Skip to main content

Plan 2 extras: agentless scanning, JIT, FIM, vulnerability management

Microsoft documentedDefender for Servers · Source checked 2026-10-22 · Not yet verified in tenant · Sources: [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22]

What it is​

Plan 1 is MDE for servers, billed by the hour, with alerts in Defender for Cloud. Plan 2 adds features that do not exist in the MDE sensor. They run from the Azure control plane: disk snapshots scanned out of band, NSG and firewall rules rewritten on request, change events shipped to Log Analytics, OS baseline checks through the machine configuration extension. None of it works if you onboard servers straight to MDE and skip Defender for Cloud. See overview and licensing.

It does not replace the sensor. Agentless scanning sees the disk once a day; the sensor sees processes live. Plan 2 runs both.

From the Defender for Servers overview page:

FeaturePlan 1Plan 2Scope notes
MDE EDR, alerts, software inventoryYesYesAzure, AWS, GCP, Arc
Vulnerability scanning, agent-basedYesYesDVM core
Vulnerability scanning, agentlessNoYesAzure, AWS, GCP
Malware scanning, agentlessNoYesAzure, AWS, GCP
Machine secrets scanning, agentlessNoYesAzure, AWS, GCP
DVM premium featuresNoYesDefender portal only
File integrity monitoringNoYesAWS and GCP only via Arc
Just-in-time VM accessNoYesAzure and AWS, AWS in preview
OS baseline misconfigurations, MCSBNoYesNeeds machine configuration extension; non-Azure via Arc
OS system updates assessmentNoYesArc-onboarded only for non-Azure
Threat detection, Azure network layerNoYesAzure only
Defender for DNS alertsNoYesAzure, AWS, GCP
Network mapNoYesAzure only
Free data ingestion, 500 MB per node per dayNoYesWorkspace level

Licensing and prerequisites​

  • Defender for Servers Plan 2 on the subscription. Plan 2 is subscription scope only. Plan 1 can be set per resource through the Pricings REST API with subPlan P1.
  • Agentless scanning also comes with Defender CSPM, minus malware. Malware needs Plan 2.
  • MDE-direct machines (sensor installed, no Defender for Cloud onboarding) keep Plan 1 features and, from Plan 2, only the DVM premium features.
  • Non-Azure machines must be Arc-enabled for FIM, OS baselines and OS updates. JIT is not documented for Arc; the supported list is Azure Resource Manager VMs, VMs behind Azure Firewall on the same VNet, and AWS EC2 in preview.
  • FIM and the ingestion benefit need a Log Analytics workspace. For the benefit, Plan 2 must be enabled on the workspace itself under Environment settings.
  • FIM agent versions: Windows MDE client 10.8799 or later (Learn update 2026-03-22, after the MDE pipeline change), Linux 30.124082 or later.
  • Roles. Agentless scanning grants itself the VM scanner operator role (disk, VM and VMSS read, plus Microsoft.Compute/disks/beginGetAccess/action). JIT configure: Microsoft.Security/locations/jitNetworkAccessPolicies/write and Microsoft.Compute/virtualMachines/write. JIT request: .../jitNetworkAccessPolicies/initiate/action, .../jitNetworkAccessPolicies/*/read, VM read, NIC read, public IP read. FIM enable: Workspace owner plus Security admin; view: Security reader. DVM scanner deployment: Owner at resource group.
  • Agentless disk support: platform-managed keys work as is. Customer-managed keys need the Microsoft Defender for Cloud Servers Scanner Resource Provider (app ID 0c7668b5-3260-4ad0-9f53-34ed54fa19b2) granted Get, Wrap Key and Unwrap Key, or Key Vault Crypto Service Encryption User on RBAC vaults. Azure Disk Encryption is not mentioned on either agentless page.

How it works​

Defender for Cloud acts on the machine from outside. Nothing here changes the sensor's behaviour.

Agentless machine scanning. Defender for Cloud snapshots the OS and data disks, analyses the copy in an isolated regional environment, extracts metadata and deletes the snapshot within minutes. Vulnerability and software data goes to DVM. Secrets go to the Microsoft secrets engine, which also tests whether SSH private keys can reach another machine; unverifiable keys are labelled unverified. Malware scanning runs Defender Antivirus with cloud protection against the snapshot, so it catches files the on-box AV excluded and machines with no AV. The scan runs every 24 hours, not configurable, and the VM must be running. Results land as recommendations (vulnerabilities, secrets) and security alerts (malware, also in Defender XDR).

