Vulnerability assessment / Missing findings for images running on AKS clusters

Mat Thomas 6 Reputation points
2026-08-17T18:55:27.88+00:00

Running-container vulnerability assessment stopped producing findings for all of our AKS clusters between the afternoon of Wednesday 08/12 and Thursday 08/13. Registry (container image) vulnerability assessment continues to work normally, but the running-container recommendation is no longer generated at all — it returns zero results both by assessment ID and by recommendation title, and the "Container" resource type has disappeared as a filter option in Recommendations → Vulnerabilities (only "Container Image" remains).

We have methodically validated every customer-side prerequisite (plan, extensions, Trusted Access binding, sensor health, node configuration) against the correct subscription that hosts the cluster, and all are healthy. This appears to be a service-side correlation / recommendation-generation failure, likely related to the recent grouped-to-individual recommendation transition and associated schema/assessment re-keying.

# Check Result
1 Query permissions (ARG securityresources) ✅ Not a permissions issue — base query returns 7,000+ assessments for our user
2 az security pricing show --name Containers (sub ef62f782) ✅ Tier = Standard; all extensions isEnabled: True (see §5)
3 Defender sensor pod health (kubectl get pods -n kube-system -l app=defender) ✅ All pods Running (2/2 and 1/1), 0 restarts
4 Toggled Kubernetes API access off/on to re-provision agentless discovery ✅ Completed; no change after 24h
5 Enabled Defender CSPM plan ✅ Completed; no change
6 AKS Trusted Access role binding (az aks trustedaccess rolebinding list) ✅ defender-containers = Succeeded → DefenderForContainersSecurityOperator (see §6)
7 Node pool OS / disk type ✅ Linux / Managed disks — no ephemeral-disk or Windows-node limitation
8 Registry (Container Image) VA ✅ Working — confirms scanner/MDVM pipeline healthy
9 Running-container assessment by ID c609cf0f-… (ARG) ❌ Zero results
10 Running-container recommendation by title (portal) ❌ Zero results / not present
11 Azure Policy add-on (addonProfiles.azurepolicy.enabled) ⚠️ false — being enabled separately; not a VA dependency

We are requesting investigation of why the running-container vulnerability assessment is not being generated for our clusters despite a fully valid configuration.We'd be happy to share specific environment details privately with a support engineer.

Thanks,
Mat

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Konstantinos Lianos 830 Reputation points Student Ambassador
    2026-09-15T09:15:01.7433333+00:00

    Hello @Mat Thomas

    This appears closely related to the recent Defender for Cloud recommendation model change, but one part of the troubleshooting should be adjusted.

    The assessment ID c609cf0f-71ab-41e9-a3c6-9a1f7fe1b8d5 for “Azure running container images should have vulnerabilities resolved” is now deprecated. Microsoft completed the transition from grouped to individual recommendations on July 31, 2026. Running-container vulnerabilities are now surfaced as individual Microsoft.Security/assessments findings under the SoftwareUpdate recommendation category.

    So, getting zero results when querying the old c609cf0f-... assessment ID after this transition doesn't necessarily indicate that runtime vulnerability assessment has stopped.

    However, the disappearance of the Container resource type is more concerning. Microsoft's current documentation still states that running-container findings should be visible under Recommendations > Vulnerabilities > Flat list with Resource type = Container.

    Your configuration also appears to meet the documented runtime requirements: Registry access plus either Kubernetes API access or the Defender sensor is sufficient for correlating registry vulnerabilities with running workloads. Azure Policy isn't a prerequisite for this functionality.

    I would therefore first validate the new individual assessments using microsoft.security/assessments and properties.metadata.recommendationCategory == "SoftwareUpdate" rather than the deprecated assessment ID.

    If no container-related individual assessments are generated there either, despite known vulnerable images actively running in the clusters, then I agree this should be escalated to Microsoft Defender for Cloud support as a possible runtime inventory/correlation issue following the recommendation transition.

    If this answer helps, please mark it as Answered.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.