{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "slug": "dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope", "url": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/" }, "title": "Keep an Advisor alert's storage group separate from its recommendation scope", "summary": "Where an alert rule is saved does not define which recommendations it watches.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:21+00:00", "modified_at": "2026-09-17T16:46:28+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule's own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.", "dse_recommendation": "DSE recommends recording both scopes in the alert request with different labels.", "primary_source": { "name": "Create Advisor alerts for new recommendations using Azure portal - Azure Advisor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Advisor alert setup separates the resource group used to save the alert from the recommendation targeting scope. The guide explicitly states that the saved rule’s resource-group selection does not change that target scope. Microsoft Learn.

\n

Applicability

\n

Use this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule’s own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.

\n

DSE recommendation

\n

DSE recommends recording both scopes in the alert request with different labels. Have the resource owner confirm the recommendation population and the monitoring owner confirm where the rule will be managed. Review category and impact or recommendation-type conditions separately. Avoid assuming that saving the rule beside a workload automatically limits its notifications to that workload.

\n

Verification

\n

Read back the deployed alert’s target conditions and storage resource group. Compare each with the approved request, then use an authorized test or observed matching event to validate the intended notification route. Check that excluded resources are outside the targeting conditions. Preserve the two scope values with the rule identifier so later organizational moves do not silently change assumptions.

\n

Official references

\n

Microsoft Learn: Create Advisor alerts for new recommendations using Azure portal.

", "content_text": "Source facts\nMicrosoft’s Advisor alert setup separates the resource group used to save the alert from the recommendation targeting scope. The guide explicitly states that the saved rule’s resource-group selection does not change that target scope. Microsoft Learn.\nApplicability\nUse this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule’s own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.\nDSE recommendation\nDSE recommends recording both scopes in the alert request with different labels. Have the resource owner confirm the recommendation population and the monitoring owner confirm where the rule will be managed. Review category and impact or recommendation-type conditions separately. Avoid assuming that saving the rule beside a workload automatically limits its notifications to that workload.\nVerification\nRead back the deployed alert’s target conditions and storage resource group. Compare each with the approved request, then use an authorized test or observed matching event to validate the intended notification route. Check that excluded resources are outside the targeting conditions. Preserve the two scope values with the rule identifier so later organizational moves do not silently change assumptions.\nOfficial references\nMicrosoft Learn: Create Advisor alerts for new recommendations using Azure portal.", "content_markdown": "## Source facts\n\nMicrosoft’s Advisor alert setup separates the resource group used to save the alert from the recommendation targeting scope. The guide explicitly states that the saved rule’s resource-group selection does not change that target scope. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal).\n\n## Applicability\n\nUse this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule’s own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.\n\n## DSE recommendation\n\nDSE recommends recording both scopes in the alert request with different labels. Have the resource owner confirm the recommendation population and the monitoring owner confirm where the rule will be managed. Review category and impact or recommendation-type conditions separately. Avoid assuming that saving the rule beside a workload automatically limits its notifications to that workload.\n\n## Verification\n\nRead back the deployed alert’s target conditions and storage resource group. Compare each with the approved request, then use an authorized test or observed matching event to validate the intended notification route. Check that excluded resources are outside the targeting conditions. Preserve the two scope values with the rule identifier so later organizational moves do not silently change assumptions.\n\n## Official references\n\n[Microsoft Learn: Create Advisor alerts for new recommendations using Azure portal](https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep an Advisor alert's storage group separate from its recommendation scope", "item": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/", "headline": "Keep an Advisor alert's storage group separate from its recommendation scope", "description": "Where an alert rule is saved does not define which recommendations it watches.", "abstract": "Where an alert rule is saved does not define which recommendations it watches.", "articleBody": "Source facts\nMicrosoft’s Advisor alert setup separates the resource group used to save the alert from the recommendation targeting scope. The guide explicitly states that the saved rule’s resource-group selection does not change that target scope. Microsoft Learn.\nApplicability\nUse this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule’s own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.\nDSE recommendation\nDSE recommends recording both scopes in the alert request with different labels. Have the resource owner confirm the recommendation population and the monitoring owner confirm where the rule will be managed. Review category and impact or recommendation-type conditions separately. Avoid assuming that saving the rule beside a workload automatically limits its notifications to that workload.\nVerification\nRead back the deployed alert’s target conditions and storage resource group. Compare each with the approved request, then use an authorized test or observed matching event to validate the intended notification route. Check that excluded resources are outside the targeting conditions. Preserve the two scope values with the rule identifier so later organizational moves do not silently change assumptions.\nOfficial references\nMicrosoft Learn: Create Advisor alerts for new recommendations using Azure portal.", "datePublished": "2026-09-17T16:32:21+00:00", "dateModified": "2026-09-17T16:46:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep an Advisor alert's storage group separate from its recommendation scope" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create Advisor alerts for new recommendations using Azure portal - Azure Advisor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal" } } ] } }