# Keep an Advisor alert's storage group separate from its recommendation scope

> Where an alert rule is saved does not define which recommendations it watches.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:21+00:00
- Modified: 2026-09-17T16:46:28+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Where an alert rule is saved does not define which recommendations it watches.

## Potentially affected

Use this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule's own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.

## DSE recommendation

DSE recommends recording both scopes in the alert request with different labels.

## Article

## Source facts

Microsoft’s Advisor alert setup separates the resource group used to save the alert from the recommendation targeting scope. The guide explicitly states that the saved rule’s resource-group selection does not change that target scope. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal).

## Applicability

Use this review when creating or relocating an Advisor recommendation alert. Identify the intended subscription and optional target resource-group filter independently from the rule’s own storage location. Confirm that the planned recommendation category is supported by the current source before proceeding.

## DSE recommendation

DSE recommends recording both scopes in the alert request with different labels. Have the resource owner confirm the recommendation population and the monitoring owner confirm where the rule will be managed. Review category and impact or recommendation-type conditions separately. Avoid assuming that saving the rule beside a workload automatically limits its notifications to that workload.

## Verification

Read back the deployed alert’s target conditions and storage resource group. Compare each with the approved request, then use an authorized test or observed matching event to validate the intended notification route. Check that excluded resources are outside the targeting conditions. Preserve the two scope values with the rule identifier so later organizational moves do not silently change assumptions.

## Official references

[Microsoft Learn: Create Advisor alerts for new recommendations using Azure portal](https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal).

## Primary reference

- Name: Create Advisor alerts for new recommendations using Azure portal - Azure Advisor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/advisor/advisor-alerts-portal
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep an Advisor alert's storage group separate from its recommendation scope,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-159-keep-an-advisor-alert-s-storage-group-separate-from-its-recommendation-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.