Microsoft Defender for Cloud
Cloud and workloadsEnable vulnerability scanning with Microsoft Defender Vulnerability Management
In brief
The page adds clearer prerequisites, updates the agentless scanning link, documents the full REST API endpoint with placeholder definitions and PUT/DELETE actions, and simplifies Inventory remediation steps.
What Defender admins need to know
Admins manually configuring scanning or remediating machines can use the updated prerequisites, API details, and step-by-step guidance.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Enable vulnerability scanning with Microsoft Defender Vulnerability Management
The Defender for Servers plan in Microsoft Defender for Cloud provides vulnerability scanning for protectedyour machines.
Integrated vulnerability scanning in Defender for Cloud uses Microsoft Defender Vulnerability Management and providesto scan your machines. It supports both agentless and agent-based scanning.modes.
Vulnerability managementScanning is enabledon by default when you enable Defender for Servers. Use this articlethe manual steps below only if you need to enableturn on scanning manually.yourself. Before you begin, review the prerequisites.
Prerequisites
Make sure you meet the following requirements before you enable vulnerability scanning.
| Requirement | Details |
|---|---|
| Agentless vulnerability scanning | Review Agentless scanning is on by default when Defender for Servers Plan 2 or the Defender for Servers Cloud Security Posture Management (CSPM) plan is enabled. |
| Agent-based vulnerability scanning | For agent-based scanning, enable Defender for Servers Plan 1 (P1) or Plan 2 (P2). |
| Machine support | Review supported machines. |
| Permissions | You need Owner (resource group level) permissions to deploy the scanner. You need Security Reader to view findings. |
:::image type="content" source="media/deploy-vulnerability-assessment-defender-vulnerability-management/turn-on-deploy-vulnerability-assessment.png" alt-text="Screenshot showing where to turn on deployment of vulnerability assessment for machines." lightbox="media/auto-deploy-vulnerability-assessment/turn-on-deploy-vulnerability-assessment.png":::
- Select Apply > Save.
Next step
[!div class="nextstepaction"] View vulnerability findings
Configure with the REST API
To configure withenable or disable scanning through the REST API, run PUT/send a PUT (enable) or DELETE using this URL: (disable) request to the following URL. Replace each placeholder with your own values.
https://management.azure.com/subscriptions/...{subscriptionId}/resourceGroups/...{resourceGroup}/providers/Microsoft.Compute/virtualMachines/...{vmName}/providers/Microsoft.Security/serverVulnerabilityAssessments/mdetvm?api-version=2015-06-01-preview| Placeholder | Description |
|---|---|
{subscriptionId} | Your Azure subscription ID. |
{resourceGroup} | The resource group that contains the VM. |
{vmName} | The name of the virtual machine. |
Enable vulnerability scanning for a machine
To enable vulnerability scanning forIf a specific machine, use the recommendation that appears when Defender for Serversmachine doesn't findhave scanning turned on, the Machines should have a vulnerability assessment recommendation appears in Defender for Cloud. Use that recommendation to enable it.
solution.solution
To find all machines without a solution installed, inOpen the Inventorypage,page and select Unhealthy resources.Use theFilter by Recommendations
filter toand searchfor machines with this recommendation:for:Machines should have a vulnerability assessment solution.Open the recommendation.
Follow the
remediationsteps to fixmachineseach machine thatdon't havelacks avulnerability assessment solution enabled.solution.Select a vulnerability solution.
:::image type="content" source="media/deploy-vulnerability-assessment-defender-vulnerability-management/mdvm-small.png" alt-text="Screenshot of the window that shows the options for selecting a vulnerability assessment solution from the recommendation.":::
After the processremediation completes, it can take up to 24 hours for resources to move to the Healthy resources tab.
