You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Extra recommendations added to identity](#extra-recommendations-added-to-identity)
28
+
-[Removed security alerts for machines reporting to cross-tenant Log Analytics workspaces](#removed-security-alerts-for-machines-reporting-to-cross-tenant-log-analytics-workspaces)
29
+
30
+
### Suppress alerts based on Container and Kubernetes entities
31
+
32
+
- Kubernetes Namespace
33
+
- Kubernetes Pod
34
+
- Kubernetes Secret
35
+
- Kubernetes ServiceAccount
36
+
- Kubernetes ReplicaSet
37
+
- Kubernetes StatefulSet
38
+
- Kubernetes DaemonSet
39
+
- Kubernetes Job
40
+
- Kubernetes CronJob
41
+
42
+
Learn more about [alert suppression rules](alerts-suppression-rules.md).
43
+
44
+
### Defender for Servers supports File Integrity Monitoring with Azure Monitor Agent
45
+
46
+
File integrity monitoring (FIM) examines operating system files and registries for changes that might indicate an attack.
47
+
48
+
FIM is now available in a new version based on Azure Monitor Agent (AMA), which you can [deploy through Defender for Cloud](auto-deploy-azure-monitoring-agent.md).
49
+
50
+
Learn more about [File Integrity Monitoring with the Azure Monitor Agent](file-integrity-monitoring-enable-ama.md).
51
+
52
+
### Legacy Assessments APIs deprecation
53
+
54
+
The following APIs are deprecated:
55
+
56
+
- Security Tasks
57
+
- Security Statuses
58
+
- Security Summaries
59
+
60
+
These three APIs exposed old formats of assessments and are replaced by the [Assessments APIs](/rest/api/defenderforcloud/assessments) and [SubAssessments APIs](/rest/api/defenderforcloud/sub-assessments). All data that is exposed by these legacy APIs are also available in the new APIs.
61
+
62
+
### Extra recommendations added to identity
63
+
64
+
Defender for Cloud's recommendations for improving the management of users and accounts.
65
+
66
+
#### New recommendations
67
+
68
+
The new release contains the following capabilities:
69
+
70
+
-**Extended evaluation scope** – Coverage has been improved for identity accounts without MFA and external accounts on Azure resources (instead of subscriptions only) which allows your security administrators to view role assignments per account.
71
+
72
+
-**Improved freshness interval** - The identity recommendations now have a freshness interval of 12 hours.
73
+
74
+
-**Account exemption capability** - Defender for Cloud has many features you can use to customize your experience and ensure that your secure score reflects your organization's security priorities. For example, you can [exempt resources and recommendations from your secure score](exempt-resource.md).
75
+
76
+
This update allows you to exempt specific accounts from evaluation with the six recommendations listed in the following table.
77
+
78
+
Typically, you'd exempt emergency “break glass” accounts from MFA recommendations, because such accounts are often deliberately excluded from an organization's MFA requirements. Alternatively, you might have external accounts that you'd like to permit access to, that don't have MFA enabled.
79
+
80
+
> [!TIP]
81
+
> When you exempt an account, it won't be shown as unhealthy and also won't cause a subscription to appear unhealthy.
82
+
83
+
| Recommendation | Assessment key |
84
+
|--|--|
85
+
|Accounts with owner permissions on Azure resources should be MFA enabled|6240402e-f77c-46fa-9060-a7ce53997754|
86
+
|Accounts with write permissions on Azure resources should be MFA enabled|c0cb17b2-0607-48a7-b0e0-903ed22de39b|
87
+
|Accounts with read permissions on Azure resources should be MFA enabled|dabc9bc4-b8a8-45bd-9a5a-43000df8aa1c|
88
+
|Guest accounts with owner permissions on Azure resources should be removed|20606e75-05c4-48c0-9d97-add6daa2109a|
89
+
|Guest accounts with write permissions on Azure resources should be removed|0354476c-a12a-4fcc-a79d-f0ab7ffffdbb|
90
+
|Guest accounts with read permissions on Azure resources should be removed|fde1c0c9-0fd2-4ecc-87b5-98956cbc1095|
91
+
|Blocked accounts with owner permissions on Azure resources should be removed|050ac097-3dda-4d24-ab6d-82568e7a50cf|
92
+
|Blocked accounts with read and write permissions on Azure resources should be removed| 1ff0b4c9-ed56-4de6-be9c-d7ab39645926 |
93
+
94
+
The recommendations although in preview, will appear next to the recommendations that are currently in GA.
95
+
96
+
### Removed security alerts for machines reporting to cross-tenant Log Analytics workspaces
97
+
98
+
In the past, Defender for Cloud let you choose the workspace that your Log Analytics agents report to. When a machine belonged to one tenant (“Tenant A”) but its Log Analytics agent reported to a workspace in a different tenant (“Tenant B”), security alerts about the machine were reported to the first tenant (“Tenant A”).
99
+
100
+
With this change, alerts on machines connected to Log Analytics workspace in a different tenant no longer appear in Defender for Cloud.
101
+
102
+
If you want to continue receiving the alerts in Defender for Cloud, connect the Log Analytics agent of the relevant machines to the workspace in the same tenant as the machine.
103
+
104
+
Learn more about [security alerts](alerts-overview.md).
-[Extra recommendations added to identity](#extra-recommendations-added-to-identity)
375
-
-[Removed security alerts for machines reporting to cross-tenant Log Analytics workspaces](#removed-security-alerts-for-machines-reporting-to-cross-tenant-log-analytics-workspaces)
376
-
377
-
### Suppress alerts based on Container and Kubernetes entities
378
-
379
-
- Kubernetes Namespace
380
-
- Kubernetes Pod
381
-
- Kubernetes Secret
382
-
- Kubernetes ServiceAccount
383
-
- Kubernetes ReplicaSet
384
-
- Kubernetes StatefulSet
385
-
- Kubernetes DaemonSet
386
-
- Kubernetes Job
387
-
- Kubernetes CronJob
388
-
389
-
Learn more about [alert suppression rules](alerts-suppression-rules.md).
