MDC Vulnerability Assessment Findings Workbook Not Displaying Vulnerabilities While Findings Are Visible Under VM Recommendations

Question

MDC Vulnerability Assessment Findings Workbook Not Displaying Vulnerabilities While Findings Are Visible Under VM Recommendations

Ekta Jitendra Singh 0

Hello,

We are facing an issue in Microsoft Defender for Cloud (MDC) regarding the "Vulnerability Assessment Findings" workbook.

The workbook is not displaying any vulnerability findings and appears to be empty. However, when we navigate to a specific machine in MDC and review the Recommendations section, we can see active vulnerability findings associated with that machine.

Environment:

Microsoft Defender for Cloud (MDC)
Vulnerability assessment findings are visible under individual machine recommendations.
The same findings are not being reflected in the Vulnerability Assessment Findings workbook.
We have verified that the affected machine is reporting vulnerabilities correctly through the recommendation view.

Questions:

What could cause vulnerabilities to be visible under machine recommendations but not appear in the Vulnerability Assessment Findings workbook?
Does the workbook rely on specific Log Analytics tables, data connectors, or data collection configurations that should be verified?
Are there any known issues, synchronization delays, RBAC permissions, or filtering conditions that could result in the workbook showing no data?
Is there a recommended troubleshooting approach to validate whether the workbook query is retrieving the expected vulnerability assessment data?

Any insights or guidance would be greatly appreciated.

Thank you.

0 comments

1 answer

Your answer

Answer 1

Hello @Ekta Jitendra Singh

This is most likely a reporting/query issue rather than a vulnerability-scanning issue, since the findings are already visible under the VM recommendations.

The Vulnerability Assessment Findings workbook does not normally depend on a Sentinel connector or Log Analytics ingestion. Microsoft states that most Defender for Cloud workbooks query Azure Resource Graph, and the VA workbook aggregates Defender for Cloud vulnerability findings.

One important recent change is that Microsoft completed the migration from grouped vulnerability recommendations/subassessments to individual recommendations on July 31, 2026. Machine vulnerabilities are now returned as microsoft.security/assessments with recommendation category SoftwareUpdate, rather than through the old grouped/subassessment model.

You can validate the underlying data directly in Azure Resource Graph with:


securityresources

| where type == "microsoft.security/assessments"

| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"

| where properties.metadata.recommendationCategory == "SoftwareUpdate"

Microsoft currently documents this as the supported query for VM vulnerability findings.

If this returns the expected vulnerabilities but the workbook remains empty, check whether you're using an older saved/customized workbook that still references the deprecated subassessment schema. If you're using the latest built-in gallery workbook and it is still empty while ARG returns data, I would raise this with Microsoft Defender for Cloud support as a workbook/template synchronization issue.

If this answer helps, please mark it as Answered.