Microsoft Defender for Cloud
Cloud and workloadsCloud asset inventory
In brief
The article now covers connected resources across Azure, AWS, and GCP; filtering, exporting, investigation, installed-application details, and Azure Resource Graph software inventory queries. It also clarifies summary metrics and assets outside configured cloud scopes.
What Defender admins need to know
Administrators can use the expanded guidance to review detected software, vulnerabilities, support status, and related security findings across their connected resources.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
CloudUse cloud asset inventory
The asset inventory page of Microsoft Defender for Cloud shows the security posture of your connected resources. It gives you one view of cloud infrastructure across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It groups assets by workload, criticality, and coverage status. It also combines health data, device actions, and risk signals in one place.
Defender for Cloud periodically analyzes the security state of connected resources. When resources have active security recommendations or security alerts, they appear in the inventory.
This article explains how to use the asset inventory page to review connected resources, filter and export inventory data, investigate security recommendations and alerts, and query software inventory using Azure Resource Graph.
::: zone pivot="azure-portal"
Access asset inventory in the Azure portal
- On the Resource Health page for the resource, review information about the resource.
- The Recommendations tab shows any active security recommendations, in order of risk. You can drill down into each recommendation for more details and remediation options.
- The Alerts tab shows any relevant security alerts.
- The Installed applications tab shows software detected on the resource, when software inventory is available.
Review software inventory
Use the software inventory to review installed applications across your connected resources and identify machines that run specific software.
:::image type="content" source="media/asset-inventory/asset-inventory-features.png" alt-text="Screenshot that shows the main features of the asset inventory page in Microsoft Defender for Cloud." lightbox="media/asset-inventory/asset-inventory-features.png":::
To review software inventory details: - Unregistered subscriptions: Any subscription in the selected scope that hasn't yet been connected to Microsoft Defender for Cloud.
- Resources connected to Defender for Cloud that run those apps are displayed. Blank options show machines where Defender for Servers or Defender for Endpoint isn't available.
Review installed applications for a resource
On the Resource Health page for a supported resource, select Installed applications to review software detected on the asset.
The Installed applications tab provides the following information:
| Field | Description |
|---|---|
| Vendor | The vendor or publisher of the software. |
| Software name | The name of the software product. |
| Version | The detected software version. |
| First seen at | The date and time when the software was first seen on the asset. This field is populated only for software detected through agent-based scanning and is not applicable to software detected by agentless scanning. |
| Evidence | The file paths, registry paths, or both that indicate where the software was detected, when available. |
| Number of known vulnerabilities | The number of known vulnerabilities associated with the detected software version. |
| End of support status | The support lifecycle status of the software or software version, when available. |
Filter the inventory
As soon as you apply filters, the summary values are updatedmetrics (such as Total resources, Unhealthy resources, and Resource count by environment) update to relate toreflect the query results.
Export tools for asset inventory
The Defender for Cloud Inventory page provides the following export options:
Download CSV report - Export the results of your selected filter options to a CSV file.
- Enter any of the following queries (or customize them or write your own!) and select Run query.
QuerySoftware inventory query examples for Azure Resource Graph
To generate a basic list of installed software:Use the following Kusto Query Language (KQL) queries in Azure Resource Graph Explorer to explore Defender for Cloud software inventory data.
The following query lists all discovered software inventory records from the securityresources table, returning the vendor, software name, and version for each asset:
securityresources
| project id, Vendor=properties.vendor, Software=properties.softwareName, Version=properties.version
ToUse the following query to retrieve software inventory records and filter by version numbers:number. This example finds Windows Server 2019 machines running a version at or below a specific build:
securityresources
| where Software=="windows_server_2019" and parse_version(Version)<=parse_version("10.0.17763.1999")
To findUse the following query to identify Azure virtual machines that have more than one specific software product installed. The query correlates software inventory entries with Azure VM identifiers and returns only machines with a combination of software products:multiple matches:
securityresources
| where count_ > 1
To combineUse the following query to join software inventory data with security assessments and find machines that have a specific software product with anotherinstalled alongside an unhealthy security recommendation:
(In this example:recommendation. This example finds machines that have MySQL installed and exposed management ports.)ports by normalizing Azure VM IDs to lowercase for accurate joins:
securityresources
## Key capabilities
The unified cloud asset inventory provides the following core capabilities for managing and monitoring your multicloud infrastructure.
### Unified multicloud visibility
The cloud asset inventory helps you monitor and manage assets consistently across cloud providers.
- **Comprehensive coverage**: View assets across Azure, AWS, GCP, and other supported platforms.
- **Consistent interface**: Use one interface to manage multicloud assets.
- **Real-time synchronization**: See current asset data from connected cloud environments.
### Advanced filtering and scoping
Filtering and scoping features help you narrow inventory views to the assets that matter most.
- **Persistent scoping**: Use cloud scopes for consistent filtering across experiences.
