Transition from grouped to individual recommendations in Defender for Cloud

Overview

Microsoft Defender for Cloud has completed the transition from grouped recommendations, also known as sub-assessments, to individual recommendations.

Individual recommendations provide a more granular view of security findings. Instead of aggregating multiple findings under a grouped recommendation, each finding is represented as an individual recommendation that can be investigated, prioritized, and remediated separately.

Grouped recommendations were deprecated on July 31, 2026. Customers should use individual recommendations as the primary model for investigation and remediation.

This article explains the operational impact of the transition and how to update existing workflows, queries, governance rules, exemptions, and continuous export configurations.

If you need to update existing configurations or queries, use the recommendation transition reference at the end of this article. It maps each deprecated grouped recommendation to its recommendation ID and current recommendation category or replacement recommendation.

Grouped vs. individual recommendations

The following table summarizes the behavioral and operational differences between grouped and individual recommendations.

Modeling changes examples:

• VM vulnerabilities → Recommendation per software update.
• Secrets → Recommendation per key/secret type.
• SQL VA rules → Each rule becomes an independent recommendation.

Adopting individual recommendations

Best practice: Use individual recommendations as your primary model for investigation and remediation.

Individual recommendations are the current posture model in Defender for Cloud. They provide clear benefits:

• Granular & accurate prioritization – Each finding is scored individually, helping you focus on what reduces risk fastest.

• Improved clarity & governance – Ownership, exemptions, and workflows can be applied at the right level (per finding).

• Consistency across Defender – A single, unified model going forward.

• Future‑proof – This is the model that will continue to evolve and be fully supported.

What changed

• Each finding appears as a separate recommendation.
• Recommendation volume can be higher because findings are represented individually.
• Prioritization is applied at the individual finding level.

Where to start

• Begin reviewing and triaging individual recommendations for day-to-day security work
• Use individual recommendations to drive investigation, remediation, ownership, and exemptions
• Expect a more detailed and actionable queue compared to grouped recommendations

Transition example: vulnerability management

Vulnerability management is one of the most common areas where the transition has a direct operational impact. For many security and compliance teams, querying and tracking machine vulnerabilities is a core daily workflow. The following example shows what changes and how to adapt.

Before (grouped recommendations model):

The recommendation Machines should have vulnerability findings resolved aggregated all vulnerability findings across your machines into one entry per machine. You queried this using sub-assessments in Azure Resource Graph, filtering by recommendation ID and resource type.

After (individual recommendations model):

Each individual recommendation has a list of vulnerability findings. Instead of one aggregated entry per machine, you see individual findings per vulnerable software package, spanning Azure VMs, AKS nodes, EC2 instances, GCP instances, and containers, within the SoftwareUpdate and ServiceUpgrade recommendation categories.

Update your Azure Resource Graph queries

Old query (grouped recommendations):

securityresources
| where type =~ "microsoft.security/assessments/subassessments"
| where id contains "1195afff-c881-495e-9bc5-1486211ae03f"
| where properties.resourceDetails.id contains "microsoft.compute/virtualmachines"
| extend DisplayName = tostring(properties.displayName)
| extend Severity = tostring(properties.status.severity)
| extend SoftwareVersion = tostring(properties.additionalData.softwareVersion)
| extend RecommendedVersion = tostring(properties.additionalData.recommendedVersion)
| mv-expand CVE = properties.additionalData.cve
| extend CVE_Title = tostring(CVE["title"])
| project DisplayName, Severity, SoftwareVersion, RecommendedVersion, CVE_Title

New query (individual recommendations):

securityresources
| where type == "microsoft.security/assessments"
| where properties.resourceDetails.ResourceType =~ "microsoft.compute/virtualmachines"
| where properties.metadata.recommendationCategory == "SoftwareUpdate"
| extend DisplayName = tostring(properties.displayName)
| extend Severity = tostring(properties.metadata.severity)
| extend DetectedVersions = tostring(properties.additionalData.DetectedSoftwareVersions)
| extend FixedVersion = tostring(properties.additionalData.FixedVersion)
| extend CvesDetails = parse_json(tostring(properties.additionalData.CvesDetails))
| mv-expand CveDetail = CvesDetails
| extend CveId = tostring(CveDetail.CveId)
| project DisplayName, Severity, DetectedVersions, FixedVersion, CveId

securityresources
| where type =~ "microsoft.security/cvedetails"

