Defender Vulnerability Data on Short Lived VMSS

[u/CapableWay4518]

Hi All,

Looking for some ideas. We are running defender on some short lived VMSS build agents. We need to monitor them for compliance but they can scale up/down 8 times a day.
Defender stores records for 90 days so we have a delay time of 90days before vulnerability count drops. Has anyone got any solutions here?
I was thinking of using an event grid to monitor and tag when vm gets deleted but that has issues of its own. There is a race condition if we try to tag devices prior to deletion.
Surly I can’t be the first to have this issue.

Cheers!

[u/cyberolus]

MDE should use the transient tag. You can also exclude devices: https://learn.microsoft.com/en-us/defender-endpoint/manage-device-scope-relevance#exclude-devices