Merge pull request #110496 from memildin/asc-melvyn-20200129

Added Quick Fix indicators where relevant

Author: PRMerger10

articles/security-center/recommendations-reference.md

@@ -95,9 +95,9 @@ Your Secure Score is based on the number of Security Center recommendations you'
 |**Install endpoint protection solution on virtual machines**|Install an endpoint protection solution on your virtual machines, to protect them from threats and vulnerabilities.<br>(No related policy)|Medium|N|Machine|
 |**OS version should be updated for your cloud service roles**|Update the operating system (OS) version for your cloud service roles to the most recent version available for your OS family.<br>(No related policy)|High|N|Machine|
 |**System updates should be installed on your machines**|Install missing system security and critical updates to secure your Windows and Linux virtual machines and computers<br>(Related policy: System updates should be installed on your machines)|High|N|Machine|
-|**Network traffic data collection agent should be installed on Linux virtual machines (Preview)**|Security Center uses the Microsoft Monitoring Dependency Agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.<br>(Related policy: [Preview]: Network traffic data collection agent should be installed on Linux virtual machines)|Medium|N|Machine|
-|**Network traffic data collection agent should be installed on Windows virtual machines (Preview)**|Security Center uses the Microsoft Monitoring Dependency Agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.<br>(Related policy: [Preview]: Network traffic data collection agent should be installed on Windows virtual machines)|Medium|N|Machine|
-|**Enable the built-in vulnerability assessment solution on virtual machines**|Install the Qualys agent (built-in the Azure Security Center standard tier offering) to enable a best of breed vulnerability assessment solution on your virtual machines.<br>(Related policy: [Preview] Vulnerability Assessment should be enabled on Virtual Machines)|Medium|N|Machine|
+|**Network traffic data collection agent should be installed on Linux virtual machines (Preview)**|Security Center uses the Microsoft Monitoring Dependency Agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.<br>(Related policy: [Preview]: Network traffic data collection agent should be installed on Linux virtual machines)|Medium|**Y**|Machine|
+|**Network traffic data collection agent should be installed on Windows virtual machines (Preview)**|Security Center uses the Microsoft Monitoring Dependency Agent to collect network traffic data from your Azure virtual machines to enable advanced network protection features such as traffic visualization on the network map, network hardening recommendations and specific network threats.<br>(Related policy: [Preview]: Network traffic data collection agent should be installed on Windows virtual machines)|Medium|**Y**|Machine|
+|**Enable the built-in vulnerability assessment solution on virtual machines**|Install the Qualys agent (built-in the Azure Security Center standard tier offering) to enable a best of breed vulnerability assessment solution on your virtual machines.<br>(Related policy: [Preview] Vulnerability Assessment should be enabled on Virtual Machines)|Medium|**Y**|Machine|
 |**Remediate vulnerabilities found on your virtual machines (powered by Qualys)**|Monitors for vulnerability findings on your virtual machines as were discovered by the built-in vulnerability assessment solution of Azure Security Center (powered by Qualys).<br>(Related policy: [Preview] Vulnerability Assessment should be enabled on Virtual Machines)|Low|N|Machine|
 |**Your machines should be restarted to apply system updates**|Restart your machines to apply the system updates and secure the machine from vulnerabilities.<br>(No related policy - dependent upon "System updates should be installed on your machines")|Medium|N|Machine|
 |**Automation account variables should be encrypted**|Enable encryption of Automation account variable assets when storing sensitive data.<br>(Related policy: Encryption should be enabled on Automation account variables)|High|N|Compute resources (automation account)|
@@ -118,7 +118,7 @@ Your Secure Score is based on the number of Security Center recommendations you'
 |**Diagnostic logs in Virtual Machine Scale Sets should be enabled**|Enable logs and retain them for up to a year. This enables you to recreate activity trails for investigation purposes. This is useful when a security incident occurs, or your network is compromised.<br>(Related policy: Diagnostic logs in Virtual Machine Scale Sets should be enabled)|Low|N|Virtual machine scale set|
 |**Endpoint protection health failures should be remediated on virtual machine scale sets**|Remediate endpoint protection health failures on your virtual machine scale sets to protect them from threats and vulnerabilities.<br>(No related policy - dependent upon "Endpoint protection solution should be installed on virtual machine scale sets")|Low|N|Virtual machine scale set|
 |**Endpoint protection solution should be installed on virtual machine scale sets**|Install an endpoint protection solution on your virtual machine scale sets, to protect them from threats and vulnerabilities.<br>(Related policy: Endpoint protection solution should be installed on virtual machine scale sets)|High|N|Virtual machine scale set|
