A company uses Microsoft Defender for Cloud to manage the security posture of multiple Azure subscriptions. The security team wants to ensure that all subscriptions are covered by the same Microsoft Defender for Cloud policy initiative, but one subscription is not showing compliance data. The subscription is in the same Azure AD tenant and has the same tags. What is the most likely cause?
Trap 1: The user does not have Security Admin permissions on the…
Security Admin RBAC permissions control a user's ability to manage security policies, dismiss alerts, or apply recommendations in Microsoft Defender for Cloud. They do not affect the underlying data collection process: Defender for Cloud's assessment engine scans the subscription's resources regardless of which user is viewing the console. If the subscription were properly onboarded, a user with inadequate permissions would see a permission error or restricted visibility, not a complete absence of compliance data. Therefore, missing permissions explain a user's inability to see certain controls, but they do not explain why the subscription or workload shows no compliance data at all.
Trap 2: The subscription does not have any tags applied.
Azure tags are logical metadata used for organising resources, cost management, or grouping by environment; they play no role in whether Defender for Cloud can collect security configuration data. The compliance scanning process reads resource properties such as network settings, storage encryption, and OS configuration, none of which depend on tag assignments. Even a subscription with zero tags will still have its resources assessed against the default Azure Security Benchmark initiative. Consequently, an absence of tags cannot cause missing compliance findings or prevent the Microsoft.Security resource provider from functioning.
Trap 3: The subscription does not have the default policy initiative…
The default policy initiative in Defender for Cloud is automatically assigned to every subscription when it is first onboarded, so a subscription without it would indicate a deeper onboarding failure rather than a configurable exclusion. Even if a user manually disables individual policy assignments, the compliance dashboard still shows the initiative's state and available recommendations. The key point is that the automatic assignment happens after the Microsoft.Security resource provider is registered, making an unregistered provider the root cause for a total absence of compliance data. Thus, 'no default initiative assigned' is a symptom, not a cause, of the issue described in the question.
- A
The user does not have Security Admin permissions on the subscription.
Why wrong: Security Admin RBAC permissions control a user's ability to manage security policies, dismiss alerts, or apply recommendations in Microsoft Defender for Cloud. They do not affect the underlying data collection process: Defender for Cloud's assessment engine scans the subscription's resources regardless of which user is viewing the console. If the subscription were properly onboarded, a user with inadequate permissions would see a permission error or restricted visibility, not a complete absence of compliance data. Therefore, missing permissions explain a user's inability to see certain controls, but they do not explain why the subscription or workload shows no compliance data at all.
- B
The subscription does not have any tags applied.
Why wrong: Azure tags are logical metadata used for organising resources, cost management, or grouping by environment; they play no role in whether Defender for Cloud can collect security configuration data. The compliance scanning process reads resource properties such as network settings, storage encryption, and OS configuration, none of which depend on tag assignments. Even a subscription with zero tags will still have its resources assessed against the default Azure Security Benchmark initiative. Consequently, an absence of tags cannot cause missing compliance findings or prevent the Microsoft.Security resource provider from functioning.
- C
The subscription does not have the default policy initiative assigned.
Why wrong: The default policy initiative in Defender for Cloud is automatically assigned to every subscription when it is first onboarded, so a subscription without it would indicate a deeper onboarding failure rather than a configurable exclusion. Even if a user manually disables individual policy assignments, the compliance dashboard still shows the initiative's state and available recommendations. The key point is that the automatic assignment happens after the Microsoft.Security resource provider is registered, making an unregistered provider the root cause for a total absence of compliance data. Thus, 'no default initiative assigned' is a symptom, not a cause, of the issue described in the question.
- D
The subscription is not registered with the Microsoft.Security resource provider.
For Defender for Cloud to assess a subscription, the Microsoft.Security resource provider must be registered at the subscription level, as this registration is what allows the service to query Azure Resource Manager for resource metadata and configuration. When the provider is unregistered, Defender for Cloud cannot perform any resource discovery, so no security recommendations, regulatory compliance controls, or secure score data are generated for that subscription. Registration is typically performed automatically when a user first opens Defender for Cloud in the portal, but it can also be done programmatically via Azure CLI (`az provider register --namespace Microsoft.Security`) or PowerShell. An unregistered provider explains both the absence of data and why the user perceives that security posture is completely missing.