Resource Health missing recommendations

Hey Laura, it looks like what you’re seeing is by-design in Defender for Cloud. The “SQL servers on machines should have vulnerability findings resolved” recommendation will drop all sub-findings from the Unhealthy view if Defender believes those issues are resolved or the data hasn’t been refreshed yet. Because you still have some unaddressed SQL findings, here’s what I’d try to pull them back in:

1. Force a fresh vulnerability assessment scan
   • In the Azure portal go to Defender for Cloud → Recommendations → search for “SQL servers on machines should have vulnerability findings resolved” → open the recommendation and click Run scan (or use PowerShell/CLI to kick off an on-demand scan).
   • This will redeploy the SQL Vulnerability Assessment extension (if needed) and run the latest scan.
2. Ensure your VM agent and data pipeline are healthy
   • Check that the Log Analytics agent (MMA/AMA) on the VM is reporting health. You can run this in the VM’s workspace:

     
          Heartbeat
     
          | where TimeGenerated > ago(1h)
     
          | where Computer contains "<YourVMName>"
     
     

   • If there are gaps, re-install or repair the agent so Defender for Cloud can ingest the new scan results.
3. Wait for the recommendation refresh cycle (up to 12 hours)
   • Defender for Cloud refreshes most recs every 12 hours. Once the new scan results come in, any unresolved findings will reappear under Unhealthy.
4. (Optional) Validate Azure Policy compliance
   • Defender for Cloud uses Azure Policy under the covers. In the portal go to Azure Policy → Compliance → find the SQL vulnerability assessment policy → confirm it’s still enabled and your VM is listed as noncompliant.
5. Query the assessments directly (if you want a quick list)
   • Azure CLI example:

     
          az security assessment list \
     
            --query "[?contains(name,'SqlVulnerabilityAssessment') && properties.status.code=='Unhealthy']"
     
     

   • Or use Resource Graph to pull SqlVulnerabilityAssessmentRuleResults entries.

Once the new scan is in, you should see only the outstanding findings under Unhealthy. Let me know if you still don’t see them after a fresh scan and 12 hours of refresh, and we can dig deeper!

Reference docs

• Removing recommendations in Microsoft Defender for Cloud: https://docs.microsoft.com/azure/defender-for-cloud/troubleshooting-guide#removing-recommendations
• How often does Defender for Cloud scan: https://docs.microsoft.com/azure/defender-for-cloud/faq-general#how-often-does-security-center-scan-for-operating-system-vulnerabilities-system-updates-and-endpoint-protection-issues
• Managing security recommendations: https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations
• Use Defender for Cloud recommendations to enhance security: https://dotnet.territoriali.olinfo.it/azure/defender-for-cloud/implement-security-recommendations

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.