# Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data

> Why can a subscription-scoped Defender recommendation query miss CVSS and CVE publication details?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:22+00:00
- Modified: 2026-09-10T01:40:03+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why can a subscription-scoped Defender recommendation query miss CVSS and CVE publication details?

## Potentially affected

Azure Resource Graph integrations enriching Defender for Cloud individual recommendations with microsoft.security/cvedetails.

## DSE recommendation

Separate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly.

## Article

## Source facts

In Defender for Cloud’s individual-recommendation schema, CvesDetails retains each vulnerability’s CveId. Additional information is available through the microsoft.security/cvedetails resource type. Microsoft requires tenant scope for that query: subscription scope returns no records from this type, so enrichment fields such as LatestPublishedDate, LastModifiedDate and CVSSScore are not returned there. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations).

## Applicability

This concerns an Azure Resource Graph enrichment pipeline, not the meaning of a CVSS score or the priority of a particular vulnerability. A report may need to distinguish finding data from the separately retrieved CVE details.

## DSE recommendation

Separate finding retrieval from tenant-scoped CVE enrichment and label unsuccessful enrichment explicitly. Preserve the CVE identifier even when the enrichment stage supplies no matching details. Have the integration owner record the scope used for each request and avoid converting a missing score into a numeric zero. Do not expand query authority merely to conceal an unexamined empty result.

## Verification

With authorized read access, select a known finding and compare its CVE identifier with the tenant-scoped details result. Inspect the report’s behavior when enrichment is unavailable: the finding should remain visible with the uncertainty expressed. Review joins and any date or score filters so absent enrichment cannot silently remove findings from the intended report. Retain the request scopes and representative sanitized output as evidence of the data contract, without asserting that all tenant vulnerabilities were assessed.

## Official references

[Microsoft Learn: Individual recommendation transition](https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations). Source reviewed September 9, 2026.

## Primary reference

- Name: Transition from grouped to individual recommendations in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Query Defender CVE enrichment at tenant scope instead of mistaking missing fields for absent data,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-334-query-defender-cve-enrichment-at-tenant-scope-instead-of-mistaking-missing-fields/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.