14.2 Agentless Scanning & Microsoft Defender Vulnerability Management for Azure VMs
Key Takeaways
- Agentless machine scanning snapshots the VM's root and data disks and analyses them out of band, so it needs no agent, no network access, and imposes no performance cost on the workload.
- Agentless scanning is delivered by Defender CSPM and Defender for Servers Plan 2, is on by default when either plan is enabled, and runs once every 24 hours on a fixed schedule.
- Only running VMs are scanned — a machine that is deallocated when the scan runs is skipped — and coverage stops at 4 TB of total disk, 14 disks, or an unsupported disk type such as UltraSSD_LRS.
- Microsoft Defender Vulnerability Management is the built-in vulnerability assessment solution in Defender for Cloud, replacing the earlier Qualys-based scanner, with premium capabilities such as security baselines assessment gated behind Defender for Servers Plan 2.
- Agentless scanning also delivers software inventory, secret scanning, malware scanning, and EDR configuration assessment, but cannot replace the real-time detection and response an endpoint agent provides.
Two Ways to See Inside a Machine
| Approach | Mechanism | Strengths | Limits |
|---|---|---|---|
| Agent-based (Defender for Endpoint sensor) | Software running in the OS | Real-time behavioural detection, response actions, live response | Requires deployment, upgrades, and OS support; can be disabled by an attacker with local admin |
| Agentless machine scanning | Snapshot of the managed disk analysed in a Microsoft-managed environment | No agent, no network access needed, no performance impact, covers machines the agent never reached | Point-in-time; no runtime detection or response |
They are complementary. Agentless scanning solves coverage — it finds the machines your deployment tooling missed. The agent solves detection and response. A serious environment runs both; the exam expects you to say which one a given requirement needs.
How Agentless Machine Scanning Works
- Defender for Cloud takes a snapshot of the machine's root and data disks using its own read-only permissions on the subscription.
- The copied snapshot stays in the same region as the VM and is analysed out of band in a regional, volatile, isolated scanning environment — nothing executes on the workload itself.
- Once the metadata is extracted, the copied snapshot is deleted immediately; scan data is not retained longer than the few minutes needed to collect it.
- Results are written back as Defender for Cloud recommendations, security findings, and cloud security graph data, consolidated with agent-based results.
Enablement: agentless scanning is a setting on the Defender CSPM plan and on Defender for Servers Plan 2, and it is on by default when either plan is enabled. Turning it on for one plan turns it on for both. You can enable or disable scanning as a whole, but you cannot switch off individual scan types. It also covers AWS EC2 and GCP compute instances reached through the multicloud connectors described earlier.
Scheduling: scans run once every 24 hours on a fixed schedule, and only running VMs are scanned — a machine that is deallocated when the scan window comes round is simply skipped. That single fact explains most "why is this VM missing from findings" scenarios.
What agentless scanning produces:
| Output | Value |
|---|---|
| Vulnerability findings | CVEs on installed OS and application packages, via Defender Vulnerability Management |
| Software inventory | Full list of installed applications and versions, queryable in Inventory |
| Secret scanning | Plaintext SSH keys, cloud credentials, and connection strings found on disk — a direct lateral-movement finding |
| Malware scanning | Detection of known malicious files using Microsoft Defender Antivirus signatures (Defender for Servers Plan 2) |
| EDR configuration assessment | Whether the machine runs an endpoint detection and response solution at all, and whether its Defender for Endpoint settings are correct |
| Kubernetes node coverage | Vulnerability assessment and malware scanning for VMs running as Kubernetes nodes, in commercial clouds |
The secret scanning output is the one security teams underestimate. Finding an unprotected private key on a web server disk turns an abstract "vulnerable machine" recommendation into a concrete attack path: internet-exposed VM → SSH key on disk → lateral movement to a database server. Defender CSPM's attack path analysis renders exactly that chain. The EDR configuration assessment is the quiet complement: it finds the machines where the agent is absent or misconfigured, which is the gap agentless scanning exists to close.
