services / Azure / Custom security recommendations

Customer-defined Microsoft Defender for Cloud recommendations that evaluate resources against organization-specific security checks and surface findings for the scope.

These are custom detection checks; removing or altering them reduces detection coverage rather than affecting production data.

Microsoft.​Security/​customRecommendations/​delete

Deleting a custom recommendation removes an organization-defined detection check entirely, eliminating coverage for the condition it monitored.

Risks

1. Data manipulation (HIGH)
2. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links