looking for a specific type "Machines should have a vulnerability assessment solution" with id "ffff0522-1e88-47fc-8382-2a80ba848f5d". And there is none of this type

I confirm a broader search returns other results for the VMs.

This is not a recent deployment. Defender has been on >1 year. But "A vulnerability assessment solution should be enabled on your virtual machines" type has only gone missing in the last 2 months

VMs are reporting assessments (based on search in #4)

I have run the query a few times. The "Machines should have a vulnerability assessment solution" is always missing.

Any idea what happened to "Machines should have a vulnerability assessment solution" ffff0522-1e88-47fc-8382-2a80ba848f5d?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

With thanks to Microsoft Support: I am told that

As part of the transition from grouped to individual recommendations in Microsoft Defender for Cloud, the"Machines should have a vulnerability assessment solution" recommendation is being deprecated.
At this time, I have not found any Microsoft documentation that provides a replacement assessment ID for ffff0522-1e88-47fc-8382-2a80ba848f5d. Instead, the current guidance is to use the individual recommendations available in Defender for Cloud to review vulnerability assessment coverage.
To help identify machines that do not have vulnerability assessment coverage, please use the Azure Resource Graph (ARG) query below.
Before running the query, please replace 'xxx' with the appropriate Subscription ID(s). Reference Article: Transition from grouped to individual recommendations in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn Please review the Microsoft Defender for Servers section in the article for additional details regarding the deprecation of the recommendation.

resources 
| where type in ('microsoft.compute/virtualmachines','microsoft.hybridcompute/machines') 
| where subscriptionId in ('xxx') 
| where type != 'microsoft.hybridcompute/machines' or tostring(properties.status) == 'Connected' 
| extend machineId = tolower(id) 
| extend nodeResourceGroupKey = strcat(subscriptionId, '/', tolower(resourceGroup)) 
| join kind=leftouter ( 
   resources 
   | where type == 'microsoft.containerservice/managedclusters' 
   | project nodeResourceGroupKey = strcat(subscriptionId, '/', tolower(tostring(properties.nodeResourceGroup))), isKubernetesNode = 1 
   | distinct nodeResourceGroupKey, isKubernetesNode 
) on nodeResourceGroupKey 
| where isempty(isKubernetesNode) 
| join kind=leftouter ( 
   securityresources 
   | where type == 'microsoft.security/softwareinventories' 
   | project machineId = tolower(substring(id, 0, indexof(tolower(id), '/providers/microsoft.security/softwareinventories/'))), hasSoftwareInventory = 1 
   | distinct machineId, hasSoftwareInventory 
) on machineId 
| where isempty(hasSoftwareInventory) 
| project Machine = name, ResourceGroup = resourceGroup, Subscription = subscriptionId, Type = type, Location = location, MachineId = id 
| order by Machine asc

Therefore: the answer to the question is "it disappeared; but it is meant to". It is up to us the users to adapt.