Defender recommendation issue

Davit Grigoryan 16

In Defender for cloud, I'm getting Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost recommendations, but in my Azure VM EncryptionAtHost enabled already, I have checked connection between VM and Azure monitor and also checked Heartbeat from azure monitor to agent and receive result from agent and vice versa. Why I'm receiving recommendation If encryption is in place.
User's image

User's image

Givary-MSFT 33,476 Reputation points Microsoft Employee

2024-09-17T05:44:09.18+00:00

@Davit Grigoryan Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Davit Grigoryan 16 Reputation points

2024-09-17T05:52:23.3+00:00

In process of transition to AMA, will update here accordingly, thank you.
Per Bendixen - Bixsoft 0 Reputation points

2024-11-04T12:26:49.83+00:00

@Davit Grigoryan Did you get the correct result in Defender after you got to AMA?
I have the same recommendation in Defender for some of my VM's but EncryptionAtHost is enabled and we are using AMA
It seems like an issue where over time, more and more VM is suddenly appearing on the list with missing Encryption enabled
Per Bendixen - Bixsoft 0 Reputation points

2024-11-04T12:30:44.3633333+00:00

@Davit Grigoryan Did you get the correct result in Defender after you got to AMA? I have the same recommendation in Defender for some of my VM's but EncryptionAtHostVM's is enabled and we are on AMA It seems like an issue where over time, more and more VM is suddenly appearing on the list with missing Encryption enabled
Khushi Joshi 21 Reputation points

2024-11-12T06:28:18.95+00:00

I’m experiencing the same issue across approximately 44 VMs. Previously, we hadn’t enabled Encryption at host, and even after activating it, the VMs are still showing an unhealthy status. Additionally, I noticed something unusual: although the refresh interval is set to 30 minutes, the last updated timestamp shows a date from several days ago and hasn’t changed since.

1 answer

Deepanshukatara-6769 10,765 Reputation points

2024-09-12T06:45:52.19+00:00
Hello Davit, Welcome to MS Q&A

It seems that you have already enabled EncryptionAtHost (HBE) on your Azure VM. However, you are still receiving recommendations to enable Azure Disk Encryption (ADE) or EncryptionAtHost. Let's delve into the possible reasons for this recommendation.

It's important to note that enabling both ADE and HBE at the same time on a VM is not supported. Additionally, customers should not enable HBE on a VM which previously used ADE at some point. This could be a reason why you are still receiving the recommendation despite having HBE enabled on your VM.

Another aspect to consider is the compliance requirements for ADE. For Windows VMs, the OS disk and all data disks should be encrypted, with the exception of the 'System Reserved partition' and the "BEK volume" created by ADE extension. For Linux VMs, similar encryption requirements apply, with exemptions for certain disks and file system types not supported by the ADE extension.

To further troubleshoot this issue, you can check if any disk on the VM is missing ADE encryption. For Windows, you can run the command "manage -bde --status" from an elevated command prompt or PowerShell window. For Linux, you can run the command "lsblk" from an elevated user prompt to verify the encryption status of the disks.

For further details and specific commands to check the encryption status, you can refer to the Microsoft Defender for Cloud Encryption recommendation troubleshooting guide.

For more detailed instructions, you can view solution:

Microsoft Defender for Cloud encryption recommendation

Please let us know if further questions

Kindly accept answer if it helps

Thanks

Deepanshu
Please sign in to rate this answer.
Davit Grigoryan 16 Reputation points

2024-09-12T11:07:23.85+00:00

Thank you for your reply,
We don't have attached data or any disk on VM ,only Temp disk, which have to be encrypted with HBE.
There is another part ,that I doubt ,It is configuration of defender environments, in attached you can see that .Is there possibility that there's conflict in collecting data for defender and scan is out of date?

Deepanshukatara-6769 10,765 Reputation points

2024-09-13T07:19:21.28+00:00

I think If the Log Analytics Agent is outdated and other critical scanning or monitoring tools are turned off (such as Vulnerability Assessment and Agentless Scanning), this could lead to incomplete or out-of-date security data being reported to Defender. Without updated information from these components, Microsoft Defender may not be performing scans accurately or in a timely manner.

Davit Grigoryan 16 Reputation points

2024-09-13T09:41:03.47+00:00

All tools are enabled, but still facing the outdate findings and recommendations from defender for cloud

Deepanshukatara-6769 10,765 Reputation points

2024-09-16T06:18:21.06+00:00

This could be due to a few factors, as outlined below:

The recommendations may not be refreshed, as they typically refresh every 12 hours.

Microsoft Defender for Cloud may not have received the new data from the Operations Management Suite (OMS) agent in the VM.

It's also important to check the recommendation status in the Azure Policy compliance center to validate if the resource is compliant. This can be done by following the steps outlined in the Azure portal. It's important to note that some updates may require a restart for the issues to be fully remediated, and in some cases, the findings aren't updated after installing a patch. This could be due to the patch not setting the registry value automatically, which may still result in identified vulnerabilities. In summary, to address the issue of outdated findings and recommendations in Microsoft Defender for Cloud, it's crucial to ensure that recommendations are refreshed, data is received from the OMS agent, and compliance is validated through the Azure Policy compliance center.

For more detailed instructions, you can view solutions:

Auditing and logging recommendations

Server recommendations for Microsoft Defender for Cloud

Davit Grigoryan 16 Reputation points

2024-09-16T07:19:21.14+00:00

Thank you for your reply.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Defender recommendation issue

1 answer

Your answer