Once Security Center is enabled in your subscription, you will see a series of security recommendations that are directly correlated with your secure score. The secure score is the accumulation of all recommendations scores that are relevant for your workloads.
This means that each subscription may have a completely different total value (accumulation score), since it will vary according to the number of workloads that you have on each subscription and their current secure state. To drive your secure score up, you need to address each individual recommendation, as each recommendation has a direct impact in your secure score. Under the Recommendations blade, you can see a list of all recommendations organized by secure score impact.
When you click on each individual recommendation you will see its description, some additional information about the recommended score, the threats that it is addressing, and the steps to remediate. Security Center typically scans for new data every hour, and refreshes the recommendations accordingly, which means that once you remediate a specific recommendation, the recommendation won’t disappear immediately from the dashboard, only on the next refresh.
Fine tuning your recommendations
In some circumstances, you may identify that a particular recommendation is not applicable for your environment. Sometimes this happens because you are already using a security countermeasure that it was not taken in consideration by Security Center. For example, if you are using a third-party MFA solution, Security Center will still trigger the MFA recommendation, since it is not aware that there is a countermeasure in place. If this is the case, you should disable the security assessment that triggers this recommendation to avoid having a negative impact in your secure score (since you will never remediate this recommendation), and also to stop receiving this recommendation (which in this case can be considered as a false positive for your environment).
While fine tuning your assessments is something that you may need to do in order to adequate with your organization’s needs, make sure to document the rationale behind disabling each assessment. From the change control and governance perspective, it is critical to track changes and the reasons behind those policy changes.
To fine tune your recommendations, you will need to disable the security assessment that triggers the recommendation. Follow the steps below to do that:
1. Open Security Center dashboard.
2. On the left navigation pane, click Security Policy.
3. Click on the subscription that has the policy that you want to change it:
4. When the Security policy blade opens, click the hyperlink for the Azure Policy, as shown below:
6. At the bottom of this blade, click Save.
7. Wait until you see the notification that the update was successfully committed, as shown in the sample below:
