In accurate results on Defender CSPM workbook

Hello team ,

I am reaching out to you regarding the following item.
https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workbooks/Defender%20CSPM%20Dashboard

Now when we see this Workbook on Azure Portal , when we check for Agentless scanning for machine part we see 2 results , I wanted to understand why it shows 2 results as both the subscriptions are same .

Secondly the query use in this workbook seems to be buggy , specially the line number 7 , please help us correcting the logic , [

](url)

securityresources
| where type == "microsoft.security/pricings"
| where name in~("CloudPosture", "VirtualMachines", "Containers", "StorageAccounts")
| mv-expand extensions = properties.extensions
| extend extensionName = tostring(extensions.name)
| where extensionName in~("AgentlessVmScanning")
**| extend agentLessVMScan = iff(name in~ ("CloudPosture", "VirtualMachines") and extensionName == "AgentlessVmScanning" and tostring(extensions.isEnabled) == "True", "Good", "Should Enable")**
| distinct subscriptionId, agentLessVMScan

Start in Workbooks/Defender CSPM Dashboard and reproduce the Agentless scanning results in the Azure portal. Read the displayed query, especially the highlighted line and its distinct subscription output, then compare the two subscriptions and determine the expected single-result behavior. Done means the duplicate result is explained and the workbook query logic is corrected and validated.

Written by the indexing model from the issue text.