Do not close security findings from Azure Advisor preview completion state

Source facts

Azure Advisor recommendation state management is documented as preview. Full state management does not apply to security recommendations: only Active is supported for that category, not Completed, Postponed, or Dismissed.

Microsoft warns that a security recommendation can nevertheless show Completed in the Advisor table in Azure Resource Graph. That value may not represent the actual status and should not be relied on. Microsoft Learn.

Applicability

Review dashboards, exports, and ticket integrations that consume Advisor recommendation states. Identify the recommendation category before interpreting a state, and document the preview dependency in the integration’s operating record.

DSE recommendation

DSE recommends a category-aware closure rule. Route an unsupported security completion value to an exception queue instead of automatically resolving the associated security work item. Ask the finding owner to verify the underlying condition and retain that evidence. Keep the original source value visible for diagnosis without presenting it as remediation proof.

Verification

Test the consumer with a security recommendation carrying Completed and confirm that the ticket stays open for review. Compare the behavior with an eligible nonsecurity category, without assuming the categories share lifecycle semantics. Verify that the report distinguishes an unsupported status from an independently checked resolution, and preserve the test payload and mapping version.

Official references

Microsoft Learn: Azure Advisor recommendation state management. Source retrieved September 9, 2026.