Microsoft Defender for Cloud: Persistent Server Update Recommendation Despite Fully Patched Windows Server 2025

Question

Problem description

I am experiencing an issue where Microsoft Defender for Cloud continues to show a server update recommendation for Windows Server 2025 machines, even though Windows Update and Azure Update Manager both indicate that the systems are fully up to date. The recommendation persists on multiple servers, and inside the VM, Windows Update reports no pending updates, with the machine fully patched.

Environment

Microsoft Defender for Cloud; Azure virtual machines running Windows Server 2025; Azure Update Manager; affected servers in the same environment.

What I've already tried

I verified the update status inside the VM using Windows Update, which shows the machine as fully updated. I also checked Azure Update Manager, which indicates the VM is current. Additionally, I examined the Defender for Cloud recommendation and confirmed there are no exemptions or suppressions applied. I monitored the VM over three days, and the update status remained current in Windows and Azure Update Manager, yet the Defender recommendation persists.

Current status

The recommendation to update Windows Server 2025 still appears in Defender for Cloud despite all systems showing the latest updates. I am seeking guidance on how to resolve this discrepancy and clear the persistent recommendation.

Answer 1

Defender for Cloud has more than one "update" recommendation, and each uses a different data source. When Windows Update and Azure Update Manager both say "up to date" but Defender doesn't, the recommendation usually comes from a source other than the one you checked. First, identify which one you're looking at.

1. Identify the recommendation by its exact name

Recommendation	Data source	What to check
System updates should be installed on your machines (powered by Azure Update Manager)	Azure Update Manager assessment	Step 2
System updates should be installed on your machines (without the suffix)	Legacy Log Analytics agent (MMA), deprecated	Step 3
Machines should have vulnerability findings resolved, or a security recommendation like Update Microsoft Windows Server 2025	Defender Vulnerability Management (MDE sensor)	Step 4

2. Azure Update Manager–based recommendation: check what AUM actually reports

Run this in Azure Resource Graph Explorer, replacing the VM name:

patchassessmentresources
| where type =~ "microsoft.compute/virtualmachines/patchassessmentresults/softwarepatches"
| where id contains "/virtualMachines/<vm-name>/"
| project patch = tostring(properties.patchName), kb = tostring(properties.kbId),
          classification = tostring(properties.classifications), state = tostring(properties.patchInstallationState)

• Rows returned → AUM still sees missing patches that the Update Manager overview may hide behind its classification filter (e.g. Definition or Other updates). Install them or trigger Check for updates.
• No rows, but the recommendation persists → make sure periodic assessment is enabled (the companion recommendation Machines should be configured to periodically check for missing system updates should be healthy). Then run Check for updates once. Defender re-evaluates on its own cycle, so allow up to 24 hours after a clean assessment.

3. Legacy recommendation (no "powered by Azure Update Manager" suffix)

This one relies on the deprecated MMA / Log Analytics pipeline, so results can go stale or never clear once the agent is gone. Enable the AUM-based recommendation through periodic assessment and work from that one instead.

4. Defender Vulnerability Management recommendation

In the Defender portal: Vulnerability management → Recommendations, open the Windows Server 2025 entry, then Exposed devices and the KB / "missing updates" list. On the VM, check whether that exact KB is installed:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Common reasons for a mismatch:

• The flagged KB is an optional or out-of-band update, or a .NET / SSU update that your update source (WSUS or a policy with deferrals) hasn't offered.
• The machine uses Hotpatch, where security fixes install without a new LCU between baseline months. Check whether the flagged KB is the next baseline.
• The MDE sensor hasn't reported since patching. Check Last seen on the device page.

If you post the exact recommendation name and the KB it lists, it's easier to say which of these applies.

References: Enable periodic system updates assessment (Defender for Cloud) · Compute recommendations reference