Azure VM showing "No actionable vulnerabilities" message on Vulnerabilities Page

  • Updated

If you are an administrator and notice there are Virtual Machines from Azure that do not have their vulnerabilities showing on the Vulnerabilities page in Vanta,  and instead see a "No actionable vulnerabilities" please go through this article before submitting a ticket.

You are likely either using  Microsoft Defender Vulnerability Management (MDVM) which is not supported, or that server has no vulnerabilities, or possibly there is a sync issue. 



On the vulnerabilities page, search for the name of the server, and verify the status shows 'No actionable vulnerabilities":


If you believe this is a mistake, please go into Azure to verify if the information Vanta is currently fetching about the server from Defender is accurate. You can do this by following the steps below:


1. Click the name of the server in question, under the identifier column (From Vanta):


2. This will take you to resource in Azure, on that new page that opened up, scroll down and click Microsoft Defender for Cloud under the Security header in the left-hand menu:

3. Select "View additional recommendations in Defender for Cloud >" highlighted below in pink: 


Note: Recommendations that are not related to packages/applications are not tracked by Vanta and will not show on the vulnerabilities page. Examples include IP Address blocking, Port Management, etc...  :


4. You will be at the Secure Score recommendations tab by default, select the All Recommendations tab (the tab next to it):


5. Now in the search bar search for "Machines should have vulnerability findings resolved":

The status should even say Completed with 0 of X virtual machines unhealthy, where X is the total number of VMs that exist on that subscription: 


And clicking into it, you  should see there are No unhealthy resources found:

If this is what you see, then there are no findings for the server which is why Vanta shows no scan found. 


Note: If you use Microsoft Defender Vulnerability Management (MDVM) and this shows vulnerabilities, this is not supported at the moment, you can write into Support to check on the progress of this feature being added.  


Final Steps

If you instead see a list of vulnerabilities for packages/applications, and it is not from Microsoft Defender Vulnerability Management (MDVM),  please forward us a screenshot from the Machines that should have a vulnerability assessment solution page to further investigate this as there may be a syncing issue. We also would suggest checking your integrations page to make sure your Azure integration has no errors.