Assign a recommendation to an active user

Microsoft Defender for Cloud has an active user feature. It helps security admins find the users who most often fix recommendations. To keep cloud resources safe, admins need to track and address potential threats and related recommendations.

The active user feature suggests up to three users. Defender for Cloud bases its suggestions on each user's control plane activity on the resource, its resource group, or the subscription. This feature speeds up fixes and strengthens your security posture.

Admins can assign the recommendation to the best user from the suggested list. That user gets a notification and a due date, so no one has to figure out who is responsible. This approach saves time for security teams.

Prerequisites

Before you start, make sure you meet these requirements:

• Enable the Defender for Cloud Security Posture Management (Defender CSPM) plan.

• Make sure you have one of the following roles and permissions:

  • Security Administrator
  • Owner
  • Contributor

• Review cloud availability.

Assign a recommendation

To assign a recommendation to an active user:

1. Sign in to the Azure portal.

2. Go to Defender for Cloud > Recommendations.

3. Review the Recommendation owner column.

   

4. Select a recommendation that has a suggested owner.

5. In the Recommendation owner and set due date section, find the top suggested active user for the resource.

   

6. Select Assign owner & set due date.

7. Review the activity details and confidence of the top three suggested users.

   

8. To view more information about the user, select More info. You can see a user's name, email address, manager, department, role, and last activities.

9. (Recommended) Select an owner from the list of suggested users.

10. (Optional) Select Add a user manually if you don't want to assign any of the suggested users.

11. (Optional) Select a remediation time frame.

12. (Optional) Turn on the Apply grace period toggle.

13. (Optional) Set email notifications.

14. Select Create.

If you set an email notification, the user gets an email. The email includes the recommendation details and a link to view it in Defender for Cloud.

Next steps