- **Multi-dimensional filtering**: Filter by environment, workload, risk level, and compliance status.
- **Search capabilities**: Find assets quickly with built-in search.
## Asset categorization and metadata
The asset inventory enriches each resource with classification and coverage metadata to help you prioritize security efforts.
### Asset criticality classification
Assets are automatically classified based on:
## Navigation and filtering
Use the following navigation and filtering features to find and scope cloud assets in the Defender portal.
### Accessing the cloud inventory
To open the cloud inventory in the Microsoft Defender portal:
### Using filters effectively
Use filters to narrow the inventory to the assets and risks you want to investigate.
- **Environment filtering**: Select specific cloud providers or view all environments.
- **Scope filtering**: Apply cloud scopes to match organizational boundaries.
- **Risk-based filtering**: Focus on high-risk or exposed assets.
### Search and discovery
Search and discovery tools help you quickly locate relevant assets in large environments.
- **Text search**: Find assets by name, resource ID, or metadata.
- **Tag-based search**: Locate assets by cloud provider tags and labels.
- **Advanced queries**: Combine filters for precise asset discovery.
## Asset details and insights
Selecting an asset in the inventory reveals detailed configuration, security, and relationship information.
### Comprehensive asset information
Each asset provides detailed information including:
### Scoping limitations
Some assets may appear outside definedthe cloud scopes:scopes configured in Defender for Cloud:
- **Cross-scope dependencies**: Assets with relationships that span multiple scopes.
- **Floating assets**: Some asset types don't support fine-grained scoping.
@@ -1,18 +1,21 @@ --- title: Cloud asset inventory-description: Learn about the cloud asset inventory in Microsoft Defender for Cloud and Security Exposure Management-ms.date: 05/25/2026+description: Use the cloud asset inventory in Microsoft Defender for Cloud to view connected resources across Azure, AWS, and GCP, grouped by workload, criticality, coverage status, and risk signals.+ms.date: 07/03/2026 ms.topic: how-to zone_pivot_groups: defender-portal-experience+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to use cloud asset inventory so that I can review the security posture of connected resources across my multicloud environment. ai-usage: ai-assisted ----# Cloud asset inventory+# Use cloud asset inventory The asset inventory page of Microsoft Defender for Cloud shows the [security posture](concept-cloud-security-posture-management.md) of your connected resources. It gives you one view of cloud infrastructure across Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). It groups assets by workload, criticality, and coverage status. It also combines health data, device actions, and risk signals in one place. Defender for Cloud periodically analyzes the security state of connected resources. When resources have active [security recommendations](security-policy-concept.md) or [security alerts](alerts-overview.md), they appear in the inventory. +This article explains how to use the asset inventory page to review connected resources, filter and export inventory data, investigate security recommendations and alerts, and query software inventory using Azure Resource Graph.+ ::: zone pivot="azure-portal" ## Access asset inventory in the Azure portal@@ -42,9 +45,12 @@ The Inventory uses [Azure Resource Graph (ARG)](/azure/governance/resource-graph 1. On the **Resource Health** page for the resource, review information about the resource. - The **Recommendations** tab shows any active security recommendations, in order of risk. You can drill down into each recommendation for more details and remediation options. - The **Alerts** tab shows any relevant security alerts.+ - The **Installed applications** tab shows software detected on the resource, when software inventory is available. ## Review software inventory +Use the software inventory to review installed applications across your connected resources and identify machines that run specific software.+ :::image type="content" source="media/asset-inventory/asset-inventory-features.png" alt-text="Screenshot that shows the main features of the asset inventory page in Microsoft Defender for Cloud." lightbox="media/asset-inventory/asset-inventory-features.png"::: To review software inventory details:@@ -57,11 +63,30 @@ To review software inventory details: - **Unregistered subscriptions**: Any subscription in the selected scope that hasn't yet been connected to Microsoft Defender for Cloud. 1. Resources connected to Defender for Cloud that run those apps are displayed. Blank options show machines where Defender for Servers or Defender for Endpoint isn't available. +### Review installed applications for a resource++On the **Resource Health** page for a supported resource, select **Installed applications** to review software detected on the asset.++The **Installed applications** tab provides the following information:++| Field | Description |+|---|---|+| **Vendor** | The vendor or publisher of the software. |+| **Software name** | The name of the software product. |+| **Version** | The detected software version. |+| **First seen at** | The date and time when the software was first seen on the asset. This field is populated only for software detected through agent-based scanning and is not applicable to software detected by agentless scanning. |+| **Evidence** | The file paths, registry paths, or both that indicate where the software was detected, when available. |+| **Number of known vulnerabilities** | The number of known vulnerabilities associated with the detected software version. |+| **End of support status** | The support lifecycle status of the software or software version, when available. |+ ## Filter the inventory -As soon as you apply filters, the summary values are updated to relate to the query results.