Microsoft Defender for Cloud

Faq General

13 October 2026Doc update+7 / −0 lines

In brief

The FAQ now recommends having more than one subscription owner and removing disabled or guest accounts with owner, write, or read permissions on Azure resources.

What Defender admins need to know

Administrators should review subscription owners and identify disabled or guest accounts with the listed permissions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Unused API endpoints should be disabled and removed from Logic Apps
Authentication should be enabled on API endpoints hosted in Function Apps
Authentication should be enabled on API endpoints hosted in Logic Apps
A maximum of 3 owners should be designated for your subscription
There should be more than one owner assigned to your subscription
Disabled accounts with owner permissions on Azure resources should be removed
Disabled accounts with read and write permissions on Azure resources should be removed
Guest accounts with owner permissions on Azure resources should be removed
Guest accounts with write permissions on Azure resources should be removed
Guest accounts with read permissions on Azure resources should be removed

Are there any limitations to Defender for Cloud's identity and access protections?

@@ -178,6 +178,13 @@ The following generally available recommendations don't support exemption: - Unused API endpoints should be disabled and removed from Logic Apps
 - Authentication should be enabled on API endpoints hosted in Function Apps
 - Authentication should be enabled on API endpoints hosted in Logic Apps
+- A maximum of 3 owners should be designated for your subscription
+- There should be more than one owner assigned to your subscription
+- Disabled accounts with owner permissions on Azure resources should be removed
+- Disabled accounts with read and write permissions on Azure resources should be removed
+- Guest accounts with owner permissions on Azure resources should be removed
+- Guest accounts with write permissions on Azure resources should be removed
+- Guest accounts with read permissions on Azure resources should be removed
 
 ### Are there any limitations to Defender for Cloud's identity and access protections?