Azure Advisor Recommendations

Azure Advisor is a fully managed, no-cost service that continuously analyzes your Azure resources and provides recommendations to improve reliability, security, performance, cost, and operational excellence. It is a core part of Azure's governance and monitoring suite, alongside Azure Monitor, Azure Policy, and Azure Security Center (now Microsoft Defender for Cloud). Advisor is essentially a rules engine that evaluates resource configurations against a set of best practices defined by Microsoft engineering teams. It does not require any setup – it is enabled by default for all subscriptions and tenants.

Why does Advisor exist? In large enterprises, managing thousands of resources makes it impossible for humans to manually check every VM for underutilization, every storage account for redundancy, or every SQL database for backup settings. Advisor automates this audit process, surfacing issues that would otherwise go unnoticed until they cause an outage or overspend. For the AZ-104 exam, you must know that Advisor is passive – it never makes changes. It only suggests changes. The administrator must review and implement recommendations.

Advisor operates on a scanning loop. Every 24 hours (approximately), Advisor evaluates all resources in a subscription against a set of rules. These rules are defined by Microsoft and are periodically updated. The evaluation happens in the background using Azure Resource Graph and telemetry data from Azure Monitor. For each resource, Advisor checks configuration properties, performance metrics (like CPU usage, IOPS, network throughput), and security settings.

For example, a rule for cost might check if a VM has average CPU usage below 5% over the past 7 days. If so, it recommends right-sizing or shutting down. A reliability rule might check if a virtual machine does not have availability set or zone redundancy configured. A security rule might check if network security groups allow unrestricted inbound RDP/SSH (port 22, 3389) from any source (0.0.0.0/0).

The output is a list of recommendations, each with:

Advisor stores recommendations in the subscription's data. They are accessible via portal, REST API, CLI, or PowerShell. The default retention is 90 days. Recommendations are not automatically deleted after implementation – they are removed when the resource no longer violates the rule (i.e., after the fix is applied and the next scan runs).

Advisor's configuration is minimal. You can configure: - Cost recommendations threshold: The average CPU utilization percentage below which a VM is considered underutilized. Default is 5% over 7 days. You can adjust this via Azure CLI or PowerShell. - Exclusions: You can exclude specific subscriptions or resource groups from Advisor evaluation. - Recommendation alerts: Set up action groups to notify when new recommendations appear.

Example CLI commands:

# List all recommendations for a subscription
az advisor recommendation list --subscription MySubscription

# List only cost recommendations with high impact
az advisor recommendation list --category Cost --impact High

# Suppress a recommendation (by resource URI)
az advisor recommendation disable --ids /subscriptions/.../resourceGroups/.../providers/.../recommendations/...

# Update cost threshold (set to 10%)
az advisor configuration update --low-cpu-threshold 10 --subscription MySubscription

PowerShell equivalent:

Get-AzAdvisorRecommendation -Category Cost
Disable-AzAdvisorRecommendation -RecommendationId "..."
Set-AzAdvisorConfiguration -LowCpuThreshold 10

A multinational company runs 2,000 VMs across multiple subscriptions. Their cloud costs are spiraling. The cloud operations team uses Advisor's Cost recommendations to identify underutilized VMs. They set the low CPU threshold to 10% (instead of default 5%) to catch more VMs. Advisor flags 300 VMs with average CPU below 10% over 7 days. The team uses the recommendation details to right-size or shut down VMs during off-hours. They automate the shutdown using Azure Automation runbooks triggered by Advisor alerts. The result: 20% cost reduction. Misconfiguration risk: If they set the threshold too high (e.g., 50%), they might get false positives and unnecessarily resize VMs that are actually busy but with spikes. Also, Advisor's savings estimates are based on list prices; actual savings depend on reserved instances or hybrid benefit.

A bank must comply with PCI DSS. They use Advisor's Security recommendations (backed by Microsoft Defender for Cloud) to identify VMs with open management ports (RDP/SSH) to the internet. Advisor flags 50 VMs with NSG rules allowing 0.0.0.0/0 on port 3389. The security team reviews and restricts access to specific IP ranges. They also set up an alert to email the security lead when a new high-severity security recommendation appears. Without Advisor, these open ports might go unnoticed until an audit. A common mistake: assuming Advisor's security recommendations are independent of Defender for Cloud. In reality, disabling Defender for Cloud removes security recommendations from Advisor.

A SaaS provider runs 100 VMs in a single availability zone. Advisor's Reliability recommendations suggest using Availability Sets or Zones to protect against datacenter failures. The team implements the recommendation by redeploying VMs into an availability set. They also enable backup via Advisor's recommendation. However, they overlook the recommendation to configure geo-redundant storage for their SQL databases. A regional outage occurs, and they lose data. Advisor had flagged this but was dismissed. The lesson: treat high-impact reliability recommendations as mandatory. Misconfiguration: If they had excluded the production subscription from Advisor evaluation, they would have missed these warnings.