Implementing Agentless VM Scanning in Microsoft Defender for Cloud

Introduction: The Evolution of Cloud Security Visibility

In the early days of cloud computing, security professionals relied heavily on endpoint protection platforms (EPP) that required installing software agents on every virtual machine (VM). While effective for real-time monitoring and active threat prevention, this approach introduced significant operational overhead. Organizations faced challenges with agent deployment consistency, compatibility issues across diverse operating systems, and the inevitable performance impact on the underlying virtual hardware. As cloud environments scaled to thousands of instances, managing these agents became a bottleneck for security operations teams.

Agentless VM scanning represents a fundamental shift in how we approach cloud workload protection. Instead of relying on software running inside the guest operating system, agentless scanning leverages the cloud provider’s underlying infrastructure—specifically, the ability to take snapshots of virtual hard disks (VHDs) and mount them in a secure, isolated environment for analysis. This method allows security tools to inspect files, configurations, and installed software without ever touching the running workload. For security practitioners, this means gaining deep visibility into vulnerabilities and misconfigurations without the friction of deploying agents or managing credentials for every single VM.

Understanding how to implement agentless scanning is critical for modern cloud architects and security engineers. It allows for comprehensive security coverage across ephemeral workloads, legacy systems that cannot support modern agents, and environments where administrative access is strictly controlled. This lesson will guide you through the technical architecture, implementation steps, and best practices for leveraging agentless scanning within Microsoft Defender for Cloud, ensuring you can maintain a high security posture with minimal operational complexity.

Understanding the Architecture of Agentless Scanning

To effectively implement agentless scanning, you must first understand what is happening under the hood. When you enable this feature in Microsoft Defender for Cloud, you are not simply toggling a setting; you are authorizing the service to interact with your storage layer. The process begins with the cloud provider’s management plane orchestrating a snapshot of the disk associated with the virtual machine. This snapshot is then attached to a dedicated, managed scanner instance operated by Microsoft.

Because the scanner operates on a copy of the disk, it does not interfere with the production VM’s CPU or memory. This is a significant advantage for high-performance databases or latency-sensitive applications where traditional agents might cause jitter or resource contention. Once the disk is mounted, the scanner performs a deep analysis of the file system to identify installed software, configuration files, and known vulnerabilities (CVEs). After the scan is complete, the snapshot is deleted, and the results are reported back to the Defender for Cloud dashboard.

Callout: Agent-Based vs. Agentless Scanning

Choosing between agent-based and agentless scanning is not an "either-or" decision; it is about selecting the right tool for the specific security requirement. Agent-based solutions remain the gold standard for real-time threat detection and active response, as they can monitor system calls and memory in real-time. Agentless scanning, by contrast, is superior for broad, low-impact visibility, vulnerability assessment, and compliance auditing across large, diverse estates where agent deployment is not feasible.

Core Components of the Workflow

The workflow relies on several distinct stages that ensure security and data privacy:

1. Triggering: The scan is triggered either on a predefined schedule or via an API call from the Defender for Cloud service.
2. Snapshot Creation: The system creates a point-in-time snapshot of the OS disk.
3. Mounting: The snapshot is attached to a secure, isolated environment managed by Microsoft.
4. Deep Inspection: The scanning engine parses the file system, looking for vulnerabilities and configuration issues.
5. Reporting: The engine pushes the findings to the Defender for Cloud portal and deletes the snapshot.

Prerequisites and Configuration Steps

Before you can start using agentless scanning, you must ensure that your environment is properly prepared. Microsoft Defender for Cloud requires specific permissions to interact with your storage resources and manage snapshots. If these permissions are not correctly configured, the service will fail to perform the scans, leading to gaps in your security reporting.

Step 1: Enabling the Defender CSPM Plan

Agentless scanning is a feature of the Microsoft Defender Cloud Security Posture Management (CSPM) plan. You must ensure that this plan is enabled for your subscription or management group. Navigate to the "Environment Settings" in the Azure portal, select your subscription, and ensure the "Defender CSPM" plan is set to "On."

