If you are using Security Center’s Secure Score today (and you should!), you are able to disable specific recommendations which may not be relevant to you. By navigating to the ASC’s default initiative in the Azure Policy blade, you can disable a recommendation:
This would exclude the recommendation from your Secure Score.
But what if you want to quickly find which recommendations have been disabled?
Since Azure Policy is the technology behind ASC's recommendations, you can leverage the Az PowerShell module and specifically the AzPolicy* Cmdlets:
Using Get-AzPolicyAssignment I can query the ASC Default Initiative:
$PolicyAssignment = Get-AzPolicyAssignment | Where-Object {$_.name -eq "SecurityCenterBuiltIn"}
This captures the information in a variable which we can use to reveal disabled recommendations:
$PolicyAssignment.Properties.parameters
That gives us the following output:
I could then interact further with this assignment using additional PowerShell cmdlets.
Microsoft
