แก้ไข

Manage MCSB recommendations in Defender for Cloud

Microsoft Defender for Cloud assesses resources against security policies and standards in Defender for Cloud. By default, when you onboard cloud accounts to Defender for Cloud, the Microsoft Cloud Security Benchmark (MCSB) standard is enabled. Defender for Cloud starts assessing the security posture of your resource against controls in the MCSB standard, and issues security recommendations based on the assessments.

This article describes how you can manage recommendations provided by MCSB.

Prerequisites

There are two specific roles in Defender for Cloud that can view and manage security elements:

  • Security reader: Has rights to view Defender for Cloud items such as recommendations, alerts, policy, and health. Can't make changes.
  • Security admin: Has the same view rights as security reader. Can also update security policies, and dismiss alerts.

Deny and enforce recommendations

  • Deny is used to prevent deployment of resources that don't comply with MCSB. For example, if you have a Deny control that specifies that a new storage account must meet a certain criteria, a storage account can't be created if it doesn't meet that criteria.

  • Enforce lets you take advantage of the DeployIfNotExist effect in Azure Policy, and automatically remediate noncompliant resources upon creation.

    Note

    Enforce and Deny are applicable to Azure recommendations and are supported on a subset of recommendations.

To review which recommendations you can deny and enforce, in the Security policies page, on the Standards tab, select Microsoft cloud security benchmark and drill into a recommendation to see if the deny or enforce actions are available.

Manage recommendation settings

Note

If you disable a recommendation, you also disable all its subrecommendations.

Disabled and Deny effects are available only for the Azure environment.

  1. In the Defender for Cloud portal, open Environment settings.

  2. Select the cloud account or management account where you want to manage MCSB recommendations.

  3. Open Security policies, and select the MCSB standard. Turn on the standard.

  4. Select the ellipses > Manage recommendations.

    Screenshot showing the manage effect and parameters screen for a given recommendation.

  5. Next to the relevant recommendation, select the ellipses menu, and then select Manage effect and parameters.

    • To turn on a recommendation, select Audit.
    • To turn off a recommendation, select Disabled.
    • To deny or enforce a recommendation, select Deny.

Enforce a recommendation

You can only enforce a recommendation from the recommendation details page.

  1. In the Defender for Cloud portal, open the Recommendations page, and select the relevant recommendation.

  2. In the top menu, select Enforce.

    Screenshot showing how to enforce a given recommendation.

  3. Select Save.

The enforce setting takes effect immediately, but recommendations update based on their freshness interval, up to 12 hours.

Modify additional recommendation parameters

You might want to configure extra parameters for some recommendations. For example, diagnostic logging recommendations have a default retention period of one day. You can change the default retention period value.

In the recommendation details page, the Additional parameters column indicates whether a recommendation has associated extra parameters.

  • Default. The recommendation runs with the default configuration.
  • Configured. The recommendation's configuration is modified from its default values.
  • None. The recommendation doesn't require any extra configuration.

  1. Next to the MCSB recommendation, select the ellipses menu, and then select Manage effect and parameters.

  2. In Additional parameters, configure the available parameters with new values.

  3. Select Save.

If you want to revert changes, select Reset to default to restore the default value for the recommendation.

Identify conflicts between recommendation settings

Potential conflicts can arise when you have multiple assignments of standards with different values.

  1. To identify conflicts in effect actions, in Add, select Effect conflict > Has conflict to identify any conflicts.

    Screenshot showing how to manage assignment of standards with different values.

  2. To identify conflicts in additional parameters, in Add, select Additional parameters conflict > Has conflict to identify any conflicts.

  3. If conflicts are found, in Recommendation settings, select the required value, and save.

All standard assignments in the selected scope are aligned with the value you selected in Recommendation settings, resolving the conflict.

Related content

  • Last updated on