MDC not showing misconfigurations

Question

MDC not showing misconfigurations

Tikoo, Shivata 0

We observed that an NSG rule in Server – mazawea510 (multiuser) is configured with both Source and Destination set to “Any”.

However, Microsoft Defender for Cloud is not currently showing any NSG-related recommendation to remediate or review this configuration.

We can see that there were a few NSG-related recommendations for this resource in the past, but all of them are currently marked as “Completed.”

Could you please help clarify why no active recommendation is being triggered for this rule
MDC SS.png

NSG SS.png

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-22T11:58:45.45+00:00
Hey Shivata, it’s not a bug – Defender for Cloud only shows “active” NSG misconfiguration recommendations when a rule matches one of its built-in checks and is in an unhealthy (open) state. In your case:

Those four NSG recommendations you saw (“All network ports should be restricted…”, “Internet-facing VMs…”, etc.) have already been marked Completed, so Defender for Cloud treats them as “resolved” and won’t re-open them until the VM/NSG drifts back into an unhealthy state.

The rule you’ve highlighted (ports 4712/4812, source=Any, dest=Any) doesn’t map to any new built-in recommendation—most of the network checks today focus on management ports (SSH 22, RDP 3389) or indeed “any port” open to the Internet tag. Custom ports aren’t automatically flagged once you’ve closed out the generic “all ports” rec.

Recommendations only re-evaluate every ~4 hours, so if you want to force a refresh you can hit the Refresh button in the Recommendations blade or explicitly Re-evaluate your security policy. If after that the rule still meets one of the built-in checks, it’ll surface again as “active”.

If you’re looking to catch arbitrary open ports across all your VMs you have two options:

• Open the All network ports recommendation and edit its parameters via the Security Policy blade to force-fail on any port-range you choose.

• Deploy a custom Azure Policy that audits NSG rules allowing any source/destination on any/custom ports.

Give that a try and let me know! If it still looks like a gap in detection, could you share:

Which Defender for Cloud security policy (built-in or custom) is assigned at the subscription/resource-group level?

Whether this NSG is attached at the NIC or subnet level?

The timestamp of your last “Refresh”/“Re-evaluate” action in the Recommendations blade?

Cheers,

– Your Azure Defender for Cloud helper

Reference:

NSG-based recommendations (see “Network security group” section) https://docs.microsoft.com/azure/defender-for-cloud/recommendations-reference#network-security-group-recommendations

Customizing recommendation parameters via Security Policy https://docs.microsoft.com/azure/defender-for-cloud/tutorial-security-policy#customizing-the-security-policy

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-25T10:00:57.0366667+00:00

Tikoo, Shivata Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Tikoo, Shivata 0 Reputation points

2026-05-28T13:45:27.96+00:00
Hello @Rukmini @Harshitha Eligeti

Hope you are doing well.

We would like to seek clarification on the following points related to Azure Policy, Defender recommendations, and Regulatory Compliance management.

MDC Recommendations detection logic. We have one policy created on the server where we configured a rule with the port range 1025–5000. Since port 3389 is already included within this range, we expected to receive network recommendations- "All network ports should be restricted on NSGs associated with your Virtual machine” however, we are currently not receiving any recommendations.Although port 3389 is allowed in our NSG, the recommendation is marked as Completed. We would like clarification on how compliance is determined in this scenario. Kindly refer to the attached snippet and help us understand the reason for this behavior.

Azure Policy Capabilities Could you please suggest whether it is possible to customize the built-in Azure Policies that generate recommendations in Microsoft Defender.
We request that you to share the Detailed document on Usage of Azure policy with respect to defender for cloud recommendations.
Kindly refer to the attached snippet for reference.
** 3.** Regulatory Compliance Framework Additionally, we are expecting a document of understanding for best usage of regulatory compliance feature in defender for cloud, How can we incorporate various Frameworks into defender for cloud for our environment.**** 4. Managing Regulatory Compliance Standards We would appreciate guidance on the best practices for managing Regulatory Compliance standards effectively.

