We are experiencing an issue with the Microsoft Defender for Cloud (ASC Secure Score) not reflecting completed remediation actions.

Hi @Anjana Chipalkatti, since the original answer covers the recalculation timing, here's how to actually pinpoint which resources are pulling the score down when the UI isn't showing them clearly.

1. Don't rely on the top-level percentage — drill into the per-control breakdown. In Defender for Cloud (or the Defender portal), each control (not each recommendation) has its own healthy/unhealthy resource count and refreshes on its own 8-hour cycle, while individual recommendations underneath can update more often. That mismatch is one reason the top-line score and what you see per-recommendation can look out of sync for a while — you have to check controls, not just recommendations, to see where the actual point loss is.

2. Query it directly with Resource Graph — this is the fastest way to see exactly which control(s) lost points, rather than clicking through the UI:

SecurityResources
| where type == 'microsoft.security/securescores/securescorecontrols'
| extend controlName=properties.displayName,
  unhealthyResourceCount=properties.unhealthyResourceCount,
  healthyResourceCount=properties.healthyResourceCount,
  currentScore=properties.score.current,
  maxScore=properties.definition.properties.maxScore
| project controlName, unhealthyResourceCount, healthyResourceCount, currentScore, maxScore
| order by (maxScore - currentScore) desc

Sort that by the biggest gap between max and current score, and you'll see immediately which control is dragging things down, even if the specific recommendation you're eyeballing in the portal looks clean.

3. Check if this is a scope change, not a regression. There was a change on June 30, 2026 where Defender for Cloud expanded Secure Score to include over 200 additional AWS and GCP recommendations as part of the multicloud coverage GA. If you're onboarding AWS/GCP accounts (or Defender already had connectors for them), a chunk of your "new" unhealthy resources could simply be newly-in-scope resources that were never evaluated before — not something that broke. On the Secure Score card in the portal, there's a View updates link that shows a change log, and recommendations added in the last 30 days get a New tag — worth checking there first since it'd explain a drop with no obvious cause on the Azure side.

4. If you want it over time instead of a point-in-time snapshot, set up Continuous Export of Secure Score to a Log Analytics workspace (Environment settings → Continuous export). Once that's flowing you can run a KQL query like summarize UnhealthyResources=dcount(AssessedResourceId) by ControlName, RecommendationDisplayName, SubscriptionId against the exported data, which will show you the trend across the two weeks instead of just today's state — much easier to correlate the drop with a specific date/change.

Between #2 and #3 you should get a definitive answer — #2 tells you which control lost points, and #3 tells you why it might not be a real regression in your environment.

If the recommendation “SQL servers should have vulnerability assessment configured” is already marked as Completed and no affected resources are listed, the Secure Score may not have been recalculated yet.

Defender for Cloud calculates each Secure Score control every 8 hours. Please allow the next calculation cycle and then recheck the Secure Score.

If the score still does not update after the next cycle, review the recommendation and subscription details for any remaining unhealthy resources.

Microsoft Learn: Cloud Secure Score in Microsoft Defender for Cloud.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls?utm_source=chatgpt.com&pivots=defender-portal