|
| 1 | +Contoso Manufacturing enabled Defender for Servers across their Azure VM fleet, but inconsistent agent deployment means some machines have rich vulnerability data while others remain invisible. Microsoft Defender Vulnerability Management (MDVM) is natively integrated into Defender for Servers and provides continuous vulnerability scanning—but the scanning method, coverage depth, and premium features depend on which plan tier you use and whether VMs have the Defender for Endpoint agent deployed. Here, you explore how MDVM integrates with Defender for Servers, compare agent-based and agentless scanning approaches, and understand which capabilities unlock at each plan tier. |
| 2 | + |
| 3 | +| Scanning Approach | Availability | How It Works | |
| 4 | +|-------------------|--------------|--------------| |
| 5 | +| Agent-based | Plan 1 and Plan 2 | Uses the Defender for Endpoint sensor deployed on VMs for near-real-time vulnerability detection | |
| 6 | +| Agentless | Plan 2 only | Scans VMs without requiring agent installation, providing visibility even for unmanaged machines | |
| 7 | + |
| 8 | +## Explore how MDVM integrates with Defender for Servers |
| 9 | + |
| 10 | +MDVM is automatically enabled when you activate Defender for Servers. MDVM gives you continuous vulnerability scanning across Azure VMs, on-premises machines connected through Azure Arc, and multicloud VMs from AWS or GCP. For Contoso Manufacturing's scenario, every Windows Server VM in their production automation, supply chain, and ERP environments gets scanned without manual configuration. While this module focuses on Windows Server VMs, MDVM vulnerability scanning also supports macOS and a broad range of Linux distributions for organizations with mixed-OS environments. |
| 11 | + |
| 12 | +MDVM delivers four core capabilities that transform raw vulnerability data into actionable security intelligence. |
| 13 | + |
| 14 | +| Feature | Description | |
| 15 | +|---------|-------------| |
| 16 | +| **Continuous asset discovery** | Tracks every software package, application, and service running on your servers. | |
| 17 | +| **Risk-based intelligent prioritization** | Ranks vulnerabilities by combining Common Vulnerabilities and Exposures (CVE) severity scores with active threat intelligence and breach likelihood predictions, so your team focuses on exploitable risks rather than theoretical weaknesses. | |
| 18 | +| **CVE-linked findings** | Provides detailed remediation guidance for each vulnerability, including software version upgrades, patches, or configuration changes. | |
| 19 | +| **Remediation tracking** | Monitors progress across your VM fleet, showing which vulnerabilities remain open and which teams own responsibility for fixes. | |
| 20 | + |
| 21 | +The integration happens at the infrastructure layer rather than requiring separate licensing or configuration. When Defender for Cloud deploys the Defender for Endpoint agent on a VM, MDVM scanning activates automatically. For VMs without agents, Plan 2 customers benefit from agentless scanning that operates transparently in the background. |
| 22 | + |
| 23 | +## Compare agent-based and agentless scanning approaches |
| 24 | + |
| 25 | +:::image type="content" source="../media/agent-versus-agentless.png" alt-text="Diagram comparing agent-based and agentless vulnerability scanning paths in Defender for Servers, showing how each method collects data and reports findings to Defender for Cloud."::: |
| 26 | + |
| 27 | +Defender for Servers supports two distinct scanning methods, each optimized for different deployment scenarios and visibility requirements. Understanding which approach applies to your VMs determines how fresh your vulnerability data is and which machines appear in your security dashboard. |
| 28 | + |
| 29 | +**Agent-based scanning** uses the **Microsoft Defender for Endpoint (MDE)** sensor that Defender for Cloud automatically deploys on your VMs. This sensor runs continuously on the machine, monitoring software installations, configuration changes, and system behavior in near-real-time. When a new CVE is published or software is updated, the agent detects the change within minutes. The agent reports findings to Defender for Cloud. Agent-based scanning is available in **both Plan 1 and Plan 2**, making it the baseline scanning method for all Defender for Servers customers. For Contoso Manufacturing's production VMs that already have MDE deployed, this approach provides the richest and freshest vulnerability data. |
| 30 | + |
| 31 | +> [!NOTE] |
| 32 | +> Enabling Defender for Servers (Plan 1 or Plan 2) includes a bundled Microsoft Defender for Endpoint Plan 2 license for your servers—you don't need a separate MDE subscription. When you enable Defender for Servers, MDE integration is turned on by default, and the agent is automatically provisioned on supported VMs. |
| 33 | +
|
| 34 | +**Agentless scanning** operates without requiring any software installation on target VMs. Defender for Cloud takes periodic snapshots of VM disks and analyzes the file system, registry, and installed software inventory offline. This approach discovers vulnerabilities even on VMs that aren't connected to the corporate network, have no agents deployed, or run in isolated environments. Agentless scanning is **exclusive to Plan 2**, extending visibility to machines that fall outside your agent footprint. For Contoso Manufacturing's development VMs or temporary workloads that don't justify agent deployment, agentless scanning fills critical visibility gaps. |
| 35 | + |
| 36 | +When both scanning methods are available on the same VM, Defender for Cloud applies a priority rule: **agent-based results take precedence** because they're fresher and more detailed. If a machine has both MDE agent installed and agentless scanning enabled, you see agent-based findings in your dashboard. If a machine lacks the MDE agent, Defender for Cloud automatically scans it agentlessly (Plan 2 only), ensuring no VM goes unmonitored. Organizations using BYOL scanners from Qualys or Rapid7 follow a similar priority—partner agent results appear for machines with those agents installed, while agentless MDVM results fill gaps for machines without partner coverage. |
| 37 | + |
| 38 | +## Evaluate Defender for Servers plan tiers and MDVM features |
| 39 | + |
| 40 | +Defender for Servers offers two plan tiers with distinctly different MDVM capabilities. Choosing between Plan 1 and Plan 2 affects not just scanning methods, but the depth of security insights you receive. |
| 41 | + |
| 42 | +**Plan 1** provides foundational vulnerability management through agent-based scanning. Every VM with the Defender for Endpoint sensor gets continuous monitoring, configuration assessment, risk-based prioritization, remediation tracking, software inventory, and software usage insights. This tier gives Contoso Manufacturing's security team everything they need to identify and remediate critical vulnerabilities across their production Windows Server fleet. The limitation is coverage: VMs without agents remain invisible, and advanced assessment features aren't available. |
| 43 | + |
| 44 | +**Plan 2** includes everything in Plan 1 plus agentless scanning and six advanced assessment capabilities that compliance-focused organizations require. **Security baselines assessment** evaluates VMs against CIS Benchmarks and DISA STIG standards, generating compliance scores for audit reporting. **Block vulnerable applications** lets you prevent execution of software with known critical vulnerabilities until patches are applied. **Digital certificate assessment** identifies expired or weak certificates that create authentication risks. **Browser extensions assessment** discovers risky or malicious browser plugins on server VMs. **Network share analysis** maps exposed file shares and their permissions. **Hardware and firmware assessment** detects vulnerabilities in BIOS, UEFI, and hardware components that software-only scanners miss. |
| 45 | + |
| 46 | +For Contoso Manufacturing, the choice depends on coverage requirements and compliance obligations. If their Compliance Manager needs CIS Benchmark scores for audit reports or their security policies require blocking vulnerable applications, Plan 2 is essential. If their cloud security engineer simply needs vulnerability visibility across the entire VM fleet—including development and temporary workloads—Plan 2's agentless scanning extends coverage without operational overhead. |
| 47 | + |
| 48 | +| Feature | Plan 1 | Plan 2 | |
| 49 | +|---------|--------|--------| |
| 50 | +| Agent-based vulnerability scanning | Supported | Supported | |
| 51 | +| Agentless vulnerability scanning | - | Supported | |
| 52 | +| Configuration assessment | Supported | Supported | |
| 53 | +| Risk-based prioritization | Supported | Supported | |
| 54 | +| Remediation tracking | Supported | Supported | |
| 55 | +| Software inventory | Supported | Supported | |
| 56 | +| Software usage insights | Supported | Supported | |
| 57 | +| Security baselines assessment (CIS/STIG) | - | Supported | |
| 58 | +| Block vulnerable applications | - | Supported | |
| 59 | +| Digital certificate assessment | - | Supported | |
| 60 | +| Browser extensions assessment | - | Supported | |
| 61 | +| Network share analysis | - | Supported | |
| 62 | +| Hardware and firmware assessment | - | Supported | |
| 63 | + |
| 64 | +Organizations with existing Qualys or Rapid7 deployments can integrate BYOL (bring your own license) scanners with Defender for Cloud instead of using integrated MDVM scanning. BYOL scanners report findings to their own management platforms, which feed vulnerability data back to Defender for Cloud's security dashboard. This option doesn't require a paid Defender for Servers plan, though you lose access to MDVM's premium features like security baselines assessment and remediation tracking. This module focuses on the integrated MDVM experience rather than BYOL scenarios. |
0 commit comments