I Have deleted a VM and its associated RG and infrastructures yet, I keep receiving vulnerability alerts!

Hi

How long has it been exactly since decommission?

https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-overview

Why it happens: The system may still have metadata about the VM until the next full evaluation run.

1. What you can do:
   • Confirm the VM is fully removed from your subscription (including disks, NICs, and resource group if applicable).
   • If recommendations persist beyond a week, check if there are associated resources (e.g., unattached disks or NICs) that trigger them.
   • You can also manually trigger an Advisor refresh in the portal.

Refer to similar scenarios - https://learn.microsoft.com/en-us/answers/questions/2280554/resolving-edr-configuration-issues-for-deleted-vir

Azure Advisor: https://learn.microsoft.com/en-us/azure/advisor/advisor-get-started

Exemption: -https://learn.microsoft.com/en-us/azure/defender-for-cloud/exempt-resource