Step 2: Configuring Data Collection Settings

Once the plan is enabled, you need to configure the data collection settings. In the "Settings & Environment" menu, locate the "Data Collection" section. Here, you will see an option for "Agentless scanning for machines." Ensure this is toggled to "On." You may also need to specify which resource groups or subscriptions should be included or excluded from the scanning process.

Step 3: Managing Network Access and Permissions

The scanner needs the ability to take snapshots of your disks. In most Azure environments, the default service principal for Defender for Cloud already possesses the necessary permissions. However, if you are using custom roles or restricted network environments, you must ensure that the service has "Contributor" or equivalent permissions on the resource groups containing the VMs.

Note: If you are using Azure Private Link or other network security controls, ensure that the Defender for Cloud service is allowed to communicate with your storage accounts. While the scanning happens in a separate environment, it still requires metadata access to your storage resources.

Practical Implementation: A Step-by-Step Guide

Let’s walk through the actual setup process using the Azure portal and, where applicable, the Azure CLI.

Enabling via Azure Portal

1. Navigate to Defender for Cloud: Open the portal and search for "Microsoft Defender for Cloud."
2. Select Environment Settings: In the left-hand menu, click on "Environment settings."
3. Select your Subscription: Click on the subscription you wish to protect.
4. Enable Defender CSPM: Under the "Plans" tab, find "Defender CSPM" and click "Settings & costs."
5. Activate Features: Ensure the checkbox for "Agentless scanning for machines" is selected.
6. Save Changes: Click "Save" to apply the configuration.

Enabling via Azure CLI

For organizations that manage infrastructure as code, using the CLI is the preferred method for ensuring consistency. Use the following command to enable the plan:

# Set the subscription context
az account set --subscription "Your-Subscription-ID"

# Enable the CSPM plan with agentless scanning
az security pricing create \
  --name "CloudPosture" \
  --tier "Standard" \
  --sub-plan "AgentlessScanning"

Explanation: The az security pricing create command configures the security plan for your subscription. By setting the --sub-plan to AgentlessScanning, you specifically enable the disk-snapshotting capability. This command is idempotent, meaning you can run it repeatedly without causing conflicts.

Analyzing Scan Results and Remediation

Once the scan completes, the real work begins. Defender for Cloud aggregates these findings into the "Recommendations" dashboard. You will see items tagged as "Vulnerabilities in virtual machines should be remediated." Clicking on these recommendations will provide a detailed list of CVEs (Common Vulnerabilities and Exposures) found on your disks.

Interpreting the Findings

The findings are typically categorized by severity: Critical, High, Medium, and Low. When you drill into a specific VM, you will see:

• The CVE ID: A link to the vulnerability database.
• The Affected Software: The specific package or application version causing the alert.
• Remediation Steps: Suggested updates or configuration changes.

Tip: Do not try to fix every "Low" severity vulnerability immediately. Focus your efforts on "Critical" and "High" vulnerabilities that have an associated "Exploit Available" flag. This allows you to prioritize the risks that are most likely to be weaponized by attackers.

Automating Remediation

While agentless scanning provides the visibility, it does not automatically patch the machines. You must integrate this with your configuration management tools. For example, if the scan identifies a vulnerable version of OpenSSL on a Linux VM, you should trigger an Azure Automation Runbook or a GitHub Actions workflow to update that package.

# Example: Using Azure CLI to run a command on a VM for remediation
az vm run-command invoke \
  --resource-group MyResourceGroup \
  --name MyVM \
  --command-id RunShellScript \
  --scripts "sudo apt-get update && sudo apt-get install --only-upgrade openssl"

Explanation: This script uses the run-command feature to execute a bash shell script on the remote VM. This is an effective way to remediate vulnerabilities identified by the agentless scan without needing SSH access or manual intervention.

