Fix MSFT Defender Vuln Info - STALE & OUTDATED

Question

Fix MSFT Defender Vuln Info - STALE & OUTDATED

Michael O'Hara 0

Just found out that the reporting of the 1900 device vulns in MSFT DEF is grossly wrong.

There are a ton of vulns that are very, very clearly stale. This would have an adverse impact on SecureScore - and that is a huge problem as that's a core Security KPI.

Will anyone from MSFT Support address this or am I at the mercy of the forum? :-)

Michael O'Hara 0 Reputation points

2026-03-10T23:03:54.41+00:00

Seriously - the "answer" was to start going through all the vulns? One by one????

That is so not an answer. I am looking for MSFT guidance from a HUMAN :-)
Catherine Kyalo 3,085 Reputation points Microsoft Employee

2026-03-16T11:04:32.2966667+00:00
Hi Michael O'Hara,

According to Microsoft, Defender for Endpoint continuously analyzes endpoint data, and "vulnerability assessments are refreshed continuously and automatically using Microsoft threat intelligence" this means updates can occur without waiting for a full device scan, although local scans do contribute additional context.

Reference: -https://learn.microsoft.com/en-us/answers/questions/5447802/vulnerability-update-frequency

If none of this works, raising a support ticket is the recommended route. To Raise a support Ticket:

Go to the Azure Portal.

Click on the Help + support option in the left-hand menu.

Select New support request.

Follow the prompts to create a support ticket explaining your issue.

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request
Shubham Sharma 12,765 Reputation points Microsoft External Staff Moderator

2026-03-20T06:25:55.1266667+00:00

Michael O'Hara

Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Michael O'Hara 0 Reputation points

2026-03-20T11:38:30.93+00:00

This "response" is not helpful. I have already tried to open a case - and the BYZANTINE "support process" feeds me back to only one outcome - I never get the speak with a human. All I get is a link.
Shubham Sharma 12,765 Reputation points Microsoft External Staff Moderator

2026-03-25T03:53:18.2066667+00:00

Michael O'Hara

Following up to check if the resolution provided was helpful. Please let us know if you need any further assistance.

2 answers

Your answer

Michael O'Hara 0 Reputation points

2026-03-10T23:03:54.41+00:00

Seriously - the "answer" was to start going through all the vulns? One by one????

That is so not an answer. I am looking for MSFT guidance from a HUMAN :-)
Catherine Kyalo 3,085 Reputation points Microsoft Employee

2026-03-16T11:04:32.2966667+00:00

Hi Michael O'Hara,

According to Microsoft, Defender for Endpoint continuously analyzes endpoint data, and "vulnerability assessments are refreshed continuously and automatically using Microsoft threat intelligence" this means updates can occur without waiting for a full device scan, although local scans do contribute additional context.

Reference: -https://learn.microsoft.com/en-us/answers/questions/5447802/vulnerability-update-frequency

If none of this works, raising a support ticket is the recommended route. To Raise a support Ticket:

Go to the Azure Portal.

Click on the Help + support option in the left-hand menu.

Select New support request.

Follow the prompts to create a support ticket explaining your issue.

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request
Shubham Sharma 12,765 Reputation points Microsoft External Staff Moderator

2026-03-20T06:25:55.1266667+00:00

Michael O'Hara

Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Michael O'Hara 0 Reputation points

2026-03-20T11:38:30.93+00:00

This "response" is not helpful. I have already tried to open a case - and the BYZANTINE "support process" feeds me back to only one outcome - I never get the speak with a human. All I get is a link.
Shubham Sharma 12,765 Reputation points Microsoft External Staff Moderator

2026-03-25T03:53:18.2066667+00:00

Michael O'Hara

Following up to check if the resolution provided was helpful. Please let us know if you need any further assistance.

Answer 1

Michael O'Hara 0

We'll try steps recommended by Shubham - will close this for now.

Shubham Sharma 12,765 Reputation points Microsoft External Staff Moderator

2026-03-30T10:16:27.57+00:00

Michael O'Hara

Thank you for the confirmation.

Answer 2

Hello Michael O'Hara

Thank you for reaching out to Microsoft Q&A.

Here’s some guidance on how Defender pulls in and updates those findings, plus a few things you can try to clean up the noise:

Verify your vulnerability pipeline • Make sure the Microsoft Defender for Endpoint extensions (MDE.Windows or MDE.Linux) are installed and healthy on all your machines. Defender for Cloud relies on those agents to surface vulnerability data. • Go into the Azure portal → your VM → Extensions, confirm the MDE agent is running without errors. • In Defender for Cloud, open the "Machines should have a vulnerability assessment solution" recommendation—your VMs should show up under “Healthy.”
Force a fresh scan • By default, Defender Vulnerability Management re-scans every 4 hours, but you can trigger an on-demand scan from the MDE portal to grab the latest patch/CVE status. This often clears out findings that linger past the fix date.
Bulk-dismiss or suppress known-good findings • If you have a batch of CVEs that truly aren’t applicable—even though Defender still flags them—you can use the Defender Vulnerability Management dashboard or API to “dismiss” or “suppress” those findings in bulk. That way they won’t impact your Secure Score. • Look for the “Vulnerability exceptions” feature in the MDE portal: you can create exception rules by CVE, package, or tag and have them automatically excluded.
Validate update catalogs and definitions • Check that your machines are pulling in the latest Windows or Linux update catalogs. Sometimes a missed software repository or WSUS sync issue can leave old CVEs in play.

Reference docs:

• Monitor vulnerabilities using Defender Vulnerability Management https://docs.microsoft.com/azure/defender-for-cloud/deploy-vulnerability-assessment-tvm

• Integrate Defender for Cloud with Defender for Endpoint https://docs.microsoft.com/azure/defender-for-cloud/integration-defender-for-endpoint

• What is Defender Vulnerability Management? https://docs.microsoft.com/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt

Let us know if the above steps help

Thanks

Share via

Fix MSFT Defender Vuln Info - STALE & OUTDATED

2 answers

Your answer