Security Recommendation Not Updating After Policy-Based Remediation

Question

PANDUGAYALA Sai K 0

We have remediated the Defender for Cloud recommendation:

"Container images should be deployed from trusted registries only" for the resource of AKS cluster

A regex was configured in the security policy under the Allowed registry or registries regex parameter to allow only our trusted private container registries.
All container images have been verified and updated to use only these trusted registries.
We validated via the Kubernetes cluster and CI/CD pipelines that no images are being pulled from public or untrusted registries.
Azure Policy compliance status reflects full alignment with the policy.

Despite the above, Microsoft Defender for Cloud continues to flag this recommendation as active, and the listed pods are either:

Catherine Kyalo 1,930 Reputation points Microsoft Employee

2025-05-23T06:53:13.3566667+00:00

Hi @PANDUGAYALA Sai K ,

How long has it been since the remediation? From documentation, this can take upto 24 hours. However, we have observed scenarios where these updates have reflected after 72hours.
PANDUGAYALA Sai K 0 Reputation points

2025-05-23T06:55:42.82+00:00

It's been more than 10 days last sprint we did
Catherine Kyalo 1,930 Reputation points Microsoft Employee

2025-05-23T07:05:49.8833333+00:00
Hi ,

I found a case similar to this - https://learn.microsoft.com/en-us/answers/questions/925457/container-images-should-be-deployed-from-trusted-r.

Some people found it helpful so please check whether the shared solution

"My problem was finally solved in all honesty by adding in the regex "|busybox" (from an init container) and waiting enough time for this modification to be taken into account."

If none of this works, raising a support ticket is the recommended route. To Raise a support Ticket:

Go to the Azure Portal.

Click on the Help + support option in the left-hand menu.

Select New support request.

Follow the prompts to create a support ticket explaining your issue.

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request

Your answer

Catherine Kyalo 1,930 Reputation points Microsoft Employee

2025-05-23T06:53:13.3566667+00:00

Hi @PANDUGAYALA Sai K ,

How long has it been since the remediation? From documentation, this can take upto 24 hours. However, we have observed scenarios where these updates have reflected after 72hours.
PANDUGAYALA Sai K 0 Reputation points

2025-05-23T06:55:42.82+00:00

It's been more than 10 days last sprint we did
Catherine Kyalo 1,930 Reputation points Microsoft Employee

2025-05-23T07:05:49.8833333+00:00

Hi ,

I found a case similar to this - https://learn.microsoft.com/en-us/answers/questions/925457/container-images-should-be-deployed-from-trusted-r.

Some people found it helpful so please check whether the shared solution

"My problem was finally solved in all honesty by adding in the regex "|busybox" (from an init container) and waiting enough time for this modification to be taken into account."

If none of this works, raising a support ticket is the recommended route. To Raise a support Ticket:

Go to the Azure Portal.

Click on the Help + support option in the left-hand menu.

Select New support request.

Follow the prompts to create a support ticket explaining your issue.

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request