Key field changes between the two schemas:

Investigating and prioritizing at scale

Individual recommendations introduce increased granularity. To help you focus on the issues that matter most and handle the increased granularity of individual recommendations, Defender for Cloud provides several tools and views designed to assist you with effective investigation.

Category tabs

• Start investigations within the security category most relevant to your team's ownership or risk domain
• Use categories to reduce noise and focus effort

Available categories include:

• All – Full posture view
• Misconfigurations – Configuration-based risks
• Vulnerabilities – Software and platform vulnerabilities
• Secrets – Exposed keys and secrets

Prioritizing high-impact issues

Best practice: Make Critical and High risk levels your default operating view.

• Filter recommendations by risk level
• Address high-impact issues first to reduce risk quickly

Using aggregation views effectively

Aggregated views help align remediation to your workflow:

• View by title
  • Show all assets for a single recommendation
  • Suitable for bulk remediation across multiple resources
• View by resource
  • Shows all recommendations for a single asset
  • Suitable for asset-level investigation or isolating high-risk machines

Choose the aggregation that matches the task:

• Widespread issue remediation: View by title
• Asset investigation: View by resource

How to manage the new individual recommendations

With the transition to individual recommendations complete, Microsoft Defender for Cloud continues to support Governance rules, Continuous export, and Exemptions. The main change is how these actions are scoped.

Individual recommendations are created per software update, secret, or issue type. Because they are generated according to your resources' current state, actions are no longer applied to a single static recommendation. Instead, management actions are now applied at the recommendation category level.

Governance rules, Continuous export, and Exemptions continue to work as they do today, but instead of targeting a grouped recommendation key, you now target a recommendation category. Each category automatically includes all current and future individual recommendations of that type.

The updated management experience is available in Environment settings, under Governance rules and Exemption rules, where you can apply ownership, automation, or exemptions consistently across an entire category of individual recommendations.

Classic secure score behavior after the transition

After the transition from grouped recommendations to individual recommendations, some classic secure score controls in the Azure portal can be affected by findings that are now represented through the individual recommendations model.

In some cases, a resource might appear as unhealthy in a secure score control even though the previous grouped recommendation is no longer visible under that control.

When this occurs, the applicable resources have associated security findings that contribute to the posture signal for that area. To investigate the underlying findings, switch to Risk view, which is the recommended view for reviewing and prioritizing findings.

Risk view provides the current, granular recommendation experience and helps you identify the specific findings that should be reviewed or remediated.

This behavior is expected as part of the transition to individual recommendations. The classic secure score in the Azure portal was designed to remain functionally stable through this transition while customers move to the individual recommendations model for investigation and remediation.

Remediate vulnerabilities

Enable access management

The following recommendations were replaced by single new recommendations. Use the new assessment key for future governance, exemption, and export configurations.

Implement security configuration best practices

Apply system updates

If one of these secure score controls shows unhealthy resources but the underlying grouped recommendation isn't visible, review the applicable findings in Risk view. The findings are represented through the current individual recommendations model rather than the deprecated grouped recommendation experience.

What you should do now

• Use individual recommendations as the primary model for investigation and remediation.
• Use Risk view to identify and prioritize findings associated with unhealthy resources.
• Update Azure Resource Graph queries, governance rules, continuous export configurations, and exemption workflows that relied on grouped recommendations or sub-assessments.
• Use recommendation categories, such as SoftwareUpdate, SystemUpdate, HostMisconfigurations, and ExposedSecrets, where applicable.
• Expect recommendation volume to increase in some areas because individual findings provide more actionable detail. This increase doesn't necessarily indicate that risk increased.
• Use the recommendation transition reference to identify the current recommendation category or replacement recommendation.
• Complete your migration from disable rules to exemptions.

