Merge pull request #262014 from dcurwin/wi2-161154-status-code-dec28-2023

Disabling parent assessments

Author: v-ccolin

articles/defender-for-cloud/exempt-resource.md

@@ -8,16 +8,15 @@ author: dcurwin
 ms.date: 10/29/2023
 ---
 
-# Exempt resources from recommendations 
+# Exempt resources from recommendations
 
-
-When you investigate security recommendations in Microsoft Defender for Cloud, you usually review the list of affected resources. Occasionally, a resource will be listed that you feel shouldn't be included. Or a recommendation will show in a scope where you feel it doesn't belong. For example, a resource might have been remediated by a process not tracked by Defender for Cloud, or a recommendation might be inappropriate for a specific subscription. Or perhaps your organization has decided to accept the risks related to the specific resource or recommendation.
+When you investigate security recommendations in Microsoft Defender for Cloud, you usually review the list of affected resources. Occasionally, a resource is listed that you feel shouldn't be included. Or a recommendation shows in a scope where you feel it doesn't belong. For example, a resource might be remediated by a process not tracked by Defender for Cloud, or a recommendation might be inappropriate for a specific subscription. Or perhaps your organization decided to accept the risks related to the specific resource or recommendation.
 
 In such cases, you can create an exemption to:
 
-- **Exempt a resource** to ensure it isn't listed with the unhealthy resources in the future, and doesn't impact your secure score. The resource will be listed as not applicable and the reason will be shown as "exempted" with the specific justification you select.
+- **Exempt a resource** to ensure it isn't listed with the unhealthy resources in the future, and doesn't affect your secure score. The resource will be listed as not applicable and the reason will be shown as "exempted" with the specific justification you select.
 
-- **Exempt a subscription or management group** to ensure that the recommendation doesn't impact your secure score and won't be shown for the subscription or management group in the future. This relates to existing resources and any you create in the future. The recommendation will be marked with the specific justification you select for the scope that you selected.
+- **Exempt a subscription or management group** to ensure that the recommendation doesn't affect your secure score and won't be shown for the subscription or management group in the future. This relates to existing resources and any you create in the future. The recommendation will be marked with the specific justification you select for the scope that you selected.
 
 For the scope you need, you can create an exemption rule to:
 
@@ -26,17 +25,17 @@ For the scope you need, you can create an exemption rule to:
 
 ## Before you start
 
-This feature is in preview. [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)] This is a premium Azure Policy capability that's offered at no additional cost for customers with Microsoft Defender for Cloud's enhanced security features enabled. For other users, charges might apply in the future.
+This feature is in preview. [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)] This is a premium Azure Policy capability offered at no extra cost for customers with Microsoft Defender for Cloud's enhanced security features enabled. For other users, charges might apply in the future.
 
 - You need the following permissions to make exemptions:
-    - **Owner** or **Security Admin** or **Resource Policy Contributor** to create an exemption
-    - To create a rule, you need permissions to edit policies in Azure Policy. [Learn more](../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
+  - **Owner** or **Security Admin** or **Resource Policy Contributor** to create an exemption
+  - To create a rule, you need permissions to edit policies in Azure Policy. [Learn more](../governance/policy/overview.md#azure-rbac-permissions-in-azure-policy).
 
 - You can create exemptions for recommendations included in Defender for Cloud's default [Microsoft cloud security benchmark](/security/benchmark/azure/introduction) standard, or any of the supplied regulatory standards.
 - Custom recommendations can't be exempted.
+- If a recommendation is disabled, all of its subrecommendations are exempted.
 - In addition to working in the portal, you can create exemptions using the Azure Policy API. Learn more [Azure Policy exemption structure](../governance/policy/concepts/exemption-structure.md).
 
-
 ## Define an exemption
 
 To create an exemption rule:
@@ -49,7 +48,7 @@ To create an exemption rule:
 
 1. In the **Exempt** pane:
     1. Select the scope for the exemption.
-        - If you select a management group, the recommendation will be exempted from all subscriptions within that group
+        - If you select a management group, the recommendation is exempted from all subscriptions within that group
         - If you're creating this rule to exempt one or more resources from the recommendation, choose "Selected resources" and select the relevant ones from the list
 
     1. Enter a name for the exemption rule.
@@ -60,20 +59,19 @@ To create an exemption rule:
             > [!NOTE]
             > When you exempt a recommendation as mitigated, you aren't given points towards your secure score. But because points aren't *removed* for the unhealthy resources, the result is that your score will increase.
 