Learn's agentless scanning flow: snapshot, out-of-band analysis in a regional environment, metadata to the Defender engines, snapshot deleted. Source: Microsoft Learn, CC BY 4.0.
Learn's agentless scanning flow: snapshot, out-of-band analysis in a regional environment, metadata to the Defender engines, snapshot deleted. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Limits: disks up to 4 TB total, else only the OS disk is scanned and only if under 4 TB. Over 14 disks is unsupported. UltraSSD_LRS, PremiumV2_LRS and AKS ephemeral OS disks make the VM unscannable. UFS, ReFS, ZFS, OracleASM, DRBD, Linux RAID members, DM_Verity and swap are skipped. Malware scanning is partial on archives over 1 GB, 10,000 files or 5 nesting levels.

Just-in-time VM access. Enabling JIT writes deny-all inbound rules for the chosen ports into the NSG and, if present, the Azure Firewall. Existing rules for those ports keep priority; otherwise the deny rules go to the top. A request names ports, source IP or range and a duration up to the policy maximum. Defender for Cloud checks the requester's Azure RBAC on the VM, writes a temporary allow rule, and restores the previous state at expiry. Live connections are not cut. Azure Firewall must use Rules (Classic); firewall policies and Firewall Manager are unsupported. On AWS, JIT revokes the EC2 security group inbound rules and creates a new group on approval.

Learn's decision flow for which VMs Defender for Cloud lists as JIT candidates on the Unhealthy resources tab. Source: Microsoft Learn, CC BY 4.0.
Learn's decision flow for which VMs Defender for Cloud lists as JIT candidates on the Unhealthy resources tab. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

File integrity monitoring. FIM runs on the MDE sensor. It collects create, delete and modify events for configured files and registry keys (size, ACL, content hash for files; size, ACL, type, content for registry) and sends them near real time to the Log Analytics workspace you pick. Agentless scanning adds a 24 hour feed and unlocks custom paths. Events carry account, initiating process and change source. Table: MDCFileIntegrityMonitoringEvents. The MMA path stopped in November 2024; AMA is on the migration list. Defaults cover autorun keys, AppInit DLLs, cryptography OID keys, LSA secrets, shell folders, and core Windows and Linux binaries and config paths.

Defender Vulnerability Management. Both plans get DVM core through the sensor: vulnerability and configuration assessment, risk-based prioritisation, remediation tracking, continuous monitoring, software inventory and usage insights. Plan 2 adds the premium set: security baselines assessment, block vulnerable applications, browser extensions, digital certificates, network shares, hardware and firmware. Premium features show only in the Defender portal. Windows authenticated scan is gone from the capability table. Vulnerability assessment is on by default; the toggle is for switching solutions or turning it off.

OS baselines against MCSB. The Azure Policy machine configuration extension (formerly guest configuration) evaluates the compute baselines and feeds two recommendations: Windows assessment key 8c3d9ad0-3639-4686-9cd2-2b2ab2609bda, Linux 1f655fb7-63ca-4980-91a3-56dbc2b715c6. Leftover MMA produces duplicates.

Data ingestion benefit. 500 MB per node per day, pooled across the subscription's machines, applied at workspace level, not enforced per machine. Covers SecurityAlert, SecurityBaseline, SecurityBaselineSummary, SecurityDetection, SecurityEvent, WindowsFirewall, ProtectionStatus, Update and UpdateSummary under conditions, MDCFileIntegrityMonitoringEvents, DeviceCustomFileEvents, DeviceCustomRegistryEvents, and WindowsEvent for the security stream only. Classic Sentinel meters: offsets Log Analytics ingestion. Simplified meters: offsets Sentinel ingestion. Never on the invoice; look in Cost Management exports.

MDE itself. Either plan entitles the server to MDE Plan 2 capabilities: EDR, advanced hunting, automated investigation and remediation, ASR rules, next-generation protection, threat analytics. Not a Plan 2 extra.

Configure​

All plan toggles live in one place: Defender for Cloud > Environment settings > subscription > Defender for Servers row > Settings. The page is Settings and monitoring.

Agentless scanning for machines

  1. Settings and monitoring > Agentless scanning for machines > On. Save.
  2. For CMK disks, grant the scanner resource provider on each vault. Microsoft publishes a PowerShell script in the Azure/Microsoft-Defender-for-Cloud repo for bulk vaults.
  3. Wait up to 24 hours for the first scan.
Settings and monitoring, Agentless scanning for machines toggle. Source: Microsoft Learn, CC BY 4.0.
Settings and monitoring, Agentless scanning for machines toggle. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Malware and secrets scanning have no separate toggle.

