Share via

Security Recommendation Not Updating After Policy-Based Remediation

PANDUGAYALA Sai K 0 Reputation points
2025-05-21T12:06:23.1533333+00:00

We have remediated the Defender for Cloud recommendation:

"Container images should be deployed from trusted registries only" for the resource of AKS cluster

Remediation actions taken:

  • A regex was configured in the security policy under the Allowed registry or registries regex parameter to allow only our trusted private container registries.
  • All container images have been verified and updated to use only these trusted registries.
  • We validated via the Kubernetes cluster and CI/CD pipelines that no images are being pulled from public or untrusted registries.
  • Azure Policy compliance status reflects full alignment with the policy.

Issue:

Despite the above, Microsoft Defender for Cloud continues to flag this recommendation as active, and the listed pods are either:

  • Already updated with images from trusted registries, or
  • No longer exist in the cluster.
Microsoft Security | Microsoft Defender | Other

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Timothy Lavandar 0 Reputation points
    2025-08-20T05:46:05.56+00:00

    In a recent case, we also had compliant resources being flagged. Defender for Cloud was evaluating against the Microsoft cloud security benchmark with a default regex parameter value of "^(.+){0}$", updating that assignment with our desired regex cleared the recommendations.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.