How Defender EASM found open port 500 on my IP address, and using Nmap scanner I didn't find that the port is open?

Question

How Defender EASM found open port 500 on my IP address, and using Nmap scanner I didn't find that the port is open?

FP 0

I'm using defender currently on a 30 day trial, I'm wondering how Defender EASM managed to find open port 500. I've used Nmap scanner with different switches and tried to scan port 500 directly but I got no result that the port is open. Now I don't know if port is really open or not. Can you explain to me how Defender EASM was able to find an open port?

Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2023-07-18T07:41:25.45+00:00

@FP Apologies for the delayed response, As I understand you want to investigate/find how EASM found port 500 on your ip address.

Let me research on your issue and revert back, in the mean time can you share the screenshot which shows this information, if the screenshot contains any personal info, feel free to drop an email on azcommunity [at] microsoft [dot] com referencing this issue with a subject line "ATTN:Givary" as it would help to investigate further.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2023-07-20T02:54:55.3+00:00

@FP Just wanted to check if you can share more details regarding this issue (screenshot from EASM portal), which host/page/IP address did EASM identify as having an open port 500?

Let me know if you have any further questions, feel free to post back.
Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator

2023-08-01T09:52:33.88+00:00

@FP Just checking in to see if you can provide more information that help us to investigate this further, If you have any further updates on this issue, please feel free to post back.