Vulnerability assessment for machines. Same page. Toggle On, Edit configuration to pick the solution. Apply, Save.

File Integrity Monitoring

  1. Same page. File Integrity Monitoring > On.
  2. Edit configuration. Pick a Log Analytics workspace or Create new.
  3. Recommended to monitor > Edit. All recommended entities are on by default. Set Status and Change types per rule, or delete rules. Apply.
  4. Optional: + Add rule. Rule name (letters, digits, underscore, 128 max), Status Enabled, change types, entity type and path. Path rules: up to three asterisks at segment boundaries, registry paths start with HKLM, Linux paths absolute, 260 characters max. Up to 500 custom rules per subscription. Apply.
  5. Apply, Continue, Save.
File Integrity Monitoring toggle on the Defender for Servers settings page. Source: Microsoft Learn, CC BY 4.0.
File Integrity Monitoring toggle on the Defender for Servers settings page. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Just-in-time VM access

From Defender for Cloud:

  1. Workload protections > Just-in-time VM access > Not configured tab. Select VMs. Enable JIT on VMs.
  2. Default ports: 22, 3389, 5985, 5986. Add for more; per port set protocol, allowed source IPs, maximum request time. Save.

From the VM blade: Virtual machines > VM > Configuration > Enable just-in-time. Defaults: Windows 3389, Linux 22, 3 hours, any source. Change them in Defender for Cloud > Configured tab > right-click VM > Edit.

Editing a JIT policy: ports, protocol, allowed source IPs and maximum request time. Source: Microsoft Learn, CC BY 4.0.
Editing a JIT policy: ports, protocol, allowed source IPs and maximum request time. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Requesting access: Configured tab > select VM > Request access > ports, source IP, time window > Open ports. Or VM > Connect > Request access. Behind a proxy, enter the proxy's egress range. Policy name plus VM name must stay under 56 characters.

Request access pane with ports, source IP and duration. Source: Microsoft Learn, CC BY 4.0.
Request access pane with ports, source IP and duration. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

Data ingestion benefit. Environment settings > the Log Analytics workspace (not the subscription) > Defender for Servers Plan 2 On > Save.

OS baselines. No toggle. Plan 2 plus the Azure Policy machine configuration extension. Results under Recommendations.

Verify​

Agentless scanning. Nothing on the box shows it. Check the recommendations Machines should have vulnerability findings resolved and Machines should have secrets findings resolved, and confirm machines without the sensor still get vulnerability data. For malware, run Learn's Test agentless malware scanning procedure; an empty alert list proves nothing. Azure Resource Graph:

securityresources
| where type == "microsoft.security/assessments/subassessments"
| extend assessmentKey = extract(@"(?i)providers/Microsoft.Security/assessments/([^/]*)", 1, id)
| where assessmentKey in ("1f655fb7-63ca-4980-91a3-56dbc2b715c6", "8c3d9ad0-3639-4686-9cd2-2b2ab2609bda")
| extend status = tostring(properties.status.code)
| summarize count() by assessmentKey, status

Those are the MCSB baseline keys. Swap in the vulnerability or secrets assessment keys from the recommendation details page.

JIT. Configured tab lists the VM. Confirm deny inbound rules for the policy ports in the NSG. Request access, then look for the temporary allow rule scoped to your IP. Audit: Configured tab > ellipsis > Activity Log, Download as CSV. Behind Azure Firewall the approved request returns the DNAT mapped port.

Activity Log entry point for a JIT-configured VM. Source: Microsoft Learn, CC BY 4.0.
Activity Log entry point for a JIT-configured VM. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

FIM. Workload protections > File Integrity Monitoring lists resources with tracked changes; click one to open the query. Settings there shows missing prerequisites per subscription. In the workspace:

MDCFileIntegrityMonitoringEvents
| where TimeGenerated > ago(14d)
| where MonitoredEntityType in ('Registry', 'Files')
| summarize count() by Computer, MonitoredEntityType
MDCFileIntegrityMonitoringEvents
| where TimeGenerated > ago(14d)
| where MonitoredEntityType == 'Registry'
| order by Computer, RegistryKey
Workload protections, File Integrity Monitoring entry with resources that have tracked changes. Source: Microsoft Learn, CC BY 4.0.
Workload protections, File Integrity Monitoring entry with resources that have tracked changes. Source: Microsoft Learn, CC BY 4.0. · captured 2026-10-22

DVM premium. Defender portal > Vulnerability management. Baselines assessment, Browser extensions, Certificates, Network shares and Hardware and firmware should be populated for Plan 2 servers.

