Remediation Action Catalog: Supported Fixes

Overview

This catalog lists the supported remediation actions for Azure recommendations. Use it to check whether a recommendation can be remediated from the recommendation workflow, what permission set it needs, and whether rollback is automated.

For the end-to-end workflow, see Remediation Actions. For Azure write-access setup, see Azure Write Permissions.

How to read the catalog

Field	Meaning
Recommendation	The recommendation name shown in the recommendation list.
Remediation action	The change the Implement workflow requests.
Permission set	The least-privilege permission bundle required to run the action.
Risk	The risk level shown in the recommendation context.
Rollback	Whether the action includes automated rollback rules. No means recovery is manual.

Important notes:

• Delete actions are intentionally narrow. They target resources that pass orphaned, empty, unattached, or unassigned checks.
• App Service Plan Premium v3 upgrade currently targets non-zone-redundant P1V2 plans in Succeeded state.
• App Service setting changes should still be validated against app runtime, deployment, gateway, and client compatibility.
• Network delete actions should be checked against DNS, routing, firewall, private connectivity, and deployment-code dependencies before deletion.
• Storage and Redis security actions can affect legacy clients that still depend on older protocols or public access.

App Service

Recommendation	Remediation action	Permission set	Risk	Rollback
32-bit Worker Process	Switch App Service worker process to 64-bit	web-sites-write	Medium	Yes
Always On Disabled	Enable Always On for App Service	web-sites-write	Low	Yes
Basic Authentication	Disable App Service basic publishing credentials	web-sites-write	Medium	Yes
FTP Protocols	Disable App Service FTP deployment	web-sites-write	Medium	Yes
HTTP/2 Not Enabled	Enable HTTP/2 on App Service	web-sites-write	Medium	Yes
Remote Debugging	Disable remote debugging	web-sites-write	Low	Yes
Session Affinity Enabled	Disable App Service session affinity	web-sites-write	Medium	Yes
Insecure TLS Configuration	Set App Service minimum TLS version to 1.2	web-sites-write	Medium	No

App Service Plan

Recommendation	Remediation action	Permission set	Risk	Rollback
Remove Orphaned Free App Service Plans	Delete empty Free App Service Plan	web-serverfarms-delete	Low	No
Upgrade to Premium V3 App Service Plan	Upgrade App Service Plan to Premium v3	web-serverfarms-write	Medium	No

Compute

Recommendation	Remediation action	Permission set	Risk	Rollback
Stopped Virtual Machines	Deallocate stopped virtual machine	compute-virtualmachines-deallocate	Medium	No

Network

Recommendation	Remediation action	Permission set	Risk	Rollback
Azure Application Gateway Orphaned	Delete orphaned Application Gateway	network-applicationgateways-delete	Medium	No
Azure Bastion Orphaned	Delete unused Azure Bastion host	network-bastionhosts-delete	Medium	No
Azure Front Door Orphaned	Delete unused Front Door profile	cdn-profiles-delete	Medium	No
Basic tier Load Balancers without backend pools	Delete unused Basic load balancer	network-loadbalancers-delete	Medium	No
Private Endpoint not assigned	Delete orphaned Private Endpoint and clean up records	network-privateendpoints-delete	Medium	No
Standard tier Load Balancers without backend pools	Delete unused load balancer	network-loadbalancers-delete	Medium	No
Traffic Manager Profile Orphaned	Delete empty Traffic Manager profile	network-trafficmanagerprofiles-delete	Medium	No
Unused IP Groups	Delete unused IP Group	network-ipgroups-delete	Low	No
Virtual Network Gateways without any connections	Delete unused virtual network gateway	network-virtualnetworkgateways-delete	Medium	No
NAT Gateway not assigned to subnets	Delete unassigned NAT gateway	network-natgateways-delete	Low	No
Network Interface not assigned	Delete unattached network interface	network-networkinterfaces-delete	Low	No
Network Security Group not assigned	Delete unused network security group	network-networksecuritygroups-delete	Low	No
Private DNS Zone not assigned	Delete unlinked Private DNS Zone	network-privatednszones-delete	Medium	No

