Defender for Cloud: no assessments, secure score, or compliance standards on one subscription, while an identically configured sibling works

Question

Summary

Microsoft Defender for Cloud is enabled on one of our Azure subscriptions but has never produced any assessments, secure score, or regulatory compliance standards. A second subscription, onboarded six minutes later with identical configuration, works correctly.

Both subscriptions contain zero resources, so the expected output is the set of subscription-level assessments (enable-plan recommendations, security contact, and similar).

I can supply both subscription IDs privately if needed.

Configuration - identical across both

Setting	Both subscriptions
Defender plans (all 18)	Same tiers, including `FoundationalCspm: Standard` and `AppServices: Standard`
`Microsoft.Security` resource provider	Registered
MCSB policy assignment	`SecurityCenterBuiltIn` present
Azure Policy evaluation	Completed, 17 non-compliant states each
Security contact	Configured, High-severity alert notifications on
Resources / resource groups	0 / 0

Onboarding times were 2026-08-05 20:59:40Z (working) and 21:04:49Z (faulty).

Outcome - divergent

Artefact	Working subscription	Faulty subscription
Assessments	16	0
Secure score objects	1	0
Regulatory compliance standards	2	0

Troubleshooting already performed

Waited over 40 hours after initial enablement.
Opened the faulty subscription's Security blade in the portal, in case of lazy per-subscription initialisation. No effect.
Confirmed FoundationalCspm is Standard, ruling out the free plan being disabled.
Issued a no-op PUT of the AppServices pricing. The resource provider ignored it - enablementTime was not re-stamped.
Performed a full Standard -> Free -> Standard transition on 2026-08-07 at 10:40:04Z. This did re-stamp enablementTime, confirming a genuine configuration change event was raised. Waited a further two hours: still zero across all three artefacts.

The free-trial timer decrements normally on the faulty subscription (28 days remaining), so the plan is active at the control plane while the data plane produces nothing.

Question

Why has the assessment and secure score projection layer never initialised for this subscription, and can it be re-triggered server-side?

Answer

Resolved

The subscription started producing security data roughly 24 hours after a full plan state transition. It now reports 23 assessments and 2 regulatory compliance standards, against 25 and 3 on the working sibling.

What fixed it

A genuine Standard -> Free -> Standard transition on the Defender plan:

az security pricing create --name AppServices --tier Free --subscription 
az security pricing create --name AppServices --tier Standard --subscription

The detail that matters

A no-op PUT does nothing. Re-issuing az security pricing create --name AppServices --tier Standard while the plan is already Standard returns HTTP 200 with the resource, but the resource provider treats it as a no-op: enablementTime is not re-stamped, and no configuration change event appears to be raised. It looks like you have re-enabled the plan when you have not.

Only the transition through Free produced a fresh enablementTime, and that is what preceded the data appearing. Nothing else moved the needle: waiting 40+ hours, opening the subscription's Security blade in the portal, and confirming FoundationalCspm was already Standard all had no effect.

Timing

The projection did not appear within the two hours I initially watched. It took several hours more, so allow up to 24 hours after the toggle before concluding it has not worked.

Residual

Assessments and compliance standards are present, but the subscription still returns no secure score object. The working sibling reports a score of 0.0 out of 0, which is expected with no resources deployed, so this may simply be the last projection to catch up rather than a separate fault.