services / Azure / Custom security recommendations

Customer-defined Microsoft Defender for Cloud recommendations that evaluate resources against organization-specific security checks and surface findings for the scope.

These are custom detection checks; removing or altering them reduces detection coverage rather than affecting production data.

Microsoft.​Security/​customRecommendations/​write

Editing a custom recommendation can loosen its logic so the attacker's misconfiguration no longer triggers a finding, manipulating what the posture surface reports.

Risks

1. Data manipulation (HIGH)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links