Enable Agentless Scanning for Machines in Microsoft Defender for Cloud

Risk Level: Medium (should be achieved)

Ensure that the "Agentless scanning for machines" component is turned on for your Azure subscriptions within Microsoft Defender for Cloud, so that connected virtual machines are automatically discovered and assessed without requiring the deployment of an in-guest agent. Agentless scanning becomes available once either the Microsoft Defender Cloud Security Posture Management (CSPM) plan or the Defender for Servers Plan 2 pricing plan is enabled for the subscription, and, once turned on, it periodically creates a secure, isolated snapshot of each supported machine's operating system and data disks to build a software inventory, identify known vulnerabilities, and detect plaintext secrets; when Defender for Servers Plan 2 is enabled, agentless scanning also scans the machine for malware. Agentless scanning runs on a fixed, non-configurable schedule of once every 24 hours, and it doesn't require network connectivity to the target machine or affect its performance.

Security

The Microsoft Defender for Cloud agentless machine scanner provides threat detection, vulnerability detection, and discovery of sensitive information for virtual machines that don't have (or can't have) an in-guest Microsoft Defender for Endpoint agent installed, without adding operational overhead or performance impact to the scanned machines. Without agentless scanning enabled, unmanaged, unpatched, or misconfigured virtual machines can remain outside the coverage of Defender for Cloud's vulnerability assessment, software inventory, secrets scanning, and (when Defender for Servers Plan 2 is enabled) malware detection capabilities, increasing the risk that outdated software, exposed credentials, or malicious files on these machines go undetected until they're exploited or cause a security incident.

Note: Agentless scanning results are refreshed once every 24 hours on a fixed schedule, so allow up to 24 hours after enabling the setting before results appear. Malware detection is only available when Defender for Servers Plan 2 is enabled — enabling Defender CSPM alone provides software inventory, vulnerability assessment, and secrets scanning, but not malware scanning.

Audit

To determine if "Agentless scanning for machines" is enabled in Microsoft Defender for Cloud for your Azure subscriptions, perform the following operations:

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to Microsoft Defender for Cloud blade available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0.
In the left navigation panel, under Management, choose Environment settings.
Click on the name (link) of the Azure subscription that you want to examine.
In the left navigation panel, under Settings, select Defender plans, and choose Settings & monitoring.
On the Settings & monitoring page, ensure that Defender plans is set to All, then locate the row for Agentless scanning for machines and check the value set in the Status column:
- If the On/Off toggle button in the Status column is inactive, neither Defender CSPM nor Servers (Plan 2) is enabled for the selected subscription, so "Agentless scanning for machines" can't be turned on.
- If the toggle button is active and On is not selected, "Agentless scanning for machines" is not enabled for the selected Azure subscription.
- If On is selected, "Agentless scanning for machines" is enabled for the selected Azure subscription.
Repeat steps no. 4 – 6 for each Azure subscription available within your Microsoft Azure cloud account.

Using Azure CLI

Run account list command (Windows/macOS/Linux) with output query filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
```
az account list \
--query '[].{id:id, name:name}'
```

The command output should return the requested subscription identifiers (IDs) and names:

