Defender for Cloud inventory missing resources

Question

We have a number of subscriptions that are configured to use the Foundational CSPM for Defender for Cloud. We also have a couple subscriptions that are using the Defender CSPM.

Recently I have noticed that some resources are missing from the inventory listing on the Foundational CSPM subscriptions. For example, on one subscription all of the key vaults are listed in the inventory but there are no storage accounts listed (even though the subscription does have storage accounts). On another subscription, that is also using Foundational CSPM, the inventory lists all the resources I expect. I am owner on both of these subscriptions.

• Is there a reason why I have only partial coverage on some subscriptions but full coverage on others?
• Is there a way to increase the coverage?

Thank you!

Answer 1

@Shane Corgatelli Thank you for reaching out to us, As I understand you are trying to investigate some resources are missing from the inventory in one subscription all of the key vaults are listed in the inventory but there are no storage accounts listed.

Would suggest to check for this setting within Key vault/Microsoft Defender for Cloud

If the Key Vault plan is listed as "partial" for a specific Key Vault resource, even though the plan is enabled at the subscription level, check the status of the Defender CSPM plan. If it is free, it is expected behavior. Partial usually occurs when one plan is standard and another is free.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management

Let me know if this answers your query, feel free to post back.

Answer 2

Thank you!

I did not change anything but now all resources are showing up in Defender for Cloud inventory.