# Check container image eligibility before interpreting a missing vulnerability assessment

> Which image-format limits should be checked when Defender for Containers has no assessment result?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:56+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Which image-format limits should be checked when Defender for Containers has no assessment result?

## Potentially affected

Apply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.

## DSE recommendation

DSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow.

## Article

## Source facts

Microsoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers).

## Applicability

Apply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.

## DSE recommendation

DSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.

## Verification

Select an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.

## Official references

[Microsoft Learn: Containers support matrix in Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers). Source reviewed September 17, 2026.

## Primary reference

- Name: Containers support matrix in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/defender-for-cloud/support-matrix-defender-for-containers
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check container image eligibility before interpreting a missing vulnerability assessment,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-064-check-container-image-eligibility-before-interpreting-a-missing-vulnerability/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.