Defender for Cloud indicates false an unhealthy resource

Question

After switching Microsoft Defender for Cloud to Express configuration, one of the resources in my subscription is persistently flagged as unhealthy. However, when I drill into the resource in the Defender portal:

• The Findings tab is empty, showing no specific issues.

I have attempted to re-scan the subscription, but the unhealthy status persists.

This appears to be a false positive or stale health state issue. How can this be fixed?

Screenshot 2025-06-07 124354.png

Screenshot 2025-06-07 124509.png

Answer 1

Hello Renato Marteleto,

I believe you have checked with our team and configured the disabled rules to address the issue. You can see the same information in the following document: Disable specific findings from Microsoft Defender for Cloud (preview).

If you have an organizational need to ignore a finding rather than remediate it, you can disable the finding. Disabled findings don't impact your secure score or generate unwanted noise. You can see the disabled finding in the "Not applicable" section of the scan results.

When a finding matches the criteria, you've defined in your disabled rules, it won't appear in the list of findings. Typical scenarios might include:

• Disable findings with medium or lower severity
• Disable findings that are non-patchable
• Disable findings from benchmarks that aren't of interest for a defined scope.

The above document will show you how to find or edit the disabled rules this can help you what kind of findings are already disabled. I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".

Answer 2

Hello Renato Marteleto,

Thanks for your question.

Sometimes these state issues resolve naturally within 24-48 hours. However you can try the following:

• You can possible re-scan again and wait for 24-48 hours
• You can also check that the Microsoft.Security resource provider is registered in subscription > Resource Providers.

See: https://learn.microsoft.com/en-us/azure/defender-for-cloud/troubleshoot-vulnerability-findings

I will recommend that if the issue persists beyond 48 hours with no findings visible, this warrants a support ticket with Microsoft. You can contact support here:

https://azure.microsoft.com/en-us/support/create-ticket

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola