Vulnerability assessment / Missing findings for images running on AKS clusters

Mat Thomas 6 Reputation points
2026-08-17T18:55:27.88+00:00

Running-container vulnerability assessment stopped producing findings for all of our AKS clusters between the afternoon of Wednesday 08/12 and Thursday 08/13. Registry (container image) vulnerability assessment continues to work normally, but the running-container recommendation is no longer generated at all — it returns zero results both by assessment ID and by recommendation title, and the "Container" resource type has disappeared as a filter option in Recommendations → Vulnerabilities (only "Container Image" remains).

We have methodically validated every customer-side prerequisite (plan, extensions, Trusted Access binding, sensor health, node configuration) against the correct subscription that hosts the cluster, and all are healthy. This appears to be a service-side correlation / recommendation-generation failure, likely related to the recent grouped-to-individual recommendation transition and associated schema/assessment re-keying.

# Check Result
1 Query permissions (ARG securityresources) ✅ Not a permissions issue — base query returns 7,000+ assessments for our user
2 az security pricing show --name Containers (sub ef62f782) ✅ Tier = Standard; all extensions isEnabled: True (see §5)
3 Defender sensor pod health (kubectl get pods -n kube-system -l app=defender) ✅ All pods Running (2/2 and 1/1), 0 restarts
4 Toggled Kubernetes API access off/on to re-provision agentless discovery ✅ Completed; no change after 24h
5 Enabled Defender CSPM plan ✅ Completed; no change
6 AKS Trusted Access role binding (az aks trustedaccess rolebinding list) ✅ defender-containers = Succeeded → DefenderForContainersSecurityOperator (see §6)
7 Node pool OS / disk type ✅ Linux / Managed disks — no ephemeral-disk or Windows-node limitation
8 Registry (Container Image) VA ✅ Working — confirms scanner/MDVM pipeline healthy
9 Running-container assessment by ID c609cf0f-… (ARG) ❌ Zero results
10 Running-container recommendation by title (portal) ❌ Zero results / not present
11 Azure Policy add-on (addonProfiles.azurepolicy.enabled) ⚠️ false — being enabled separately; not a VA dependency

We are requesting investigation of why the running-container vulnerability assessment is not being generated for our clusters despite a fully valid configuration.We'd be happy to share specific environment details privately with a support engineer.

Thanks,
Mat

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.