Transition to Microsoft Defender Vulnerability Management for servers

How-to
01/09/2024

Important

Defender for Server's vulnerability assessment solution powered by Qualys, is on a retirement path that is set to complete on May 1st, 2024. If you are a currently using the built-in vulnerability assessment powered by Qualys, you should plan to transition to the Microsoft Defender Vulnerability Management vulnerability scanning using the steps on this page.

For more information about our decision to unify our vulnerability assessment offering with Microsoft Defender Vulnerability Management, see this blog post.

Check out the common questions regarding the transition to Microsoft Defender Vulnerability Management.

Customers who want to continue using Qualys, can do so with the Bring Your Own License (BYOL) method.

With the Defender for Servers plan in Microsoft Defender for Cloud, you can scan compute assets for vulnerabilities. If you're currently using a vulnerability assessment solution other than the Microsoft Defender Vulnerability Management vulnerability assessment solution, this article provides instructions on transitioning to the integrated Defender Vulnerability Management solution.

To transition to the integrated Defender Vulnerability Management solution, you can use the Azure portal, use an Azure policy definition (for Azure VMs), or use REST APIs.

Transition with Azure policy for Azure VMs
Transition with Defender for Cloud's portal
Transition with REST API

Prerequisites

For prerequisites and other requirements, see Support for the Defender for Servers plan.

Transition with Azure policy for Azure VMs

Follow these steps:

Sign in to the Azure portal.
Navigate to Policy > Definitions.
Search for Setup subscriptions to transition to an alternative vulnerability assessment solution.
Select Assign.
Select a scope and enter an assignment name.
Select Review + create.
Review the information you entered and select Create.

This policy ensures that all Virtual Machines (VM) within a selected subscription are safeguarded with the built-in Defender Vulnerability Management solution.

Once you complete the transition to the Defender Vulnerability Management solution, you need to Remove the old vulnerability assessment solution

Transition with Defender for Cloud's portal

In the Defender for Cloud portal, you have the ability to change the vulnerability assessment solution to the built-in Defender Vulnerability Management solution.

Sign in to the Azure portal.
Navigate to Microsoft Defender for Cloud > Environment settings
Select the relevant subscription.
Locate the Defender for Servers plan and select Settings.
Toggle Vulnerability assessment for machines to On.

If Vulnerability assessment for machines was already set to on, select Edit configuration
Select Microsoft Defender Vulnerability Management.
Select Apply.
Ensure that Endpoint protection or Agentless scanning for machines are toggled to On.
Select Continue.
Select Save.

Once you complete the transition to the Defender Vulnerability Management solution, you need to Remove the old vulnerability assessment solution

Transition with REST API

REST API for Azure VMs

Using this REST API, you can easily migrate your subscription, at scale, from any vulnerability assessment solution to the Defender Vulnerability Management solution.

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/serverVulnerabilityAssessmentsSettings/AzureServersSetting?api-version=2022-01-01-preview

{
  "kind": "AzureServersSetting",
  "properties": {
    "selectedProvider": "MdeTvm"
  }
}

Once you complete the transition to the Defender Vulnerability Management solution, you need to remove the old vulnerability assessment solution.

REST API for multicloud VMs

Using this REST API, you can easily migrate your subscription, at scale, from any vulnerability assessment solution to the Defender Vulnerability Management solution.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Security/securityconnectors/{connectorName}?api-version=2022-08-01-preview

{
  "properties": {
  "hierarchyIdentifier": "{GcpProjectNumber}",
  "environmentName": "GCP",
  "offerings": [
    {
     "offeringType": "CspmMonitorGcp",
     "nativeCloudConnection": {
      "workloadIdentityProviderId": "{cspm}",
      "serviceAccountEmailAddress": "{emailAddressRemainsAsIs}"
     }
    },
    {
     "offeringType": "DefenderCspmGcp"
    },
    {
     "offeringType": "DefenderForServersGcp",
     "defenderForServers": {
      "workloadIdentityProviderId": "{defender-for-servers}",
      "serviceAccountEmailAddress": "{emailAddressRemainsAsIs}"
     },
     "arcAutoProvisioning": {
      "enabled": true,
      "configuration": {}
     },
     "mdeAutoProvisioning": {
      "enabled": true,
      "configuration": {}
     },
     "vaAutoProvisioning": {
      "enabled": true,
      "configuration": {
       "type": "TVM"
      }
     },
     "subPlan": "{P1/P2}"
    }
  ],
  "environmentData": {
    "environmentType": "GcpProject",
    "projectDetails": {
     "projectId": "{GcpProjectId}",
     "projectNumber": "{GcpProjectNumber}",
     "workloadIdentityPoolId": "{identityPoolIdRemainsTheSame}"
    }
  }
  },
  "location": "{connectorRegion}"
}

Remove the old vulnerability assessment solution

After migrating to the built-in Defender Vulnerability Management solution in Defender for Cloud, offboard each VM from their old vulnerability assessment solution. To delete the VM, you can use the Remove-AzVMExtension PowerShell cmdlet or a REST API Delete request.

Next step

Common questions about vulnerability scanning questions