Comparison: Scanning Approaches

The following table provides a quick reference to help you decide when to use agentless scanning versus other methodologies.

Best Practices for Agentless Security

To get the most out of your implementation, follow these established industry standards:

1. Continuous Monitoring: Do not rely on ad-hoc scans. Ensure your environment is configured for the default scanning frequency provided by Defender for Cloud.
2. Least Privilege: Ensure the service principal used for scanning has the minimum permissions required. Avoid using "Owner" roles; use custom roles that only grant "Read" and "Snapshot" access to disk resources.
3. Integrate with SIEM: Export your Defender for Cloud findings to Microsoft Sentinel. This allows you to correlate agentless scan results with network traffic logs and identity signals, providing a holistic view of your threat landscape.
4. Tagging and Scoping: Use Azure tags to categorize your VMs. You can use these tags to exclude development or testing environments from high-frequency scans to save on costs, while ensuring production environments are always covered.
5. Regular Audits: Periodically review the "Data Collection" settings to ensure that no new subscriptions or resource groups have been inadvertently left unprotected.

Common Pitfalls and How to Avoid Them

Even with a robust tool like Defender for Cloud, administrators often encounter common hurdles that can undermine their security posture.

Pitfall 1: Ignoring the "Scan Failed" Alerts

Sometimes, a scan will fail due to locked disks or insufficient permissions. A common mistake is to ignore these alerts, assuming they are transient issues.

• The Fix: Set up an Azure Monitor alert specifically for "Agentless scan failure." When a scan fails, it leaves you blind to potential vulnerabilities on that asset. Treat these failures with the same urgency as a critical security alert.

Pitfall 2: Over-Reliance on Agentless Scanning

Some teams believe that because they have agentless scanning, they no longer need EDR (Endpoint Detection and Response) agents. This is a dangerous misconception.

• The Fix: Remember that agentless scanning cannot see active memory attacks or malicious network connections happening right now. Use agentless for vulnerability posture and EDR for active threat defense. They are complementary, not substitutes.

Pitfall 3: Failing to Include "Shadow" Workloads

Organizations often have VMs created by developers or contractors that are not part of the standard management group or subscription.

• The Fix: Use Azure Policy to enforce the "Defender CSPM" plan across all subscriptions. This ensures that any new VM created is automatically enrolled in the scanning program, regardless of who created it.

Pitfall 4: Cluttered Remediation Backlogs

Trying to fix 5,000 vulnerabilities at once leads to burnout and missed critical items.

• The Fix: Focus on "Risk-Based Prioritization." Use the Defender for Cloud "Security Score" to guide your remediation efforts. The score is calculated based on the impact of the vulnerability, not just the number of findings.

Advanced Scenarios: Handling Ephemeral Workloads

One of the most challenging aspects of modern cloud security is dealing with ephemeral workloads—VMs that exist for only a few hours or days. Traditional agents often fail here because they take time to bootstrap and register. Agentless scanning is uniquely suited for this because it can be triggered as soon as the disk is created.

If you are using Auto-scaling groups, ensure that your scanning policy is configured to capture the disks of these temporary instances. You may need to adjust your scan frequency to be more frequent if your VMs have a very short lifespan. While this increases the number of snapshots created, it ensures that you are not running vulnerable code in production for extended periods.

Callout: The Cost of Snapshots

While agentless scanning is efficient, remember that snapshot creation incurs storage costs in Azure. If you have a massive environment with thousands of VMs being scanned daily, monitor your storage billing. You can optimize costs by excluding non-production environments or reducing the frequency of scans for low-risk workloads.

Integrating with Microsoft Sentinel

Once your agentless scanning is operational, you should not keep the data siloed in the Defender portal. Integrating this data with Microsoft Sentinel (your SIEM) allows you to turn raw vulnerability data into actionable security incidents.

