Storage account private endpoint recommendation not applicable – how to exempt or resolve Defender alert?

Rishabh Gupta (MAQ LLC) 40 Reputation points Microsoft External Staff
2026-05-15T06:09:58.84+00:00

We are observing a Microsoft Defender for Cloud recommendation related to our Azure Storage account:

“Storage accounts should use a private endpoint connection”

Current scenario:

  • The storage account is already secured using network/firewall rules and restricted access.
  • All dependent resources (App Services, services, etc.) are already secured behind controlled network boundaries.
  • Public exposure risk is mitigated through existing architecture.

However:

  • Defender still flags the recommendation for private endpoint.
  • In our case, private endpoints are not required due to existing security controls and design constraints.
  • We are unable to remove or suppress this recommendation directly.

We have previously seen similar behavior where Defender recommendations depend on properties like publicNetworkAccess or networkAcls.defaultAction, even when other protections are applied.We are observing a Microsoft Defender for Cloud recommendation related to our Azure Storage account:

“Storage accounts should use a private endpoint connection”

Current scenario:

  • The storage account is already secured using network/firewall rules and restricted access.
  • All dependent resources (App Services, services, etc.) are already secured behind controlled network boundaries.
  • Public exposure risk is mitigated through existing architecture.

However:

  • Defender still flags the recommendation for private endpoint.
  • In our case, private endpoints are not required due to existing security controls and design constraints.
  • We are unable to remove or suppress this recommendation directly.

We have previously seen similar behavior where Defender recommendations depend on properties like publicNetworkAccess or networkAcls.defaultAction, even when other protections are applied.

Questions

  1. Is it possible to mark this recommendation as “Not Applicable” or create an exemption in Microsoft Defender for Cloud?
  2. What is the recommended approach to suppress or manage such alerts when the architecture already complies with security requirements?
  3. Is this recommendation strictly enforced based on policy evaluation, or can it be tuned based on environment-specific design?
  4. Are there any best practices for handling false-positive or non-applicable Defender recommendations?
Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
Answer accepted by question author
Shubham Sharma 17,925 Reputation points Microsoft External Staff Moderator
2026-05-18T06:20:42.57+00:00

Rishabh Gupta (MAQ LLC)

As Discussed over team the below steps worked and the issue has been resolved now.

  1. Marking a recommendation “Not Applicable” / creating an exemption      • Defender for Cloud recommendations come from built-in policies (in this case “storage-accounts-should-use-private-endpoint”). You can’t toggle that recommendation off in the Defender UI itself, but you can create a Policy Exemption so the policy won’t evaluate your storage account.      • In the Azure portal go to Policy > Exemptions > + Add exemption, pick the scope (subscription/resource), select the policy definition for “storage accounts should use a private endpoint connection,” and choose your reason (Risk Accepted / Not Applicable). Once saved, that storage account will drop off that recommendation.      • You can also use PowerShell (New-AzPolicyExemption) or the REST API if you prefer automation.

 

  1. Suppressing or managing the alert      • If you just want to ignore it short-term, you can “Dismiss” the recommendation in the Defender for Cloud blade (open the rec, click Dismiss, choose a dismissal reason). It stays hidden for the period you pick but doesn’t change your policy evaluation.      • For a more permanent solution, stick with the policy exemption approach or build a custom policy copy that excludes storage accounts tagged “NoPrivateEndpoint” (for example), then assign that instead of the built-in.

 

  1. Policy-driven enforcement vs. tuning      • Yes—the recommendation is strictly enforced by the built-in Azure Policy. There’s no per-resource toggle inside Defender; you tune it either by adjusting the policy assignment parameters, creating exemptions, or replacing it with a tailored/custom policy definition that matches your design.

 

  1. Best practices for false positives / non-applicable recommendations      • Use Policy Exemptions to formally “skip” policies on known exceptions and document why.      • Keep a central inventory (or tags) of exempted resources so you can review them regularly.      • Where possible, build custom policies scoped to resource groups or tags instead of disabling entire subscriptions.      • If you believe this rec should be more flexible, open a support request—Microsoft may update the policy to allow additional parameters in future.

 

Reference list   1. Understand and implement storage account recommendations in Defender for Cloud   https://learn.microsoft.com/azure/defender-for-cloud/review-security-recommendations   2. Configure network access to Azure Storage   https://learn.microsoft.com/azure/storage/common/storage-network-security?tabs=azure-portal#configu…   3. Configure firewalls and virtual networks for Storage accounts   https://learn.microsoft.com/azure/storage/common/storage-network-security   4. Connect to a storage account using an Azure Private Endpoint   https://learn.microsoft.com/azure/private-link/tutorial-private-endpoint-storage-portal?tabs=dynami…   5. Defender for Cloud release notes (exemption feature info)   https://learn.microsoft.com/azure/defender-for-cloud/release-notes-archive?wt.mc_id=knowledgesearch…

If the resolution was helpful, please take a moment to accept the answer and upvote it 👍 to make it helpful to the community.

Thank you for contacting Microsoft Q&A!

 

Was this answer helpful?

1 person found this answer helpful.
0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.