Ingestion benefit. Not on the invoice. Azure Monitor's View data allocation benefits guidance, or a Cost Management export.

Troubleshoot​

SymptomLikely causeFix
Agentless scan never produces findings for a VMVM was off at scan time, disk set over 4 TB or over 14 disks, unsupported disk SKU or filesystemKeep the VM running across a 24 hour window. Check for UltraSSD, PremiumV2, ReFS, ZFS, RAID member volumes.
CMK VMs missing from agentless resultsScanner RP has no key accessGrant Get, Wrap Key, Unwrap Key or Key Vault Crypto Service Encryption User to app 0c7668b5-3260-4ad0-9f53-34ed54fa19b2.
AWS scans stopped for an account250 or more leftover Defender-tagged snapshotsFix ec2:DeleteSnapshot on the VmScanner role for CreatedBy=Microsoft Defender for Cloud, check IAM boundaries and SCPs. Cleanup clears the block.
GCP agentless returns nothingOrg policy blocks disk, image or snapshot accessFollow the Learn page Resolve an agentless scan error for GCP.
Malware alert on a known-good fileFalse positiveSubmit the sample via the submission portal. Suppress by malware name or file hash meanwhile.
JIT missing from a VM's Configuration bladeClassic VM, firewall managed by Firewall Manager, firewall policy in use, or Arc machineOnly ARM VMs and EC2 are supported. Firewall must use Rules (Classic).
JIT request fails with authorization errorMissing initiate action, NIC read or public IP readAssign the actions in the Licensing section or use the Set-JitLeastPrivilegedRole script.
JIT save fails on name lengthPolicy name plus VM name over 56 charactersShorten the policy name.
FIM toggle on but no eventsAgent below 10.8799 on Windows or 30.124082 on Linux; MDE not deployed; workspace mismatchServer 2016 and 2012 R2 need KB 5005292 manually. Check FIM > Settings corrective actions.
FIM shows Create as Modify on LinuxKnown sensor limitationExpected. Filter on Modify for new files.
FIM is not enabled message on the review pageFIM over MDE never turned on for that subscriptionOnboard subscriptions from that page, then enable FIM.
Duplicate baseline recommendationsMMA still installed next to the machine configuration extensionRemove MMA.
500 MB benefit not appliedPlan 2 enabled on the subscription but not on the workspace, or data going to another workspaceEnvironment settings > workspace > enable Plan 2.
Custom FIM rule rejectedPath rule violationMax three asterisks at segment boundaries, HKLM prefix, absolute Linux paths, 260 characters.

Gotchas and limits​

  • MDE-direct is a trap for Plan 2. Onboarded by script or Intune, not through Defender for Cloud, you pay for Plan 2 and get DVM premium and nothing else. See onboarding.
  • Plan 2 is subscription scope only. You can set individual machines to Free, but you cannot light up Plan 2 on three machines in a Plan 1 subscription.
  • Agentless scanning is a daily snapshot. Nothing in memory, nothing on machines that are off at scan time. Posture, not detection, even for malware.
  • CSPM agentless is not Plan 2 agentless. CSPM gives vulnerabilities, software, secrets and EDR config. Malware needs Plan 2.
  • Azure Disk Encryption is not covered in either agentless page. Assume ADE volumes are unscanned until proven otherwise. TODO: test in the dev tenant.
  • JIT only touches NSG and Azure Firewall classic rules. Firewall policy, Firewall Manager, classic VMs and Arc servers are out. An on-premises box behind Arc has no NSG to rewrite.
  • JIT rule priority: an existing allow on 3389 outranks the JIT deny. JIT adds to a bad NSG, it does not fix it.
  • FIM data beyond the benefit is billed. Noisy custom rules on busy paths eat the 500 MB pool, which is subscription-wide, not per machine. Disabling FIM stops collection but leaves data under workspace retention.
  • FIM on AWS and GCP needs Arc. Native EC2 or GCE onboarding does not give FIM.
  • DVM premium only shows in security.microsoft.com. The Azure portal will not tell you certificate assessment is running.
  • The ingestion benefit needs Plan 2 on the workspace, not just the subscription. Check which Sentinel meter the workspace uses before promising savings.
  • Release notes list a billing change effective 2026-11-01 for how billable servers are counted. Watch November invoices.

Further reading​

Only four posts in the window qualified.

My notes​

TODO: Sohail's notes after verification.

Changelog​

DateChangeSource
2026-10-22Drafted from Learn, with Learn images and diagrams[1]