Back to Checks
azure

All virtual machines in the subscription have a vulnerability assessment solution installed

defender_auto_provisioning_vulnerabilty_assessments_machines_on
Service: defenderSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:microsoft.security/assessmentssample

Microsoft Defender for Cloud evaluates whether Azure VMs and Arc-enabled machines have a vulnerability assessment solution deployed and reporting healthy coverage across the subscription.

Prowler logoProwlerprowler-provider-azure

Risk

Without continuous vulnerability assessment, unpatched flaws persist, enabling:

  • Remote code execution and privilege escalation
  • Ransomware disrupting availability
  • Data exfiltration via lateral movement

Confidentiality, integrity, and availability are reduced across affected machines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_auto_provisioning_vulnerabilty_assessments_machines_on

Recommendation

Enable subscription-wide auto-provisioning of a vulnerability assessment for all Azure and Arc machines and enforce it with policy for existing and new hosts.

Apply least privilege to deployment identities, integrate with patch management, and monitor findings for timely remediation.

Remediation

CLI

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/serverVulnerabilityAssessmentsSettings/AzureServersSetting?api-version=2022-01-01-preview --body '{"properties":{"selectedProvider":"MdeTvm"},"kind":"AzureServersSetting"}'

Terraform

# Enable vulnerability assessment for all machines using Microsoft Defender Vulnerability Management
resource "azapi_resource" "<example_resource_name>" {
  type      = "Microsoft.Security/serverVulnerabilityAssessmentsSettings@2022-01-01-preview"
  name      = "AzureServersSetting"
  parent_id = "/subscriptions/<example_subscription_id>"

  body = jsonencode({
    properties = {
      selectedProvider = "MdeTvm" # Critical: sets VA provider so all VMs get vulnerability assessment
    }
    kind = "AzureServersSetting"
  })
}

NativeIaC

// Enable vulnerability assessment for all machines using Microsoft Defender Vulnerability Management
// Critical: sets the VA provider so the recommendation becomes Healthy
@description('Deploy at subscription scope')
targetScope = 'subscription'

resource <example_resource_name> 'Microsoft.Security/serverVulnerabilityAssessmentsSettings@2022-01-01-preview' = {
  name: 'AzureServersSetting'
  kind: 'AzureServersSetting'
  properties: {
    selectedProvider: 'MdeTvm' // Critical: enables Defender VA provider for machines
  }
}

Other

1In the Azure portal, go to Microsoft Defender for Cloud
2Open Environment settings and select your <subscription>
3Go to Settings & monitoring (Auto-provisioning)
4Find Vulnerability assessment for machines, set to On, and select Microsoft Defender Vulnerability Management
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_auto_provisioning_vulnerabilty_assessments_machines_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            assessments,
        ) in defender_client.assessments.items():
            subscription_name = defender_client.subscriptions.get(
                subscription_id, subscription_id
            )
            if (
                "Machines should have a vulnerability assessment solution"
                in assessments
            ):
                report = Check_Report_Azure(
                    metadata=self.metadata(),
                    resource=assessments[
                        "Machines should have a vulnerability assessment solution"
                    ],
                )
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Vulnerability assessment is set up in all VMs in subscription {subscription_name} ({subscription_id})."

                if (
                    assessments[
                        "Machines should have a vulnerability assessment solution"
                    ].status
                    == "Unhealthy"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Vulnerability assessment is not set up in all VMs in subscription {subscription_name} ({subscription_id})."

                findings.append(report)

        return findings

References