'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Remove Duplicate Ephemeral Hosts in Defender for Cloud
Question details
The user needs to identify and remove duplicate ephemeral host entries in Microsoft Defender for Cloud to fix distorted coverage metrics.
- Product
- Microsoft Defender for Cloud
- Device & OS
- not provided
- Scenario
- Managing virtual machine instances and onboarding configurations in Microsoft Azure cloud environments.
- Observed behavior
- Duplicate ephemeral hosts are appearing in the portal, likely caused by inconsistent hardware UUIDs, VM agent identity issues, or stale onboarding records.
Ensure you have administrative access to the Azure portal and permissions to view virtual machine hardware UUIDs and VM agent logs.
Verify Virtual Machine Agent and Host Identity
Confirm whether the entries are actual duplicates rather than separate virtual machines by inspecting their configurations and agent identities.
Duplicate metrics often result from onboarding scripts that regenerate identities rather than reusing them. Validating the UUIDs ensures you do not accidentally target active machines.
Log in to the Microsoft Defender for Cloud portal and compare the hardware UUIDs of the suspected duplicate instances.
Review the installation files and running state of the Linux VM agent on the affected instances to ensure the host identity is properly configured and persistent.
Check your automated onboarding scripts to confirm they are not inadvertently generating multiple stale records when an ephemeral host is restarted or updated.
Submit a Support Request for Reconciliation
If you have corrected the agent configurations but stale duplicate records persist, you must contact Microsoft Support to safely remove them.
Manage Cloud Security Reports and Logs with WPS Office
While troubleshooting Microsoft Defender for Cloud duplicate issues, you may need to export diagnostic logs, analyze CSV metrics, and document your cloud infrastructure. WPS Office provides a free, lightweight, and highly compatible alternative to Microsoft Office for all your data analysis and documentation tasks.
- 1. Download and Install WPS: Get WPS Office for free from the official website and follow the installation wizard to set it up on your workstation.
- 2. Open Exported Azure Logs: Launch WPS Spreadsheet and open the CSV or XLSX logs you exported from the Microsoft Defender for Cloud portal.
- 3. Analyze and Filter Duplicate Data: Use built-in data filters, conditional formatting, and pivot tables to quickly identify and organize duplicate hardware UUIDs.
Frequently Asked Questions
Why do duplicate ephemeral hosts appear in Microsoft Defender for Cloud?
Duplicates usually occur due to inconsistent hardware UUIDs, virtual machine agent identity configuration errors, or stale onboarding records generated when ephemeral nodes are frequently spun up and down.
Is it safe to manually delete a duplicate host record in the portal?
No, you should not manually delete records unless the Defender for Cloud portal provides an officially supported removal option for that exact entry. Incorrect deletion can lead to tracking issues.
What information should I include when opening a support ticket for duplicate hosts?
To expedite resolution, provide the host names, hardware UUIDs, your subscription details, the exact timestamps when the duplicates were noticed, and the corresponding VM agent logs.