Why Integration Matters

When an agentless scan identifies a critical vulnerability, Sentinel can automatically cross-reference this with your network traffic logs. For example, if a VM is identified as having a critical vulnerability and you simultaneously see it communicating with an unknown external IP address, Sentinel can trigger an automated playbook to isolate that VM from the network.

Steps for Sentinel Integration:

1. Connect Defender for Cloud: In the Sentinel "Data Connectors" page, find the "Microsoft Defender for Cloud" connector.
2. Enable Data Streaming: Ensure that "SecurityRecommendations" and "SecurityAlerts" are being streamed to your Log Analytics workspace.
3. Create Analytics Rules: Build custom queries in KQL (Kusto Query Language) to alert when a new critical vulnerability is detected on a production-tagged machine.

// KQL Query to find critical vulnerabilities
SecurityRecommendation
| where TimeGenerated > ago(24h)
| where RecommendationName contains "vulnerabilities"
| where AssessmentSeverity == "High" or AssessmentSeverity == "Critical"
| project TimeGenerated, ResourceName, RecommendationName, RemediationSteps

Explanation: This query scans the last 24 hours of security recommendations. It filters for high-severity vulnerability alerts and outputs the resource name and the steps required to fix it. This is a perfect example of a query you would use to populate a dashboard in Sentinel.

Security Governance and Compliance

Agentless scanning is a powerful tool for compliance frameworks like CIS Benchmark, NIST, and ISO 27001. Auditors often look for proof that you are continuously assessing your environment for vulnerabilities. By keeping a history of your agentless scan reports, you provide a clear, timestamped audit trail that shows you are identifying and tracking risks.

When preparing for an audit, use the "Compliance" dashboard in Defender for Cloud. It maps your agentless scan findings directly to specific controls within various regulatory frameworks. This saves weeks of manual work, as you can simply export the reports showing that your environment is being scanned and that vulnerabilities are being tracked.

Establishing a Governance Workflow

1. Establish a Baseline: Perform an initial scan to understand your current "Security Score."
2. Set Targets: Define a goal for your security score (e.g., "We will maintain a score above 70%").
3. Monthly Reviews: Hold a monthly meeting to review the top 10 vulnerabilities identified by the agentless scans.
4. Accountability: Assign remediation tasks to specific application owners rather than leaving them as generic "IT tasks."

Summary of Key Takeaways

Implementing agentless VM scanning is a transformative step for any organization looking to secure its cloud environment. By moving away from agent-heavy architectures, you reduce performance overhead and operational complexity while gaining deep, consistent visibility into your infrastructure.

Here are the essential points to remember:

• Agentless is about visibility, not just defense: Use it as your primary tool for vulnerability management and compliance, but keep EDR agents for active, real-time threat hunting.
• Automation is your friend: Leverage Azure Policy and Infrastructure as Code (IaC) to ensure that every new VM is automatically enrolled in your scanning plan.
• Focus on risk, not volume: Utilize the severity ratings and exploit availability flags to prioritize your remediation efforts, focusing on the vulnerabilities that pose the greatest real-world risk.
• Integration is mandatory: Connect your Defender for Cloud data to Microsoft Sentinel to correlate vulnerability data with other security signals, enabling a unified response to threats.
• Governance drives success: Use the compliance dashboards and security scores to track progress over time and demonstrate your security posture to stakeholders and auditors.
• Monitor for failures: Treat "Scan Failed" notifications as critical alerts; if the scan isn't running, you don't have visibility, and you cannot secure what you cannot see.
• Optimize costs: Be mindful of snapshot storage costs by carefully scoping which environments require daily scans versus weekly scans, ensuring you balance security needs with budget constraints.

By adhering to these principles, you will build a resilient and highly visible security posture that scales alongside your cloud environment. Agentless scanning is not just a feature; it is the foundation of a modern, proactive approach to cloud security management.