Microsoft Defender for Cloud
Identity protectionRecommendations Reference Identity Access
In brief
The documentation now explains that some identity and access recommendations can appear without the Azure CSPM standard assigned, but those recommendations don't support exemptions unless the standard is assigned. It also links to assignment instructions.
What Defender admins need to know
Administrators should assign the Azure CSPM standard when they need to exempt applicable recommendations.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Azure identity and access recommendations
Note
Some Azure identity and access recommendations might appear even when the Azure CSPM standard isn't assigned, but exemptions aren't supported for recommendations without an Azure CSPM standard assignment. For the list of recommendations that don't support exemptions, see Are there any recommendations that don't support exemption?.
To assign the Azure CSPM standard, follow the steps in Assign regulatory compliance standards in Microsoft Defender for Cloud.
A maximum of 3 owners should be designated for subscriptions
Description: To reduce the potential for breaches by compromised owner accounts, we recommend limiting the number of owner accounts to a maximum of 3 (Related policy: A maximum of 3 owners should be designated for your subscription).
@@ -34,12 +34,12 @@ item_type: Content source_path: defender-for-cloud/recommendations-reference-identity-access.md cmProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/f488294d-f483-456e-94e3-755f933b811b-- https://authoring-docs-microsoft.poolparty.biz/devrel/8e3fdb08-a059-4277-98f6-c0e21e940707 - https://authoring-docs-microsoft.poolparty.biz/devrel/68ec7f3a-2bc6-459f-b959-19beb729907d+- https://authoring-docs-microsoft.poolparty.biz/devrel/8e3fdb08-a059-4277-98f6-c0e21e940707 spProducts: - https://authoring-docs-microsoft.poolparty.biz/devrel/02662057-0b9b-40f4-a3c7-537125b6d283-- https://authoring-docs-microsoft.poolparty.biz/devrel/88291526-9c74-4f87-878c-de0a82134421 - https://authoring-docs-microsoft.poolparty.biz/devrel/90370425-aca4-4a39-9533-d52e5e002a5d+- https://authoring-docs-microsoft.poolparty.biz/devrel/88291526-9c74-4f87-878c-de0a82134421 platformId: 81ce51af-0056-0652-edcf-56ff1c63ad28 --- @@ -59,6 +59,12 @@ For example, the recommendation *Endpoint protection health failures should be r
## Azure identity and access recommendations
+Note
+
+Some Azure identity and access recommendations might appear even when the Azure CSPM standard isn't assigned, but exemptions aren't supported for recommendations without an Azure CSPM standard assignment. For the list of recommendations that don't support exemptions, see [Are there any recommendations that don't support exemption?](faq-general#are-there-any-recommendations-that-don-t-support-exemption-).
+
+To assign the Azure CSPM standard, follow the steps in [Assign regulatory compliance standards in Microsoft Defender for Cloud](assign-regulatory-compliance-standards).
+
### A maximum of 3 owners should be designated for subscriptions
**Description**: To reduce the potential for breaches by compromised owner accounts, we recommend limiting the number of owner accounts to a maximum of 3 (Related policy: [A maximum of 3 owners should be designated for your subscription](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2fproviders%2fMicrosoft.Authorization%2fpolicyDefinitions%2f4f11b553-d42e-4e3a-89be-32ca364cad4c)).