CLASSIC SECURE SCORE STILL SHOWS A DEPRECATED RECOMMENDATION

Raja P 0 Reputation points
2026-09-09T10:59:13.81+00:00

CLASSIC SECURE SCORE STILL SHOWS A DEPRECATED RECOMMENDATION | Why does Classic Secure Score still show unhealthy resources after a grouped recommendation was deprecated?

Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
0 comments
Answer accepted by question author
Givary-MSFT 35,911 Reputation points Microsoft Employee Moderator
2026-09-09T11:10:55.36+00:00

@Raja P

Microsoft Defender for Cloud completed its transition from grouped recommendations, also known as sub-assessments, to individual recommendations.

During this transition, some Classic Secure Score controls can continue to receive posture signals from assessments that are now represented through individual recommendations. This can result in the following behavior:

- Classic Secure Score shows unhealthy resources.

- The previous grouped recommendation is no longer visible.

- The visible recommendations appear completed.

- The control does not receive its expected full score.

To investigate:

  1. Open Defender for Cloud > Recommendations.
  2. Switch to Risk view.
  3. Identify the affected Secure Score control.
  4. Use the recommendation transition reference to map the retired recommendation to its replacement.
  5. Search for the replacement assessment ID or filter by the replacement recommendation category.
  6. Review and remediate the individual findings.

The visible recommendation list in Classic Secure Score might not show every assessment contributing to the control. The individual recommendation experience should be used to investigate the underlying findings.

Reference:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/transition-grouped-individual-recommendations#classic-secure-score-behavior-after-the-transition

Was this answer helpful?

2 people found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-09T10:59:26.0966667+00:00

    Yes. This is expected behavior in some cases.

    After the transition from grouped recommendations to individual recommendations, the classic Secure Score in the Azure portal can still show a resource as unhealthy under a control even when the old grouped recommendation is no longer visible. The underlying reason is that the resource now has associated security findings represented through the individual recommendations model.

    What to do:

    1. In Microsoft Defender for Cloud, open Recommendations.
    2. Switch to Risk view. This is the recommended view to investigate the underlying findings.
    3. Review the current individual recommendations that now represent that deprecated grouped recommendation.
    4. If needed, filter by the relevant recommendation category such as:
      • SoftwareUpdate
      • SystemUpdate
      • HostMisconfigurations
      • ExposedSecrets
      • CodeVulnerabilities
      • IacVulnerabilities
      • ApiVulnerabilities

    Key points:

    • The classic Secure Score was kept functionally stable during the transition.
    • Recommendation volume can increase because individual findings are more granular and actionable.
    • An unhealthy classic control does not necessarily mean the deprecated recommendation is still active; it can reflect the newer individual findings instead.
    • The classic view is still available in the Azure portal under Microsoft Defender for Cloud > Recommendations > Switch to classic view.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.