Defender: Subscription Onboarding Issue — Subscription Not Listed Under Environment Settings

Question

Problem description

I am experiencing an issue where my subscription does not appear correctly in Microsoft Defender for Cloud's environment settings. The portal displays only "1 Azure subscription" without specifying its name, which prevents me from enabling or configuring Defender plans for that subscription. Despite this, SQL resources from the subscription are visible under Inventory. This problem first occurred on August 24, 2026.

Environment

Microsoft Defender for Cloud, affected subscription, region not specified in the case information.

What I've already tried

I have verified that Microsoft.Security is registered. I attempted to remove orphaned SecurityResourceProvider artifacts using Azure Resource Explorer and Azure CLI, but encountered issues with resource listing and deletion commands. I also tried to re-onboard the subscription by enabling or re-enabling Defender plans through the Azure Portal and Azure CLI, but the subscription remains absent from the environment settings.

Current status

I am seeking guidance on how to resolve the onboarding issue and ensure my subscription appears correctly in Defender for Cloud environment settings, allowing me to configure Defender plans properly.

Answer 1

Hi @GaryRainbow-1361 ,

If your Azure subscription is not listed by name in Defender for Cloud’s Environment Settings (showing only "1 Azure subscription"), follow these structured steps to diagnose and resolve the issue. This ensures you can enable Defender plans and configure security policies.

---

1. Verify Resource Provider Registration

Ensure Microsoft.Security is fully registered and in state Registered.

Azure CLI Commands:

Check registration status

az provider show --namespace Microsoft.Security --query "registrationState"

 

Register if not already registered

az provider register --namespace Microsoft.Security

Wait 5–10 minutes after registration before proceeding, as propagation can take time.

---

2. Check Defender Plans Status

Confirm whether Defender plans (e.g., Baseline, Secure Score, Specific Services) are enabled for the subscription.

Azure CLI Commands:

List all enabled Defender plans

az security pricing list --query "[?tier != 'Free']"

 

Check plan status for a specific service (e.g., SqlVulnerabilityAssessment)

az security pricing show --name SqlVulnerabilityAssessment

If plans are not enabled, enable them:

Enable a Defender plan (replace )

az security pricing create --name  --tier Standard

Note: Use Free tier for testing, but Standard is required for full features.

---

3. Clean Up Orphaned Security Resources

If previous onboarding attempts left artifacts, manually remove them.

A. Identify Orphaned Security Resources

Use Azure Resource Explorer or CLI to list security-related resources:

List all security policies (should be empty if orphaned)

az security policy list

If resources exist, delete them:

Delete a specific policy (replace )

az security policy delete --name

B. Remove Security Contact (if applicable)

List security contacts

az security contact show

 

Delete if exists

az security contact delete

---

4. Re-Onboard the Subscription

Option A: Via Azure CLI (Recommended)

Reset onboarding and re-register the subscription:

Reset onboarding status

az security onboarding reset --subscription-id

 

Re-onboard the subscription

az security onboarding show --subscription-id

Option B: Via Azure Portal

Go to Microsoft Defender for Cloud → Environment Settings.

Click + (Add) → Azure Subscription.

Select your subscription and enable All Defender Plans (or select specific plans).

Wait 15–20 minutes for synchronization.

---

5. Validate Subscription Appearance in Defender for Cloud

After re-onboarding:

Refresh the Environment Settings page.

Confirm the subscription name appears (not just "1 Azure subscription").

If still missing:

Clear browser cache or try an incognito window.

Use a different browser (e.g., switch from Chrome to Edge).

---

6. Check Permissions

Ensure your Azure AD user has sufficient permissions on the subscription:

Contributor + Security Admin or Security Manager roles are required.

Verify via Azure CLI:

az role assignment list --scope /subscriptions/

If permissions are missing, assign them via the Azure Portal:

Subscription → Access Control (IAM) → Add Role Assignment.

Assign Contributor and Security Admin to your user/service principal.

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.