Requirements, Limits, and Permissions
Coverage claims fail on the details, so know the boundaries:
| Area | What is supported |
|---|---|
| Azure disks | Maximum 4 TB total across all disks (above that, only the OS disk is scanned, and only if it is under 4 TB); maximum 14 disks; virtual machine scale sets in Flexible orchestration |
| Encryption | Unencrypted disks, platform-managed keys (PMK), and customer-managed keys (CMK) |
| AWS / GCP | EC2 and Auto Scale instances (PMK and CMK); GCP compute instances and instance groups with Google-managed keys or CMEK |
| Unsupported disk types | UltraSSD_LRS, PremiumV2_LRS, and AKS ephemeral OS disks — if any disk on the VM matches, the whole VM is skipped |
| Unsupported file systems | UFS, ReFS, and ZFS, plus OracleASM, DRBD, and Linux_Raid_Member layouts and DM_Verity_Hash/swap volumes |
| Unsupported resources | Databricks VMs |
Permissions are worth a moment because they show why this is safe to enable. In Azure, the built-in VM scanner operator role grants only read-level disk and VM actions — Microsoft.Compute/disks/read, disks/beginGetAccess/action, and the VM and scale-set read actions — and Defender for Cloud adds them automatically when you enable scanning. Extending coverage to CMK-encrypted disks requires granting the Microsoft Defender for Cloud Servers Scanner Resource Provider Key Get, Key Wrap, and Key Unwrap on the relevant key vaults, or the Key Vault Crypto Service Encryption User role on vaults that use Azure RBAC. On AWS the equivalent is the VmScanner role in the CloudFormation stack; on GCP, a custom role plus the CMEK encrypter/decrypter role.
Microsoft Defender Vulnerability Management
Microsoft Defender Vulnerability Management (MDVM) is the integrated vulnerability assessment solution in Defender for Cloud, and it has replaced the older Qualys-powered built-in scanner. It works both through the Defender for Endpoint agent and through agentless scanning.
Core capabilities, available with Defender for Servers Plan 1 and Plan 2:
- Continuous vulnerability discovery and assessment across OS and applications.
- Risk-based prioritization that weighs exploit availability, active threat campaigns, and business context rather than raw CVSS.
- Findings surfaced through the "Machines should have vulnerability findings resolved" recommendation, with per-machine and per-CVE drill-down.
- Integration into Secure Score and attack path analysis.
Premium capabilities, included with Defender for Servers Plan 2:
| Capability | What it adds |
|---|---|
| Security baselines assessment | Measures machines against industry baselines (for example CIS) and reports drift |
| Browser extensions inventory | Enumerates installed extensions and their risk |
| Digital certificate assessment | Finds expiring, weak, or untrusted certificates on machines |
| Network share analysis | Identifies internally exposed shares with weak configuration |
| Blocking vulnerable applications | Prevents execution of applications with known critical vulnerabilities |
Choosing the Right Answer on Exam Scenarios
- "We must assess every VM, including ones where agent deployment repeatedly fails" → agentless scanning.
- "We need to detect a live process injection and isolate the machine" → Defender for Endpoint via Defender for Servers; agentless cannot do this.
- "Find hardcoded credentials sitting on server disks" → agentless secret scanning.
- "Tell us which servers have no EDR solution installed at all" → agentless EDR configuration assessment.
- "Report drift from a CIS baseline on Windows Server" → security baselines assessment (Defender for Servers Plan 2), or machine configuration where the requirement is Azure Policy compliance rather than vulnerability reporting.
- "Block applications with critical CVEs from running" → Defender for Servers Plan 2 premium MDVM.
- "Assess a container image before it is deployed" → Defender for Containers registry scanning, not machine scanning.
Finally, remember the operational point that makes any of this useful: findings must be exported and owned. Route vulnerability recommendations through continuous export to Log Analytics, apply governance rules to assign owners and due dates, and alert in Sentinel when a machine with an internet-exposed public IP acquires a critical, exploitable finding.
A subscription contains 300 virtual machines, and agent deployment has failed on roughly 40 of them for months. The security team must still see vulnerability findings and installed software for those machines. What should be enabled?
Which requirement can agentless machine scanning NOT satisfy?
An organization needs Defender for Cloud to report how far its Windows servers have drifted from an industry security baseline and to block applications with known critical vulnerabilities from executing. What is required?
A batch-processing virtual machine is powered on for only a few hours each week. Agentless machine scanning is enabled on the subscription, yet this VM never appears with vulnerability findings while its neighbours do. What is the most likely explanation?