Azure VM Alerts

Hello Christopher Johnson

Thank you for reaching out to Microsoft Q&A.

The alert you’re seeing is likely coming from Microsoft Defender for Cloud

and it indicates that your VM has one or more vulnerabilities that could be exploited remotely.

This usually means:

• The VM is exposed to the internet (public IP assigned and NSG rules allow inbound traffic).
• Missing critical security patches or misconfigured services (e.g., RDP/SSH open to all).
• Possibly weak credentials or unencrypted protocols.

Below are the steps to identify the cause: -

1.) Go to Microsoft Defender for Cloud → Recommendations.

Look for items: -

Apply system updates

• Restrict public network access (Remove or restrict public IP access (use private endpoints or VPN).
• Install endpoint protection

Enable Just-In-Time VM access

If JIT is not enabled, Defender will consider RDP/SSH open

Go to: -

Defender for Cloud → Workload protections → JIT VM access

If your VM shows Not configured, that is one root cause.

2.) Verify Network Exposure:

Check the Network Security Group (NSG) rules for the VM.

If RDP (3389) or SSH (22) is open to Any source, this is a major risk.

3.) Run Vulnerability Assessment:

Enable Defender for Servers and run a vulnerability scan.

It will list missing patches and insecure configurations.

Microsoft docs for your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference

Microsoft docs for your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/tutorial-protect-resources

Microsoft docs for your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path

Microsoft docs for your reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/internet-exposure-analysis

Please let us know if the above steps help you