Recommendation transition reference

Use this reference to map each deprecated grouped recommendation to its recommendation ID and current recommendation category or replacement recommendation. Recommendations are organized by product. This is your reference for:

• Updating governance rules, exemption rules, and continuous export — these now target a recommendation category instead of a specific recommendation key. Find the category for each recommendation you currently manage, then update your configurations to use that category.
• Migrating queries — replace grouped recommendation IDs with the microsoft.security/assessments resource type and filter by properties.metadata.recommendationCategory. The recommendation ID column helps you verify you're targeting the right recommendations.

Each grouped recommendation transitioned to one of two end states:

• Replaced by individual recommendations — The grouped recommendation is replaced by individual recommendations generated dynamically per finding. Update governance rules, exemptions, and continuous export to target the Recommendation category instead of the recommendation ID.
• Replaced by a single new recommendation — The grouped recommendation is replaced by a specific new individual recommendation with a fixed recommendation ID. The recommendation category shows as Unknown. Update your configurations to use the New recommendation ID directly — don't use the category filter for these recommendations.

Microsoft Defender for Servers

The following grouped recommendations transitioned under Microsoft Defender for Servers.

How to review findings: Remediate machine vulnerabilities

Replaced by individual recommendations — update governance rules, exemptions, and continuous export to use the recommendation category:

Replaced by individual recommendations — the following grouped recommendations are deprecated and don't have a single direct replacement. They are replaced by new individual recommendations now available in Defender for Cloud.

New individual recommendations

Microsoft Defender for Databases

The following grouped SQL recommendations transitioned under Microsoft Defender for Databases. After the transition, each SQL vulnerability assessment rule appears as an individual recommendation reported on the database resource instead of the server resource. To analyze findings for an Azure SQL database, open the resource in the Azure portal, go to Microsoft Defender for Cloud, and select the specific finding to see the rule description, severity, and remediation guidance. For SQL servers on machines, open the Recommendations page in Defender for Cloud, find the relevant individual recommendation, and follow the same remediation steps.

Learn about remediation approaches and how to review findings.

Deprecated recommendations — the following grouped recommendations are deprecated and don't have a single direct replacement. They are replaced by the new individual SQL vulnerability assessment recommendations now available in Defender for Cloud. For the full list, see SQL vulnerability assessment rules and recommendations mapping.

Microsoft Defender for Containers

The following grouped recommendations transitioned under Microsoft Defender for Containers. After the transition, container vulnerability findings appear as individual recommendations, with each vulnerable image layer or package surfaced as a separate finding.

How to review findings: View and remediate vulnerabilities for containers running on Kubernetes clusters | View and remediate vulnerability assessment findings for registry images

Replaced by individual recommendations — update governance rules, exemptions, and continuous export to use the recommendation category:

Microsoft Defender for DevOps

The following grouped recommendations transitioned under Microsoft Defender for DevOps. After the transition, individual findings for code scanning, dependency vulnerabilities, secrets, infrastructure as code issues, and API security appear in the relevant recommendation categories.

How to review findings: In Defender for Cloud, go to Recommendations and filter by the relevant category: ApiVulnerabilities, SoftwareUpdate, CodeVulnerabilities, IacVulnerabilities, or ExposedSecrets. Select any individual recommendation to view the affected repository, finding details, and remediation steps.

Replaced by individual recommendations — update governance rules, exemptions, and continuous export to use the recommendation category:

Microsoft Defender for Identity

Replaced by a single new recommendation — the following grouped recommendations are each replaced by a specific new individual recommendation with a fixed assessment key. Update your governance rules, exemptions, and continuous export to use the new assessment key directly.

Important: Exemption rules for these replacement recommendations are available only to paid customers. Non-paying customers will lose exemption capabilities for these recommendations when the original assessments are retired.

Next steps

• Review security recommendations
• Remediate security recommendations
• Security recommendations overview
• Transition from disable rules to exemptions