Why is Defender displaying Azure internal DNS name instead of VM name?

Question

Hello,

I am currently learning and testing Microsoft Defender for Endpoint on an Azure Linux VM. I’ve installed Defender for Endpoint on a Linux VM in Azure. However, in the Defender portal, the device is showing up with an internal Azure DNS name instead of the actual VM name.

After noticing this, I changed the hostname of the Linux VM to linux-defender using the command:

sudo hostnamectl set-hostname linux-defender

Then, I reinstalled Defender and onboarded it again using the onboarding file.

However, now I see two devices listed in Defender:

The old device with the internal DNS name.

The new device with the updated hostname.

I’m not sure if this is the expected behavior, but I believe it may cause some issues when it comes to managing devices overall, since Defender initially took the DNS name as the device name — even the domain was showing the same.

After changing the hostname, the domain is now showing as WORKGROUP.

Can anyone help me understand why this is happening and how to clean up or fix the duplicate entries in Defender?

Thanks for your help!