390
-
391
-
### Defender for Servers supports File Integrity Monitoring with Azure Monitor Agent
392
-
393
-
File integrity monitoring (FIM) examines operating system files and registries for changes that might indicate an attack.
394
-
395
-
FIM is now available in a new version based on Azure Monitor Agent (AMA), which you can [deploy through Defender for Cloud](auto-deploy-azure-monitoring-agent.md).
396
-
397
-
Learn more about [File Integrity Monitoring with the Azure Monitor Agent](file-integrity-monitoring-enable-ama.md).
398
-
399
-
### Legacy Assessments APIs deprecation
400
-
401
-
The following APIs are deprecated:
402
-
403
-
- Security Tasks
404
-
- Security Statuses
405
-
- Security Summaries
406
-
407
-
These three APIs exposed old formats of assessments and are replaced by the [Assessments APIs](/rest/api/defenderforcloud/assessments) and [SubAssessments APIs](/rest/api/defenderforcloud/sub-assessments). All data that is exposed by these legacy APIs are also available in the new APIs.
408
-
409
-
### Extra recommendations added to identity
410
-
411
-
Defender for Cloud's recommendations for improving the management of users and accounts.
412
-
413
-
#### New recommendations
414
-
415
-
The new release contains the following capabilities:
416
-
417
-
-**Extended evaluation scope** – Coverage has been improved for identity accounts without MFA and external accounts on Azure resources (instead of subscriptions only) which allows your security administrators to view role assignments per account.
418
-
419
-
-**Improved freshness interval** - The identity recommendations now have a freshness interval of 12 hours.
420
-
421
-
-**Account exemption capability** - Defender for Cloud has many features you can use to customize your experience and ensure that your secure score reflects your organization's security priorities. For example, you can [exempt resources and recommendations from your secure score](exempt-resource.md).
422
-
423
-
This update allows you to exempt specific accounts from evaluation with the six recommendations listed in the following table.
424
-
425
-
Typically, you'd exempt emergency “break glass” accounts from MFA recommendations, because such accounts are often deliberately excluded from an organization's MFA requirements. Alternatively, you might have external accounts that you'd like to permit access to, that don't have MFA enabled.
426
-
427
-
> [!TIP]
428
-
> When you exempt an account, it won't be shown as unhealthy and also won't cause a subscription to appear unhealthy.
429
-
430
-
| Recommendation | Assessment key |
431
-
|--|--|
432
-
|Accounts with owner permissions on Azure resources should be MFA enabled|6240402e-f77c-46fa-9060-a7ce53997754|
433
-
|Accounts with write permissions on Azure resources should be MFA enabled|c0cb17b2-0607-48a7-b0e0-903ed22de39b|
434
-
|Accounts with read permissions on Azure resources should be MFA enabled|dabc9bc4-b8a8-45bd-9a5a-43000df8aa1c|
435
-
|Guest accounts with owner permissions on Azure resources should be removed|20606e75-05c4-48c0-9d97-add6daa2109a|
436
-
|Guest accounts with write permissions on Azure resources should be removed|0354476c-a12a-4fcc-a79d-f0ab7ffffdbb|
437
-
|Guest accounts with read permissions on Azure resources should be removed|fde1c0c9-0fd2-4ecc-87b5-98956cbc1095|
438
-
|Blocked accounts with owner permissions on Azure resources should be removed|050ac097-3dda-4d24-ab6d-82568e7a50cf|
439
-
|Blocked accounts with read and write permissions on Azure resources should be removed| 1ff0b4c9-ed56-4de6-be9c-d7ab39645926 |
440
-
441
-
The recommendations although in preview, will appear next to the recommendations that are currently in GA.
442
-
443
-
### Removed security alerts for machines reporting to cross-tenant Log Analytics workspaces
444
-
445
-
In the past, Defender for Cloud let you choose the workspace that your Log Analytics agents report to. When a machine belonged to one tenant (“Tenant A”) but its Log Analytics agent reported to a workspace in a different tenant (“Tenant B”), security alerts about the machine were reported to the first tenant (“Tenant A”).
446
-
447
-
With this change, alerts on machines connected to Log Analytics workspace in a different tenant no longer appear in Defender for Cloud.
448
-
449
-
If you want to continue receiving the alerts in Defender for Cloud, connect the Log Analytics agent of the relevant machines to the workspace in the same tenant as the machine.
450
-
451
-
Learn more about [security alerts](alerts-overview.md).
452
-
453
367
## Next steps
454
368
455
369
For past changes to Defender for Cloud, see [Archive for what's new in Defender for Cloud?](release-notes-archive.md).
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/upcoming-changes.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -96,7 +96,7 @@ Defender for Cloud won't include these recommendations as built-in recommendatio
96
96
97
97
**Estimated date for change: May 2023**
98
98
99
-
We announced previously the [availability of identity recommendations V2 (preview)](release-notes.md#extra-recommendations-added-to-identity), which included enhanced capabilities.
99
+
We announced previously the [availability of identity recommendations V2 (preview)](release-notes-archive.md#extra-recommendations-added-to-identity), which included enhanced capabilities.
100
100
101
101
As part of these changes, the following recommendations will be released as General Availability (GA) and replace the V1 recommendations that are set to be deprecated.
0 commit comments