Explain OS-only agentless findings before counting Azure data disks as covered

Source facts

For supported Azure VMs, Defender for Cloud agentless scanning considers the combined size of the operating-system and data disks. Above four terabytes, only the operating-system disk is scanned, and only if that disk is smaller than four terabytes. Data disks are then outside coverage. VMs with more than fourteen disks are unsupported. Microsoft Learn.

Scans follow a fixed daily schedule. A stopped or deallocated machine is skipped for that cycle. Microsoft explicitly cautions that an enabled setting does not establish coverage and advises against restructuring production disks solely to meet the scan limit. Microsoft Learn.

Applicability

Review Defender for Cloud agentless scanning of Azure standard VMs and Flexible scale-set VMs. Check the full disk-type, filesystem and encryption requirements as well as capacity. This size calculation is not a substitute for the remaining support checks.

DSE recommendation

DSE recommends totaling provisioned disk sizes from the actual VM configuration, then marking operating-system and data-disk coverage separately. For data outside the agentless boundary, record the approved alternative assessment method and its owner. Do not classify an entire VM as assessed simply because some findings exist. Investigate scheduled power state before interpreting missing fresh results as a permission defect.

Verification

Compare expected coverage with the next eligible scan cycle’s findings. Check that the inventory records any OS-only result and the uncovered data disks explicitly. Retain the capacity calculation, disk count and power-state evidence with the assessment. Revisit the boundary when disks are added or resized rather than carrying the previous coverage label forward.

Official references

Microsoft Learn: Enable agentless machine scanning.