+As soon as you apply filters, the summary metrics (such as **Total resources**, **Unhealthy resources**, and **Resource count by environment**) update to reflect the query results.++<a name="export-tools"></a>+### Export tools for asset inventory -### Export tools+The Defender for Cloud **Inventory** page provides the following export options: **Download CSV report** - Export the results of your selected filter options to a CSV file. @@ -134,9 +159,12 @@ To query software inventory data in Azure Resource Graph Explorer: 1. Enter any of the following queries (or customize them or write your own!) and select **Run query**. -### Query examples+<a name="query-examples"></a>+### Software inventory query examples for Azure Resource Graph -To generate a basic list of installed software:+Use the following Kusto Query Language (KQL) queries in Azure Resource Graph Explorer to explore Defender for Cloud software inventory data.++The following query lists all discovered software inventory records from the `securityresources` table, returning the vendor, software name, and version for each asset: ```kusto securityresources@@ -144,7 +172,7 @@ securityresources | project id, Vendor=properties.vendor, Software=properties.softwareName, Version=properties.version ``` -To filter by version numbers:+Use the following query to retrieve software inventory records and filter by version number. This example finds Windows Server 2019 machines running a version at or below a specific build: ```kusto securityresources@@ -153,7 +181,7 @@ securityresources | where Software=="windows_server_2019" and parse_version(Version)<=parse_version("10.0.17763.1999") ``` -To find machines with a combination of software products:+Use the following query to identify Azure virtual machines that have more than one specific software product installed. The query correlates software inventory entries with Azure VM identifiers and returns only machines with multiple matches: ```kusto securityresources@@ -164,9 +192,7 @@ securityresources | where count_ > 1 ``` -To combine a software product with another security recommendation:--(In this example: machines that have MySQL installed and exposed management ports.)+Use the following query to join software inventory data with security assessments and find machines that have a specific software product installed alongside an unhealthy security recommendation. This example finds machines that have MySQL installed and exposed management ports by normalizing Azure VM IDs to lowercase for accurate joins: ```kusto securityresources@@ -205,8 +231,12 @@ The cloud asset inventory gives you one view of cloud infrastructure across Azur ## Key capabilities +The unified cloud asset inventory provides the following core capabilities for managing and monitoring your multicloud infrastructure.+ ### Unified multicloud visibility +The cloud asset inventory helps you monitor and manage assets consistently across cloud providers.+ - **Comprehensive coverage**: View assets across Azure, AWS, GCP, and other supported platforms. - **Consistent interface**: Use one interface to manage multicloud assets. - **Real-time synchronization**: See current asset data from connected cloud environments.@@ -227,6 +257,8 @@ The inventory is organized by workload types, each providing tailored visibility ### Advanced filtering and scoping +Filtering and scoping features help you narrow inventory views to the assets that matter most.+ - **Persistent scoping**: Use cloud scopes for consistent filtering across experiences. - **Multi-dimensional filtering**: Filter by environment, workload, risk level, and compliance status. - **Search capabilities**: Find assets quickly with built-in search.@@ -234,6 +266,8 @@ The inventory is organized by workload types, each providing tailored visibility ## Asset categorization and metadata +The asset inventory enriches each resource with classification and coverage metadata to help you prioritize security efforts.+ ### Asset criticality classification Assets are automatically classified based on:@@ -263,6 +297,8 @@ Integrated risk indicators provide comprehensive asset context: ## Navigation and filtering +Use the following navigation and filtering features to find and scope cloud assets in the Defender portal.+ ### Accessing the cloud inventory To open the cloud inventory in the Microsoft Defender portal:@@ -282,6 +318,8 @@ To open the cloud inventory in the Microsoft Defender portal: ### Using filters effectively +Use filters to narrow the inventory to the assets and risks you want to investigate.+ - **Environment filtering**: Select specific cloud providers or view all environments. - **Scope filtering**: Apply cloud scopes to match organizational boundaries. - **Risk-based filtering**: Focus on high-risk or exposed assets.@@ -290,6 +328,8 @@ To open the cloud inventory in the Microsoft Defender portal: ### Search and discovery +Search and discovery tools help you quickly locate relevant assets in large environments.+ - **Text search**: Find assets by name, resource ID, or metadata. - **Tag-based search**: Locate assets by cloud provider tags and labels. - **Advanced queries**: Combine filters for precise asset discovery.@@ -297,6 +337,8 @@ To open the cloud inventory in the Microsoft Defender portal: ## Asset details and insights +Selecting an asset in the inventory reveals detailed configuration, security, and relationship information.+ ### Comprehensive asset information Each asset provides detailed information including:@@ -385,7 +427,7 @@ Cloud assets connect seamlessly with vulnerability management: ### Scoping limitations -Some assets may appear outside defined cloud scopes:+Some assets may appear outside the cloud scopes configured in Defender for Cloud: - **Cross-scope dependencies**: Assets with relationships that span multiple scopes. - **Floating assets**: Some asset types don't support fine-grained scoping.