If you are an administrator and notice that there are Virtual Machines from Azure whose vulnerabilities do not show on the Vulnerabilities page in Vanta and instead show "No actionable vulnerabilities"
Troubleshooting
On the vulnerabilities page, search for the name of the server and verify the status shows 'No actionable vulnerabilities":
If you believe this is a mistake, please go into Azure to verify if the information Vanta is currently fetching about the server from Defender is accurate. You can do this by following the steps below:
- Click the name of the server in question under the identifier column (From Vanta):
- This will take you to resource in Azure; on that new page that opened up, scroll down and click Microsoft Defender for Cloud under the Security header in the left-hand menu:
- Select "View additional recommendations in Defender for Cloud >" highlighted below in pink:
Note: Recommendations that are not related to packages/applications are not tracked by Vanta and will not show on the vulnerabilities page. Examples include IP Address blocking, Port Management, etc... :
- You will be at the Secure Score recommendations tab by default, select the All Recommendations tab (the tab next to it):
- Now in the search bar, search for "Machines should have vulnerability findings resolved":
- The status should even say Completed with 0 of X virtual machines unhealthy, where X is the total number of VMs that exist on that subscription:
- Clicking into it, you should see there are "No unhealthy resources found"
- If this is what you see, then there are no findings for the server which is why Vanta shows no scan found.
Note: If you use Microsoft Defender Vulnerability Management (MDVM) and this shows vulnerabilities, this is not supported at the moment, you can write into Support to check on the progress of this feature being added.
Final Steps
If you instead see a list of vulnerabilities for packages/applications, and it is not from Microsoft Defender Vulnerability Management (MDVM), please forward us a screenshot from the Machines that should have a vulnerability assessment solution page to further investigate this as there may be a syncing issue. We also suggest checking your integrations page to ensure your Azure integration has no errors.