Hi @GaryRainbow-1361

Thanks for the detailed writeup, that definitely saves some back-and-forth. Given what you've already tried (confirming Microsoft.Security is registered, poking at the orphaned SecurityResourceProvider artifacts, and re-onboarding through both the portal and CLI), I don't think this is something you can fix from your end anymore.

The fact that your SQL resources still show up under Inventory, but the subscription itself won't render properly (just "1 Azure subscription" with no name) under Environment settings, is the key detail here. If this were a straightforward permissions or registration gap, you likely wouldn't be seeing any resources at all. That mismatch points to a backend metadata/sync issue on Microsoft's side rather than anything misconfigured in your tenant.

One thing worth trying before you escalate: instead of toggling plans from the Environment settings page, assign the built-in Azure Policy definition "Enable Microsoft Defender for Cloud on your subscription" directly at the subscription scope, then run a remediation task against it. That's the documented path for subscriptions Defender for Cloud isn't tracking correctly, and it goes through a different code path than the portal toggle you've already tried.

If that doesn't clear it up, I'd open a support request:

(Azure portal → Help + support → New support request, scoped to Defender for Cloud).

This looks like a case where someone on the engineering side needs to look at your subscription's security resource provider state directly.

You will need to have your subscription ID and the August 24 start date ready, along with a quick note on what you've already tried so they don't just send you back through the same steps. BE concise but include everything so there in no need for back-and-forth communications to get this resolved. I've included some official links below for you as well.

Sources:

• Connect your Azure subscriptions to Defender for Cloud
• User roles and permissions in Defender for Cloud
• Onboard a management group to Defender for Cloud

I hope that gets you unblocked and on to the next thing.

---

Please 'Upvote' (Thumbs-up) and 'Accept' as answer if the response was helpful. This will be benefitting other community members who face the same issue.

Best regards,

Andrew S Taylor

Hi @GaryRainbow-1361 ,

If your Azure subscription is not listed by name in Defender for Cloud’s Environment Settings (showing only "1 Azure subscription"), follow these structured steps to diagnose and resolve the issue. This ensures you can enable Defender plans and configure security policies.

---

1. Verify Resource Provider Registration

Ensure Microsoft.Security is fully registered and in state Registered.

Azure CLI Commands:

Check registration status

az provider show --namespace Microsoft.Security --query "registrationState"

 

Register if not already registered

az provider register --namespace Microsoft.Security

Wait 5–10 minutes after registration before proceeding, as propagation can take time.

---

2. Check Defender Plans Status

Confirm whether Defender plans (e.g., Baseline, Secure Score, Specific Services) are enabled for the subscription.

Azure CLI Commands:

List all enabled Defender plans

az security pricing list --query "[?tier != 'Free']"

 

Check plan status for a specific service (e.g., SqlVulnerabilityAssessment)

az security pricing show --name SqlVulnerabilityAssessment

If plans are not enabled, enable them:

Enable a Defender plan (replace )

az security pricing create --name  --tier Standard

Note: Use Free tier for testing, but Standard is required for full features.

---

3. Clean Up Orphaned Security Resources

If previous onboarding attempts left artifacts, manually remove them.

A. Identify Orphaned Security Resources

Use Azure Resource Explorer or CLI to list security-related resources:

List all security policies (should be empty if orphaned)

az security policy list

If resources exist, delete them:

Delete a specific policy (replace )

az security policy delete --name

B. Remove Security Contact (if applicable)

List security contacts

az security contact show

 

Delete if exists

az security contact delete

---

4. Re-Onboard the Subscription

Option A: Via Azure CLI (Recommended)

Reset onboarding and re-register the subscription:

Reset onboarding status

az security onboarding reset --subscription-id

 

Re-onboard the subscription

az security onboarding show --subscription-id

Option B: Via Azure Portal

Go to Microsoft Defender for Cloud → Environment Settings.

Click + (Add) → Azure Subscription.

Select your subscription and enable All Defender Plans (or select specific plans).

Wait 15–20 minutes for synchronization.

---

5. Validate Subscription Appearance in Defender for Cloud

After re-onboarding:

Refresh the Environment Settings page.

Confirm the subscription name appears (not just "1 Azure subscription").

If still missing:

Clear browser cache or try an incognito window.

Use a different browser (e.g., switch from Chrome to Edge).

---

6. Check Permissions

Ensure your Azure AD user has sufficient permissions on the subscription:

Contributor + Security Admin or Security Manager roles are required.

Verify via Azure CLI:

az role assignment list --scope /subscriptions/

If permissions are missing, assign them via the Azure Portal:

Subscription → Access Control (IAM) → Add Role Assignment.

Assign Contributor and Security Admin to your user/service principal.

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.