Next steps
@@ -2,24 +2,27 @@ title: Enable vulnerability scanning with Microsoft Defender Vulnerability Management description: Enable, deploy, and use Microsoft Defender Vulnerability Management with Microsoft Defender for Cloud to discover weaknesses in your Azure and hybrid machines ms.topic: how-to-ms.date: 05/28/2026+ms.date: 07/03/2026+ms.custom: msecd-doc-authoring-1013 #customer intent: As a security administrator, I want to enable Microsoft Defender Vulnerability Management scanning so that I can identify and remediate machine vulnerabilities. ai-usage: ai-assisted --- # Enable vulnerability scanning with Microsoft Defender Vulnerability Management -The Defender for Servers plan in Microsoft Defender for Cloud provides [vulnerability scanning](auto-deploy-vulnerability-assessment.md) for protected machines.+The Defender for Servers plan in Microsoft Defender for Cloud provides [vulnerability scanning](auto-deploy-vulnerability-assessment.md) for your machines. -Integrated vulnerability scanning in Defender for Cloud uses Microsoft Defender Vulnerability Management and provides both [agentless and agent-based](auto-deploy-vulnerability-assessment.md#agent-based-and-agentless-scanning) scanning.+Defender for Cloud uses Microsoft Defender Vulnerability Management to scan your machines. It supports both [agentless and agent-based](auto-deploy-vulnerability-assessment.md#agent-based-and-agentless-scanning) modes. -Vulnerability management is enabled by default when you enable Defender for Servers. Use this article only if you need to enable scanning manually.+Scanning is on by default when you enable Defender for Servers. Use the manual steps below only if you need to turn on scanning yourself. Before you begin, review the [prerequisites](#prerequisites). ## Prerequisites +Make sure you meet the following requirements before you enable vulnerability scanning.+ **Requirement** | **Details** --- | ----**Agentless vulnerability scanning** | Review [agentless scanning requirements](enable-agentless-scanning-vms.md#prerequisites).<br/><br/> Agentless scanning is on by default when Defender for Servers Plan 2 or the Defender for Servers Cloud Security Posture Management (CSPM) plan is enabled.+**Agentless vulnerability scanning** | Review [agentless scanning requirements](enable-agentless-scanning-vms.md#before-you-begin).<br/><br/> Agentless scanning is on by default when Defender for Servers Plan 2 or the Defender for Servers Cloud Security Posture Management (CSPM) plan is enabled. **Agent-based vulnerability scanning** | For agent-based scanning, enable Defender for Servers Plan 1 (P1) or Plan 2 (P2). **Machine support** | Review [supported machines](/defender-vulnerability-management/tvm-supported-os). **Permissions** | You need [Owner](/azure/role-based-access-control/built-in-roles#owner) (resource group level) permissions to deploy the scanner.<br/><br/> You need [Security Reader](/azure/role-based-access-control/built-in-roles#security-reader) to view findings.@@ -40,29 +43,34 @@ To enable vulnerability scanning for an entire subscription, complete the follow :::image type="content" source="media/deploy-vulnerability-assessment-defender-vulnerability-management/turn-on-deploy-vulnerability-assessment.png" alt-text="Screenshot showing where to turn on deployment of vulnerability assessment for machines." lightbox="media/auto-deploy-vulnerability-assessment/turn-on-deploy-vulnerability-assessment.png"::: 1. Select **Apply** > **Save**. -## Next step--> [!div class="nextstepaction"]-> [View vulnerability findings](/defender-vulnerability-management/tvm-weaknesses)+<a name="next-step"></a>+## Configure with the REST API -### Configure with the REST API+To enable or disable scanning through the REST API, send a **PUT** (enable) or **DELETE** (disable) request to the following URL. Replace each placeholder with your own values. -To configure with the REST API, run PUT/DELETE using this URL:+```http+https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/{vmName}/providers/Microsoft.Security/serverVulnerabilityAssessments/mdetvm?api-version=2015-06-01-preview+``` -`https://management.azure.com/subscriptions/.../resourceGroups/.../providers/Microsoft.Compute/virtualMachines/.../providers/Microsoft.Security/serverVulnerabilityAssessments/mdetvm?api-version=2015-06-01-preview`+| Placeholder | Description |+|---|---|+| `{subscriptionId}` | Your Azure subscription ID. |+| `{resourceGroup}` | The resource group that contains the VM. |+| `{vmName}` | The name of the virtual machine. | ## Enable vulnerability scanning for a machine -To enable vulnerability scanning for a specific machine, use the recommendation that appears when Defender for Servers doesn't find a vulnerability assessment solution.+If a specific machine doesn't have scanning turned on, the `Machines should have a vulnerability assessment solution` recommendation appears in Defender for Cloud. Use that recommendation to enable it. -1. To find all machines without a solution installed, in the **Inventory** page, select **Unhealthy resources**. Use the **Recommendations** filter to search for machines with this recommendation: `Machines should have a vulnerability assessment solution`.+1. Open the **Inventory** page and select **Unhealthy resources**.+1. Filter by **Recommendations** and search for: `Machines should have a vulnerability assessment solution`. 1. Open the recommendation.-1. Follow the remediation steps to fix machines that don't have a vulnerability assessment solution enabled.+1. Follow the steps to fix each machine that lacks a solution. 1. Select a vulnerability solution. :::image type="content" source="media/deploy-vulnerability-assessment-defender-vulnerability-management/mdvm-small.png" alt-text="Screenshot of the window that shows the options for selecting a vulnerability assessment solution from the recommendation."::: -After the process completes, it can take up to 24 hours for resources to move to the **Healthy resources** tab.+After remediation completes, it can take up to 24 hours for resources to move to the **Healthy resources** tab. ## Next steps