[
    {
        "id": "abcdabcd-1234-abcd-1234-abcdabcdabcd",
        "name": "Production Subscription"
    },
    {
        "id": "abcd1234-abcd-1234-abcd-abcd1234abcd",
        "name": "Development Subscription"
    }
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter, to set the selected subscription to be the current active subscription (the command does not produce an output):
```
az account set \
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run security pricing list command (Windows/macOS/Linux) to check if "Agentless scanning for machines" is enabled for the CloudPosture (Defender CSPM) and VirtualMachines (Defender for Servers) plans:
```
az security pricing list \
--query "value[?name=='CloudPosture' || name=='VirtualMachines'].{Plan:name, AgentlessStatus:extensions[?name=='AgentlessVmScanning'].isEnabled | [0]}" \
--output table
```
The command output should return the agentless scanning status for both plans:
```
Plan             AgentlessStatus
---------------  -----------------
VirtualMachines  True
CloudPosture     True
```
If the AgentlessStatus column shows True for either the CloudPosture or VirtualMachines plan (or both), Agentless Scanning for Machines is enabled for the selected subscription. If AgentlessStatus shows False or null for both plans, Agentless Scanning for Machines is not enabled for the selected subscription.
Repeat steps no. 3 – 5 for each Azure subscription available within your Microsoft Azure cloud account.

Remediation / Resolution

To enable "Agentless scanning for machines" in Microsoft Defender for Cloud for your Azure subscriptions, perform the following operations:

Note: Enabling "Agentless scanning for machines" requires either the Microsoft Defender Cloud Security Posture Management (CSPM) plan or the Defender for Servers Plan 2 pricing plan to be enabled for the target Azure subscription. Agentless scanning itself is included at no additional cost within these plans, however Defender CSPM and Defender for Servers Plan 2 are billed pricing plans — review the Microsoft Defender for Cloud pricing page before enabling either plan.

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to Microsoft Defender for Cloud blade available at https://portal.azure.com/#view/Microsoft_Azure_Security/SecurityMenuBlade/~/0.
In the left navigation panel, under Management, choose Environment settings.
Click on the name (link) of the Azure subscription that you want to configure (see Audit section part I to identify the right subscription).
In the left navigation panel, under Settings, select Defender plans, and choose Settings & monitoring.
On the Settings & monitoring page, perform the following actions:
1. Ensure that Defender plans is set to All.
2. Locate the row for Agentless scanning for machines and select On in the Status column. If the On/Off toggle button is inactive, navigate back to the Defender plans page and turn on the required Defender plan (Defender CSPM and/or Servers with Plan 2 selected) first.
3. Select Continue from the top menu to apply the configuration changes.
4. Choose Save from the top menu to save the changes.
Repeat steps no. 4 – 6 for each Azure subscription that requires "Agentless scanning for machines" in your Microsoft Azure cloud account.

Using Azure CLI

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to configure as the identifier parameter, to set the selected subscription to be the current active subscription (see Audit section part II to identify the right subscription; the command does not produce an output):
```
az account set \
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run security pricing create command (Windows/macOS/Linux) to enable the Defender for Servers Plan 2 pricing plan (if not already enabled) and turn on the AgentlessVmScanning extension for the selected Azure subscription:
```
az security pricing create \
--name VirtualMachines \
--tier Standard \
--subplan P2 \
--extensions name=AgentlessVmScanning isEnabled=true
```

The command output should return the updated pricing plan configuration, confirming that the "AgentlessVmScanning" extension is enabled while the plan's other extensions are preserved unchanged:

{
    "deprecated": null,
    "enablementTime": "2026-09-08T04:15:00.000000+00:00",
    "extensions": [
        {
            "additionalExtensionProperties": null,
            "isEnabled": "False",
            "name": "MdeDesignatedSubscription",
            "operationStatus": null
        },
        {
            "additionalExtensionProperties": null,
            "isEnabled": "False",
            "name": "FileIntegrityMonitoring",
            "operationStatus": null
        },
        {
            "additionalExtensionProperties": null,
            "isEnabled": "True",
            "name": "AgentlessVmScanning",
            "operationStatus": {
                "code": "Succeeded",
                "message": "Successfully enabled extension"
            }
        }
    ],
    "freeTrialRemainingTime": "30 days, 0:00:00",
    "id": "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/providers/Microsoft.Security/pricings/VirtualMachines",
    "name": "VirtualMachines",
    "pricingTier": "Standard",
    "replacedBy": null,
    "subPlan": "P2",
    "type": "Microsoft.Security/pricings"
}

Repeat steps no. 1 – 3 for each Azure subscription that requires "Agentless scanning for machines" in your Microsoft Azure cloud account.

References

CIS Security Documentation
CIS Microsoft Azure Benchmarks

Azure Command Line Interface (CLI) Documentation
az account list
az account set
az security pricing list
az security pricing create

Publication date Sep 11, 2026

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

Using Azure CLI

References

Related SecurityCenter rules