-        - **Risk accepted (waiver)** – if you’ve decided to accept the risk of not mitigating this recommendation
+        - **Risk accepted (waiver)** – if you decided to accept the risk of not mitigating this recommendation
     1. Enter a description.
     1. Select **Create**.
     :::image type="content" source="media/exempt-resource/defining-recommendation-exemption.png" alt-text="Steps to create an exemption rule to exempt a recommendation from your subscription or management group."  lightbox="media/exempt-resource/defining-recommendation-exemption.png":::
 
-
 ## After creating the exemption
 
-After creating the exemption it can take up to 30 minutes to take effect. After it takes effect:
- 
+After creating the exemption, it can take up to 30 minutes to take effect. After it takes effect:
+
 - The recommendation or resources won't impact your secure score.
-- If you've exempted specific resources, they'll be listed in the **Not applicable** tab of the recommendation details page.
-- If you've exempted a recommendation, it will be hidden by default on Defender for Cloud's recommendations page. This is because the default options of the **Recommendation status** filter on that page are to exclude **Not applicable** recommendations. The same is true if you exempt all recommendations in a security control.
+- If you exempted specific resources, they'll be listed in the **Not applicable** tab of the recommendation details page.
+- If you exempted a recommendation, it will be hidden by default on Defender for Cloud's recommendations page. This is because the default options of the **Recommendation status** filter on that page are to exclude **Not applicable** recommendations. The same is true if you exempt all recommendations in a security control.
 
 ## Next steps
 
-[Review exempted resources](review-exemptions.md) in Defender for Cloud. 
+[Review exempted resources](review-exemptions.md) in Defender for Cloud.

articles/defender-for-cloud/manage-mcsb.md

@@ -22,7 +22,7 @@ This article describes how you can manage recommendations provided by MCSB.
 
 - **Deny** is used to prevent deployment of resources that don't comply with MCSB. For example, if you have a Deny control that specifies that a new storage account must meet a certain criteria, a storage account can't be created if it doesn't meet that criteria.
 
-- **Enforce** lets you take advantage of the **DeployIfNotExist** effect in Azure Policy, and automatically remediate non-compliant resources upon creation.
+- **Enforce** lets you take advantage of the **DeployIfNotExist** effect in Azure Policy, and automatically remediate noncompliant resources upon creation.
 
     > [!NOTE]
     > Enforce and Deny are applicable to Azure recommendations and are supported on a subset of recommendations.
@@ -33,6 +33,9 @@ To review which recommendations you can deny and enforce, in the **Security poli
 
 You can enable/disable, deny and enforce recommendations.
 
+> [!NOTE]
+> If a recommendation is disabled, all of its subrecommendations are exempted.
+
 1. In the Defender for Cloud portal, open the **Environment settings** page.
 
 1. Select the subscription or management group for which you want to manage MCSB recommendations.
@@ -60,14 +63,11 @@ You can only enforce a recommendation from the recommendation details page.
 
 1. Select **Save**.
 
-The setting will take effect immediately, but recommendations will update based on their freshness interval (up to 12 hours).
-
-
-
+The setting takes effect immediately, but recommendations will update based on their freshness interval (up to 12 hours).
 
 ## Modify additional parameters
 
-You might want to configure additional parameters for some recommendations. For example diagnostic logging recommendations have a default retention period of one day. You can change that default value.
+You might want to configure additional parameters for some recommendations. For example, diagnostic logging recommendations have a default retention period of one day. You can change that default value.
 
 In the recommendation details page, the **Additional parameters** column indicates whether a recommendation has associated additional parameters.
 
@@ -94,11 +94,12 @@ Potential conflicts can arise when you have multiple assignments of standards wi
     :::image type="content" source="./media/manage-mcsb/effect-conflict.png" alt-text="Screenshot showing how to manage assignment of standards with different values." lightbox="./media/manage-mcsb/effect-conflict.png":::
 
 1. To identify conflicts in additional parameters, in **Add**, select **Additional parameters conflict** > **Has conflict** to identify any conflicts.
-1. If conflicts are found, in **Recommendation settings**, select the required value, and save. 
+1. If conflicts are found, in **Recommendation settings**, select the required value, and save.
 
 All assignments on the scope will be aligned with the new setting, resolving the conflict.
 
 ## Next steps
+
 This page explained security policies. For related information, see the following pages:
 
 - [Learn how to set policies using PowerShell](../governance/policy/assign-policy-powershell.md)