Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Create custom standards and recommendations in Microsoft Defender for Cloud

4 September 2026Doc update+16 / −9 lines

In brief

The documentation now organizes prerequisites, expands the creation steps, clarifies the required HealthStatus query pattern, and adds REST and metadata examples for custom standards and policies.

What Defender admins need to know

Administrators can use the updated guidance to create, update, or remove custom recommendations and standards; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

  • Create custom recommendations for all clouds (Azure, AWS, and GCP) with a Kusto Query Language (KQL) query.
  • Assign custom recommendations to a custom security standard.

Prerequisites

Before you startcreate custom recommendations or standards, make sure you meet the following requirements:

  • You need Owner permissions on the subscription to create a new security standard.
  • You need Security Admin permissions to create custom recommendations.
  1. Select Run query to test the query you created.
  2. When the query is ready, cut and paste it from the editor into the Recommendation query pane.
  3. Continue with step 7 fromSelect Next, select the Create a custom recommendation sectionrelevant standards for the recommendation, select the custom standards to assign, and then select Review and create.
  4. Review the recommendation details and select Create.

Query templates and examples

Assessment mapping:

Every query must set a HealthStatus value for each resource. Use the iff() function to evaluatefollowing pattern as the core health evaluation logic in your custom recommendation query, replacing the placeholder condition and assign the status:with your own test: 

| extend condition = (your condition here)
| extend HealthStatus = iff(condition, 'UNHEALTHY', 'HEALTHY')

In this pattern, edit only the condition expression. Keep the following HealthStatus line unchanged:expression unchanged in your query so Defender for Cloud can classify matching resources as compliant or non-compliant: 

| extend HealthStatus = iff(condition, 'UNHEALTHY', 'HEALTHY')

To create a custom recommendation or standard with Azure Policy (legacy):

1. Create one or more policy definitions in the [Azure Policy portal](/azure/governance/policy/tutorials/create-custom-policy-definition), or [programmatically][create policy definitions programmatically](/azure/governance/policy/how-to/programmatically-create).
1. [Create a policy initiative](/azure/governance/policy/concepts/initiative-definition-structure) that contains the custom policy definitions.

### Onboard the initiative as a custom standard (legacy)

#### Example to onboard a custom initiative

Use the following REST request to create or update the Azure Policy initiative that backs your custom Defender for Cloud standard:

```http
PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policySetDefinitions/{policySetDefinitionName}?api-version=2021-06-01

Example to remove an assignment

This example shows you howTo remove a legacy custom standard from a subscription, use the following REST request to remove andelete the policy assignment:

DELETE https://management.azure.com/{subscription}/providers/Microsoft.Authorization/policyAssignments/{policyAssignmentName}?api-version=2018-05-01
- **RemediationDescription** – String
- **Severity** – Enum [Low, Medium, High]

The metadata should be added to the policy definition for a policy that is part of the custom initiative. ItThe metadata should be in the 'securityCenter' property, as shown:

```json
{
}

Here's anotherThe following example ofshows a complete custom policy includingdefinition that includes the metadata/securityCenter property: metadata property with remediation and severity details:

{