Additionally, could you please share relevant Microsoft articles or official documentation for all the above-mentioned topics for our future reference and understanding.
Tikoo, Shivata 0 Reputation points

2026-06-08T09:34:59.0666667+00:00

Hello @Rukmini , /Team,

Can you please let us know if you can assist us on above mentioned query .

1 answer

Your answer

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-25T10:00:57.0366667+00:00

Tikoo, Shivata Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Tikoo, Shivata 0 Reputation points

2026-05-28T13:45:27.96+00:00

Hello @Rukmini @Harshitha Eligeti

Hope you are doing well.

We would like to seek clarification on the following points related to Azure Policy, Defender recommendations, and Regulatory Compliance management.

MDC Recommendations detection logic. We have one policy created on the server where we configured a rule with the port range 1025–5000. Since port 3389 is already included within this range, we expected to receive network recommendations- "All network ports should be restricted on NSGs associated with your Virtual machine” however, we are currently not receiving any recommendations.Although port 3389 is allowed in our NSG, the recommendation is marked as Completed. We would like clarification on how compliance is determined in this scenario. Kindly refer to the attached snippet and help us understand the reason for this behavior.

Azure Policy Capabilities Could you please suggest whether it is possible to customize the built-in Azure Policies that generate recommendations in Microsoft Defender.
We request that you to share the Detailed document on Usage of Azure policy with respect to defender for cloud recommendations.
Kindly refer to the attached snippet for reference.
** 3.** Regulatory Compliance Framework Additionally, we are expecting a document of understanding for best usage of regulatory compliance feature in defender for cloud, How can we incorporate various Frameworks into defender for cloud for our environment.**** 4. Managing Regulatory Compliance Standards We would appreciate guidance on the best practices for managing Regulatory Compliance standards effectively.

Additionally, could you please share relevant Microsoft articles or official documentation for all the above-mentioned topics for our future reference and understanding.
Tikoo, Shivata 0 Reputation points

2026-06-08T09:34:59.0666667+00:00

Hello @Rukmini , /Team,

Can you please let us know if you can assist us on above mentioned query .

Answer 1

Defender for Cloud security recommendations are generated strictly according to the built‑in policies and their current implementation. An NSG rule with Source = Any and Destination = Any does not automatically guarantee that an active recommendation will be shown; it must match the exact conditions of one of the NSG‑related recommendations that are currently in effect.

From the networking recommendations in Defender for Cloud, NSG‑related items include, for example:

All network ports should be restricted on network security groups associated to your virtual machine – flags NSGs whose inbound rules are too permissive, such as allowing access from “Any” or “Internet” ranges.
Internet‑facing virtual machines should be protected with network security groups – flags VMs without NSGs on internet‑facing subnets.
Adaptive network hardening recommendations should be applied on internet facing virtual machines – flags NSGs whose effective rules are more permissive than Defender’s learned baseline.

If these recommendations are currently shown as Completed for the VM, it means that, based on the last assessment, Defender for Cloud evaluated the effective NSG configuration and determined that it no longer violates the specific policy logic (for example, the rule might not be considered internet‑facing, or the effective exposure does not meet the policy’s criteria). In that case, no new or active recommendation is triggered, even if a rule appears broadly scoped.

To verify the effective NSG rules that Defender for Cloud is assessing, list the NSG rules attached to the VM’s NIC or subnet and confirm which rules actually allow inbound traffic from Any or Internet:

az network nsg rule list \
  --resource-group <rg-name> \
  --nsg-name <nsg-name> \
  --include-default

If the effective rules truly are overly permissive but no recommendation appears, the behavior is typically due to the exact policy conditions not being met (for example, not classified as internet‑facing, or covered by a deprecated/changed recommendation). In that case, harden the NSG manually (restrict source ranges and ports) even without an active Defender for Cloud recommendation.

References: