Remediation Actions: Run Supported Fixes

Overview

Remediation Actions let you apply supported Azure fixes from the recommendation detail view. Instead of only telling you what to change, Spotto can show an Implement button, let you choose the affected resources, run the change with scoped permissions, and keep the decision context with the recommendation.

This page covers the operator workflow, safety model, and permission model. For the full list of supported remediation actions, see the Remediation Action Catalog. For recommendation triage without remediation, start with Recommendations. For workflow status, comments, and sharing, see Recommendation Management.

What happens when you click Implement?

For supported recommendations, Implement starts a guided remediation request:

1. Review the recommendation, affected resources, risk, and validation guidance.
2. Choose whether to remediate one resource, selected resources, or all affected resources when that scope is available.
3. Add an optional reason so the decision is clear later.
4. Confirm the action.
5. Check the result and complete the post-validation steps.

If the recommendation does not support automated remediation, the Implement button is not shown. You can still use the recommendation guidance to complete the work manually.

The implementation flow can also be scheduled for a future one-time run instead of being executed immediately. Those scheduled tasks appear on Schedules under Tasks -> Review -> Schedules.

Feature overview

Actions are attached to specific recommendation types. When a recommendation supports remediation, the detail view can show Implement beside other workflow actions such as prioritise and dismiss.

Each action defines what it can change, which permissions it needs, what pre-checks should be reviewed, how the final state is validated, and whether automated rollback is available. The goal is a smaller, repeatable change with the scope and impact clear before anyone touches production.

Why use this?

Common jobs

• When I approve a recommendation, I want to apply the supported fix directly, so I do not have to rebuild the same Azure Portal steps for every resource.
• When a recommendation affects many resources, I want to choose one resource, selected resources, or all affected resources, so I can control rollout scope.
• When security asks what the automation can do, I want a least-privilege permission list, so write access is narrow and reviewable.
• When a change is risky, I want pre-checks, impact, rollback notes, and post-validation, so implementation is based on clear change context.

Common pains

• Recommendations pile up because the final step still requires manual Portal work.
• Broad contributor permissions are hard to justify for narrowly scoped remediation.
• Bulk changes are useful, but only when the affected resources and failure handling are explicit.
• Rollback is often assumed until someone discovers the cloud provider does not support undo for deleted resources. That is a poor time to learn.

What you gain

• A consistent implementation flow from the recommendation detail view.
• Resource scoping for one or many affected resources.
• Least-privilege Azure RBAC actions for supported remediation.
• Pre-check and post-validation guidance for supported actions.
• Clear rollback guidance for each action, so teams know what can be automated and what requires manual recovery.

Key capabilities

Implement from recommendation details

The Implement button appears only for recommendations with a supported action. It is not shown for every Azure Advisor or Spotto recommendation.

When you select Implement, the dialog can show:

• An optional reason for the change.
• Scope selection for the current resource, selected resources, or all affected resources, depending on where you opened the recommendation.
• Pre-checks, estimated duration, risk level, and impact notes when available.
• Post-validation steps and reference links when available.

After confirmation, the recommendation enters the implementation workflow and the UI shows request or processing status while the action is handled.

The same flow can create a scheduled implementation task instead of running the change immediately.

Remediate one or many resources

Actions are tied to recommendations, but the target scope can include one or more affected resources. This is useful for staged rollout:

1. Run the action on one low-risk resource.
2. Validate the result and monitoring signals.
3. Apply the same action to selected resources.
4. Expand to the remaining affected resources only after the change pattern is proven.

Use least-privilege write permissions

Actions use explicit permission sets. Those permission sets can be used to build a custom Azure role that grants only the required write or delete actions for the remediation you enable.

Read-only access still powers recommendation discovery. Write permissions are only needed when you want the platform to change Azure resources. For setup details, see Azure Write Permissions and Custom Roles for Least Privilege.

Validate changes after execution

Actions can include target-state checks and post-validation steps. These checks matter because a successful API call is not always the same thing as a good production outcome.

Validation should include:

• The resource setting or state that the action intended to change.
• Application or workload health where the resource supports live traffic.
• Cost, security, or reliability signals that prove the recommendation is actually resolved.
• Follow-up owner notes for anything that still needs manual review.

Technical reference

Component	Details
Inputs	Recommendation ID, affected resources, resource provider state, action details, and configured Azure write permissions.
Outputs	Implementation request, resource change for supported actions, action status, and recommendation context for audit/review.
Defaults	Actions are recommendation-specific. The Implement button is shown only when the recommendation has a supported action.
Limitations	Most recommendations do not yet have executable actions. Rollback support depends on the individual action and the cloud provider operation.

Supported action catalog

Use the Remediation Action Catalog when you need the full list of supported actions. The catalog is grouped by Azure service and includes recommendation name, remediation action, permission set, risk, and rollback support.

Safety model

Pre-checks

Review pre-checks before confirming the action. Common pre-checks include ownership, maintenance window, workload dependency, network allowlist, and monitoring readiness checks.

Risk and impact

Risk level is action-specific. For example, deleting an orphaned resource can be low risk when the resource is genuinely unused, but still irreversible if the resource was misclassified. App Service changes may be reversible, but can still restart apps or affect downstream systems.

Rollback

Rollback support is action-specific:

• Yes means the action includes automated rollback rules.
• No means recovery is manual, such as recreating a deleted resource from infrastructure code or scaling a plan back manually.

Treat rollback notes as operational guidance, not a substitute for change planning.

Post-validation

After an action completes, validate both the resource state and the business outcome. If the resource state changed but the recommendation still appears, allow for sync delay, then refresh the recommendation data.

How it works (high level)

1. Open Recommendations and select a supported recommendation.
2. Review affected resources, risk, impact, pre-checks, and permission requirements.
3. Select Implement.
4. Choose the resource scope: current resource, selected resources, or all affected resources when available.
5. Add an optional reason and confirm the action.
6. Monitor request status, then complete the post-validation steps.
7. Record any follow-up work through comments, prioritisation, sharing, or ticketing.

Troubleshooting

I do not see the Implement button

What you're seeing: A recommendation has guidance, but no Implement button. Likely causes:

• The recommendation does not have a supported action.
• The recommendation source has no executable remediation yet.
• You are looking at a recommendation/resource combination that is not supported by the action. How to fix:

1. Check whether the recommendation appears in the Remediation Action Catalog.
2. Use the recommendation guidance to remediate manually if no action is available.
3. If you expected the button to appear, contact support with the company, subscription, recommendation name, and resource ID.

The action fails with a permission error

What you're seeing: The implementation request fails with 403 Forbidden or Permission denied. Likely causes:

• The write credential does not include the required RBAC action.
• The role assignment is scoped too narrowly for the selected resource.
• Azure role propagation has not completed yet. How to fix:

1. Match the recommendation's permission set to the RBAC action in the catalog permission reference.
2. Confirm the custom role is assigned at the correct subscription, resource group, or resource scope.
3. Wait 5-10 minutes after role assignment changes, then retry.

Some resources were not remediated

What you're seeing: The action worked for one resource but failed or was skipped for others. Likely causes:

• A resource did not pass pre-checks.
• The resource state changed after the recommendation was generated.
• Permissions cover some selected resources but not all of them. How to fix:

1. Reopen the recommendation and review the affected resource list.
2. Validate the failed resource directly in Azure.
3. Retry only the resources that still need remediation after fixing state or permission issues.

Rollback is not available

What you're seeing: The action catalog shows Rollback: No. Likely causes:

• The cloud provider operation is destructive or does not support undo.
• The action has no automated rollback rules. How to fix:

1. Confirm infrastructure code, exports, or manual recovery steps exist before running the action.
2. Use selected-resource rollout instead of remediating every affected resource at once.
3. For delete actions, validate ownership and dependency signals before confirming the change.

Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation