All of my Azure VMs have the MDE extension but most are not showing up in Assets tab

Question

All of my Azure VMs have the MDE extension but most are not showing up in Assets tab

JohnSebastian-3934 556

Why are only some of my Azure VMs showing up in the Assets tab of security.microsoft.com portal? All of my machines have the MDE extension installed on them?

VEMULA SRISAI 9,430 Reputation points Microsoft External Staff Moderator

2026-02-26T21:05:27.4533333+00:00
Hello JohnSebastian-3934,

To ensure the Azure VMs appear in the Assets tab of the Defender portal, please validate the following:

Enable Auto‑Provisioning in Defender for Cloud

Go to Defender for Cloud → Environment settings → Settings

Ensure Auto‑provisioning is enabled

Confirm Defender for Servers Plan 1 or Plan 2 is enabled, as this is required for Microsoft Defender for Endpoint (MDE) integration

Missing either of these settings commonly results in the MDE extension installing incompletely or not onboarding correctly

Verify all prerequisites are met

Ensure the OS, agent requirements, and connectivity prerequisites are satisfied as documented here:

Make sure also that all of the prerequisites are met: https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-defender-for-endpoint

Manually onboard if auto‑provisioning fails

If auto‑provisioning is disabled or not working as expected, manually install the MDE.Windows extension

Download the onboarding package from the Microsoft 365 Defender portal (https://security.microsoft.com)

Run the onboarding script locally on each affected VM

Review the VM cloning process (if applicable)
- Ensure all required system configurations and settings were properly retained during cloning - Incomplete or inconsistent clones can prevent successful MDE onboarding **Validate Azure Arc onboarding (for Arc‑enabled servers)** - Confirm the servers were onboarded to **Azure Arc successfully** - Any failure during Arc onboarding can block the MDE extension from installing or registering correctly **Check network connectivity** - Ensure there are no firewall or proxy restrictions blocking outbound connectivity to **Microsoft Defender for Endpoint service endpoints** - Network blocks are a common reason why machines do not appear in the Assets tab

Once these checks are completed and the VM starts sending telemetry successfully, it will automatically appear in the Assets tab of the Defender portal.
JohnSebastian-3934 556 Reputation points

2026-02-26T22:09:19.5966667+00:00

How do I tell what Plan I have? It would be great if that was shown directly on the Microsoft Defender for Cloud Dashboard.

I have Global Administrator Privilege and Security Administrator Privilege enabled currently. When I go to Defender for Cloud -> Environment settings, I do not see any kind of Settings. I have numerous boxes with things like Governance rules, Data Sensitivity, Direct onboarding, Integrations, Exemptions, Resource criticality and SEcurity rules. At the bottom of the scren I have the Azure Cloud with my Tenant Root Group and Subscription. There is no Settings anywhere on the page or across the menu items at the top. Where are they?

1 answer

Your answer

JohnSebastian-3934 556 Reputation points

2026-02-26T22:09:19.5966667+00:00

How do I tell what Plan I have? It would be great if that was shown directly on the Microsoft Defender for Cloud Dashboard.

I have Global Administrator Privilege and Security Administrator Privilege enabled currently. When I go to Defender for Cloud -> Environment settings, I do not see any kind of Settings. I have numerous boxes with things like Governance rules, Data Sensitivity, Direct onboarding, Integrations, Exemptions, Resource criticality and SEcurity rules. At the bottom of the scren I have the Azure Cloud with my Tenant Root Group and Subscription. There is no Settings anywhere on the page or across the menu items at the top. Where are they?

Answer 1

Hi JohnSebastian-3934,

Transient devices are automatically excluded in the Assets > Devices > Device Inventory within Defender XDR portal. To resolve this uncheck the filters.
In refernce to Defender for CLoud: According to https://learn.microsoft.com/en-us/azure/defender-for-cloud/asset-inventory?pivots=defender-portal Defender for Cloud periodically analyzes the security state of resources connected to it. When resources have active security recommendations or security alerts associated with it, they appear in the inventory. The Assets view in security.microsoft.com is driven by Microsoft Defender for Cloud asset inventory, not just Defender for Endpoint onboarding.
To further troubleshoot this, I recommend using the MDE Client Analyzer - https://learn.microsoft.com/en-us/defender-endpoint/analyzer-report. If the issue persisits: raise a support ticket and include analyzer result files when opening a support ticket, make sure you use the Attachments section and include the MDEClientAnalyzerResult.zip file.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

JohnSebastian-3934 556 Reputation points

2026-03-03T15:29:07.5333333+00:00

Thanks for the response. I will look into the Client Analyzer

Share via

All of my Azure VMs have the MDE extension but most are not showing up in Assets tab

1 answer

Your answer