Use the Azure AD recommendations API to implement Azure AD best practices for your tenant
Azure Active Directory (Azure AD) recommendations are personalized and actionable insights for you to implement Azure AD best practices in your tenant. The Azure AD recommendation service runs daily to check your tenant against predefined conditions for every recommendation. If the service detects that a recommendation applies to your tenant, the corresponding recommendation object is generated and its status is set to active.
Use the recommendations API in Microsoft Graph to identify and track the insights, assess and apply the guidance provided for implementing the best practices, and keep your tenant healthy, secure and optimized.
Azure AD recommendations are made up of two building blocks: recommendations and the Azure AD resources they apply to.
A single recommendation can apply to one or more Azure AD resource instances. For example, a recommendation relating to expiring application credentials will reference all apps in your tenant that have expiring application credentials.
For each recommendation, you have the following data:
- The type of recommendation. Eight types are currently supported. For more information about types of recommendations, see Types of recommendations.
- The Azure AD resources to which the recommendation applies. These include users, groups, and applications.
- The recommended action plan to address the recommendation.
- Where applicable, when Azure AD recommends the recommendation to have been completed before it impacts the associated service.
- The impact of the recommendation, which can be tenant-wide or resource-specific.
- A Microsoft-assigned priority ranking for the recommendation.
- The status of the recommendation such as whether it’s still active or has been completed, dismissed, or postponed to a future date.
Types of recommendations
Eight types of recommendations are currently available in Azure AD recommendations. These recommendations are identified in a recommendationType property that’s part of the recommendation object in Microsoft Graph.
The following table lists the recommendation types that are available, and maps the Microsoft Graph values to the user-friendly names that are used on the Azure portal.
|recommendationType||Friendly name in the Azure portal||Comments|
|adfsAppsMigration||Migrate your eligible applications from AD FS to Azure AD for more security, productivity and automation||For more information, see Migrate apps from ADFS to Azure AD|
|switchFromPerUserMFA||Convert per-user MFA to Conditional Access MFA||For more information, see Convert per-user MFA to Conditional Access MFA|
|tenantMFA||Minimize MFA prompts for your users signing in from known devices||For more information, see Minimize MFA prompts from known devices|
|useAuthenticatorApp||Migrate eligible users from SMS and voice call to Microsoft Authenticator App for a better MFA user experience||For more information, see Migrate to Microsoft authenticator|
|staleApps||Remove unused applications||For more information, see Remove unused applications|
|staleAppCreds||Remove unused credentials from applications||For more information, see Remove unused credentials from apps|
|applicationCredentialExpiry||Renew expiring application credentials||For more information, see Renew expiring application credentials|
|servicePrincipalKeyExpiry||Renew expiring serivce principal credentials||For more information, see Renew expiring service principal credentials|
You manage recommendations through the recommendation resource type and its associated methods. This resource type exposes the impactedResources relationship that you use to query the Azure AD resource to which the recommendations apply.
The following are some of the most popular requests for working with the Microsoft Graph recommendations API:
|Retrieve all recommendations and their associated data, including the impacted resources.||List recommendations|
|Retrieve a recommendation and its associated data, including the impacted resources.||Get recommendation|
|Act on a recommendation||Dismiss
|Retrieve details of all impacted resources for a recommendation.||List impactedResources|
|Retrieve details of an impacted resource for a recommendation.||Get impactedResource|
|Act on a recommendation for an impacted resource||Dismiss
The various recommendations have different license requirements. For more information about licenses for each type of recommendation, see Azure AD recommendations: Roles and licenses.
Submit and view feedback for