Microsoft Defender for Cloud
Cloud and workloadsEnable vulnerability scanning with a Bring Your Own License (BYOL) solution
In brief
The article now uses updated Defender Vulnerability Management terminology, clarifies Azure portal navigation and Auto deploy scope, and adds a more detailed Qualys/Rapid7 deployment script example with explicit parameters.
What Defender admins need to know
Administrators can use the clarified steps and expanded script example when deploying a partner vulnerability assessment solution.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
As an alternative to Microsoft Defender for Vulnerability Management, you can use your own privately licensed vulnerability assessment solution. This article shows how to deploy a partner solution on Azure VMs.
Prerequisites
To deploy a BYOL vulnerability assessment solution through the Azure portal, complete the following steps:
FromIn the Azure portal, search for and open Defender for Cloud.From Defender for Cloud's menu, open the Recommendations page.
- For Qualys, enter the license provided by Qualys into the License code field.
- For Rapid7, upload the Rapid7 Configuration File.
- In the Public key box, enter the public key information provided by the partner.
- To automatically install this vulnerability assessment agent on all discovered VMs in the subscription of
thisthe configured third-party vulnerability scanner solution, select Auto deploy. - Select OK.
If you already set up the BYOL solution, select Deploy your configured third-party vulnerability scanner, select the relevant extension, and select Proceed. | publicKey | ✔ | Vendor provided public key. | | AutoUpdate | - | Enable (true) or disable (false) auto deploy for this VA solution. When enabled, every new VM on the subscription automatically attempts to link to the solution.
(Default: False) |
Syntax:The following syntax runs the New-ASCVASolution.ps1 script with placeholder values to provision a Qualys or Rapid7 vulnerability assessment solution:
.\New-ASCVASolution.ps1 -subscriptionId <Subscription Id> -resourceGroupName <RG Name>
-licenseCode <License code from vendor> -publicKey <Public Key received from vendor>
Example deployment script
The following example creates a Qualys vulnerability assessment solution with explicit subscription, resource group, license, and public key parameters. This example doesn't include valid license details.
.\New-ASCVASolution.ps1 -subscriptionId 'f4cx1b69-dtgb-4ch6-6y6f-ea2e95373d3b' -resourceGroupName 'DefaultResourceGroup-WEU' -vaSolutionName 'QualysVa001' -vaType 'Qualys' -autoUpdate 'false' `
-publicKey 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOiOLXjOywMfLZIBGPZLwSocf1Q64GASLK9OHFEmanBl1nkJhZDrZ4YD5lM98fThYbAx1Rde2iYV1ze/wDlX4cIvFAyXuN7HbdkeIlBl6vWXEBZpUU17bOdJOUGolzEzNBhtxi/elEZLghq9Chmah82me/okGMIhJJsCiTtglVQIDAQAB'
Next stepsteps
[!div class="nextstepaction"] Remediate vulnerability findings
@@ -2,7 +2,8 @@ title: Enable vulnerability scanning with a Bring Your Own License (BYOL) solution description: Deploy a BYOL vulnerability assessment solution on Azure virtual machines (deprecated). Use this guidance to review existing setup and plan migration alternatives. ms.topic: how-to-ms.date: 05/28/2026+ms.date: 07/03/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to deploy a BYOL vulnerability scanner so that I can assess VM vulnerabilities by using my existing licensed solution. ai-usage: ai-assisted ---@@ -16,7 +17,7 @@ The Defender for Servers plan in Microsoft Defender for Cloud provides [vulnerab > [!WARNING] > Bring your own license (BYOL) capability is being deprecated. Starting February 3rd, you can no longer add new BYOL security solutions or onboard new machines to existing ones. By May 1st, the deprecation is complete and no data is available. If you use BYOL, migrate to [Microsoft Defender Vulnerability Management](how-to-transition-to-built-in.yml) or use a [Microsoft Security Exposure Management connector](/security-exposure-management/configure-data-connectors). -As an alternative to Defender for Vulnerability Management, you can use your own privately licensed vulnerability assessment solution. This article shows how to deploy a partner solution on Azure VMs.+As an alternative to Microsoft Defender Vulnerability Management, you can use your own privately licensed vulnerability assessment solution. This article shows how to deploy a partner solution on Azure VMs. ## Prerequisites @@ -35,7 +36,7 @@ Before you deploy a bring your own license (BYOL) vulnerability scanning solutio To deploy a BYOL vulnerability assessment solution through the Azure portal, complete the following steps: -1. From the [Azure portal](https://azure.microsoft.com/features/azure-portal/), open **Defender for Cloud**.+1. In the [Azure portal](https://azure.microsoft.com/features/azure-portal/), search for and open **Defender for Cloud**. 1. From Defender for Cloud's menu, open the **Recommendations** page. @@ -60,7 +61,7 @@ To deploy a BYOL vulnerability assessment solution through the Azure portal, com 1. For Qualys, enter the license provided by Qualys into the **License code** field. 1. For Rapid7, upload the **Rapid7 Configuration File**. 1. In the **Public key** box, enter the public key information provided by the partner.- 1. To automatically install this vulnerability assessment agent on all discovered VMs in the subscription of this solution, select **Auto deploy**.+ 1. To automatically install this vulnerability assessment agent on all discovered VMs in the subscription of the configured third-party vulnerability scanner solution, select **Auto deploy**. 1. Select **OK**. 1. If you already set up the BYOL solution, select **Deploy your configured third-party vulnerability scanner**, select the relevant extension, and select **Proceed**.@@ -93,7 +94,7 @@ To run the script, you need the relevant information for the following parameter | **publicKey** | ✔ | Vendor provided public key. | | **AutoUpdate** | - | Enable (true) or disable (false) auto deploy for this VA solution. When enabled, every new VM on the subscription automatically attempts to link to the solution.<br/>(Default: False) | -Syntax:+The following syntax runs the `New-ASCVASolution.ps1` script with placeholder values to provision a Qualys or Rapid7 vulnerability assessment solution: ```azurepowershell .\New-ASCVASolution.ps1 -subscriptionId <Subscription Id> -resourceGroupName <RG Name>@@ -101,9 +102,10 @@ Syntax: -licenseCode <License code from vendor> -publicKey <Public Key received from vendor> ``` -### Example+<a name="example"></a>+### Example deployment script -This example doesn't include valid license details.+The following example creates a Qualys vulnerability assessment solution with explicit subscription, resource group, license, and public key parameters. This example doesn't include valid license details. ```azurepowershell .\New-ASCVASolution.ps1 -subscriptionId 'f4cx1b69-dtgb-4ch6-6y6f-ea2e95373d3b' -resourceGroupName 'DefaultResourceGroup-WEU' -vaSolutionName 'QualysVa001' -vaType 'Qualys' -autoUpdate 'false' `@@ -111,7 +113,8 @@ This example doesn't include valid license details. -publicKey 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOiOLXjOywMfLZIBGPZLwSocf1Q64GASLK9OHFEmanBl1nkJhZDrZ4YD5lM98fThYbAx1Rde2iYV1ze/wDlX4cIvFAyXuN7HbdkeIlBl6vWXEBZpUU17bOdJOUGolzEzNBhtxi/elEZLghq9Chmah82me/okGMIhJJsCiTtglVQIDAQAB' ``` -## Next step+<a name="next-step"></a>+## Next steps > [!div class="nextstepaction"] > [Remediate vulnerability findings](remediate-vulnerability-findings-vm.md)