Redis Cache

Recommendation	Remediation action	Permission set	Risk	Rollback
Redis with Non SSL Port	Disable the Redis non-SSL port	cache-redis-write	Medium	Yes

Resource Groups

Recommendation	Remediation action	Permission set	Risk	Rollback
Empty Resource Groups	Delete empty resource group	resources-subscriptions-resourcegroups-delete	Medium	No

Service Bus

Recommendation	Remediation action	Permission set	Risk	Rollback
Azure Service Bus Namespace Orphaned (Basic SKU)	Delete empty Service Bus namespace	servicebus-namespaces-delete	Medium	No

Synapse Workspace

Recommendation	Remediation action	Permission set	Risk	Rollback
Synapse Workspace Without Dedicated Pools	Delete idle Synapse workspace	synapse-workspaces-delete	Medium	No

Storage Account

Recommendation	Remediation action	Permission set	Risk	Rollback
Insecure Storage Account Traffic	Enable secure transfer on the storage account	storage-storageaccounts-write	Medium	Yes
Storage Account Outdated TLS Version	Set minimum TLS version to TLS 1.2	storage-storageaccounts-write	Medium	No
Storage Account Blob Anonymous Access Enabled	Disable storage account blob anonymous access	storage-storageaccounts-write	Medium	Yes

Web Connection

Recommendation	Remediation action	Permission set	Risk	Rollback
Azure Web Connection Orphaned	Delete orphaned Web Connection	web-connections-delete	Medium	No

Permission reference

Use the permission set to build or review a least-privilege Azure custom role. The permission set maps to the Azure RBAC actions needed for the selected remediation. Scope the custom role only to the subscriptions, resource groups, or resources where remediation is allowed.

The operation names below match the permission set definitions used by the action workflow. Keep the shown casing when copying them into custom role JSON.

Permission set	Required Azure RBAC action
cache-redis-write	Microsoft.Cache/redis/write
cdn-profiles-delete	Microsoft.Cdn/profiles/delete
compute-virtualmachines-deallocate	Microsoft.Compute/virtualMachines/deallocate/action
network-applicationgateways-delete	Microsoft.Network/applicationGateways/delete
network-bastionhosts-delete	Microsoft.Network/bastionHosts/delete
network-ipgroups-delete	Microsoft.Network/ipGroups/delete
network-loadbalancers-delete	Microsoft.Network/loadBalancers/delete
network-natgateways-delete	Microsoft.Network/natGateways/delete
network-networkinterfaces-delete	Microsoft.Network/networkInterfaces/delete
network-networksecuritygroups-delete	Microsoft.Network/networkSecurityGroups/delete
network-privatednszones-delete	Microsoft.Network/privateDnsZones/delete
network-privateendpoints-delete	Microsoft.Network/privateEndpoints/delete
network-trafficmanagerprofiles-delete	Microsoft.Network/trafficManagerProfiles/delete
network-virtualnetworkgateways-delete	Microsoft.Network/virtualNetworkGateways/delete
resources-subscriptions-resourcegroups-delete	Microsoft.Resources/subscriptions/resourceGroups/delete
servicebus-namespaces-delete	Microsoft.ServiceBus/namespaces/Delete
storage-storageaccounts-write	Microsoft.Storage/storageAccounts/write
synapse-workspaces-delete	Microsoft.Synapse/workspaces/delete
web-connections-delete	Microsoft.Web/connections/Delete
web-serverfarms-delete	Microsoft.Web/serverfarms/Delete
web-serverfarms-write	Microsoft.Web/serverfarms/Write
web-sites-write	Microsoft.Web/sites/write, Microsoft.Web/sites/config/write, and Microsoft.Web/sites/basicPublishingCredentialsPolicies/write