-|**Monitoring agent should be installed on virtual machine scale sets**|Security Center uses the Microsoft Monitoring Agent (MMA) to collect security events from your Azure virtual machine scale sets. You cannot configure auto-provisioning of the MMA for Azure virtual machine scale sets. To deploy the MMA on virtual machine scale sets (including those used by Azure managed services such as Azure Kubernetes Service and Azure Service Fabric), please follow the procedure in the remediation steps.|High|N|Virtual machine scale set|
+|**Monitoring agent should be installed on virtual machine scale sets**|Security Center uses the Microsoft Monitoring Agent (MMA) to collect security events from your Azure virtual machine scale sets. You cannot configure auto-provisioning of the MMA for Azure virtual machine scale sets. To deploy the MMA on virtual machine scale sets (including those used by Azure managed services such as Azure Kubernetes Service and Azure Service Fabric), please follow the procedure in the remediation steps.|High|**Y**|Virtual machine scale set|
 |**System updates on virtual machine scale sets should be installed**|Install missing system security and critical updates to secure your Windows and Linux virtual machine scale sets.<br>(Related policy: System updates on virtual machine scale sets should be installed)|High|N|Virtual machine scale set|
 |**Vulnerabilities in security configuration on your virtual machine scale sets should be remediated**|Remediate vulnerabilities in security configuration on your virtual machine scale sets to protect them from attacks. <br>(Related policy: Vulnerabilities in security configuration on your virtual machine scale sets should be remediated)|High|N|Virtual machine scale set|
 ||||||
@@ -129,8 +129,8 @@ Your Secure Score is based on the number of Security Center recommendations you'
 |Recommendation|Description & related policy|Severity|Quick fix enabled?([Learn more](https://docs.microsoft.com/azure/security-center/security-center-remediate-recommendations#recommendations-with-quick-fix-remediation))|Resource type|
 |----|----|----|----|----|
 |**Access to storage accounts with firewall and virtual network configurations should be restricted**|Audit unrestricted network access in your storage account firewall settings. Instead, configure network rules so only applications from allowed networks can access the storage account. To allow connections from specific Internet or on-premises clients, you can grant access to traffic from specific Azure virtual networks or to public Internet IP address ranges.<br>(Related policy: Audit unrestricted network access to storage accounts)|Low|N|Storage account|
-|**Advanced data security should be enabled on your managed instances**|Advanced data security (ADS) is a unified package that provides advanced SQL security capabilities. It discovers and classifies sensitive data, surfaces and mitigates potential database vulnerabilities, and detects anomalous activities that could indicate a threat to your database. ADS is charged at $15 per managed SQL server.<br>(Related policy: Advanced data security should be enabled on your SQL managed instances)|High|N|SQL|
-|**Advanced data security should be enabled on your SQL servers**|Advanced data security (ADS) is a unified package that provides advanced SQL security capabilities. It discovers and classifies sensitive data, surfaces and mitigates potential database vulnerabilities, and detects anomalous activities that could indicate a threat to your database. ADS is charged at $15 per SQL server.<br>(Related policy: Advanced data security should be enabled on your SQL servers)|High|N|SQL|
+|**Advanced data security should be enabled on your managed instances**|Advanced data security (ADS) is a unified package that provides advanced SQL security capabilities. It discovers and classifies sensitive data, surfaces and mitigates potential database vulnerabilities, and detects anomalous activities that could indicate a threat to your database. ADS is charged at $15 per managed SQL server.<br>(Related policy: Advanced data security should be enabled on your SQL managed instances)|High|**Y**|SQL|
+|**Advanced data security should be enabled on your SQL servers**|Advanced data security (ADS) is a unified package that provides advanced SQL security capabilities. It discovers and classifies sensitive data, surfaces and mitigates potential database vulnerabilities, and detects anomalous activities that could indicate a threat to your database. ADS is charged at $15 per SQL server.<br>(Related policy: Advanced data security should be enabled on your SQL servers)|High|**Y**|SQL|
 |**An Azure Active Directory administrator should be provisioned for SQL servers**|Provision an Azure AD administrator for your SQL server to enable Azure AD authentication. Azure AD authentication enables simplified permission management and centralized identity management of database users and other Microsoft services.<br>(Related policy: Audit provisioning of an Azure Active Directory administrator for SQL server)|High|N|SQL|
 |**Auditing on SQL server should be enabled**|Enable auditing for Azure SQL servers. (Azure SQL service only. Doesn't include SQL running on your virtual machines.)<br>(Related policy: Auditing should be enabled on advanced data security settings on SQL Server)|Low|**Y**|SQL|
 |**Diagnostic logs in Azure Data Lake Store should be enabled**|Enable logs and retain them up to a year. This enables you to recreate activity trails for investigation purposes when a security incident occurs or your network is compromised.<br>(Related policy: Diagnostic logs in Azure Data Lake Store should be enabled)|Low|**Y**|Data lake store|