Azure Advisor: Recommendations and the Advisor Score

Azure Advisor is a free, built-in service that continuously analyzes your resource configuration and usage telemetry, then surfaces personalized recommendations across five categories: Cost, Security, Reliability, Operational Excellence, and Performance. The Advisor Score is a percentage, shown overall and per category, that reflects how closely your environment currently matches those recommendations. Advisor never makes changes on its own — every suggestion requires a person, or separately configured automation, to act on it.

What Advisor actually looks at

Advisor doesn’t run a generic checklist against your subscription; it examines the specific resources you’ve deployed and how they’re actually being used, then compares that against known best practices. A virtual machine that’s been sitting at 3% CPU utilization for a month looks different to Advisor than one running consistently at 80%, and the recommendations it generates reflect that difference. This is what separates Advisor from a static compliance checklist: its output changes as your environment and usage patterns change, refreshing automatically rather than being generated once and left stale.

The five categories

Every recommendation Advisor produces falls into exactly one of five fixed categories. Knowing what each one covers — and being able to tell them apart from each other — is one of the more heavily tested parts of this topic.

Category	What it flags	Typical example
Cost	Underused or oversized resources, missed commitment pricing	Resize or shut down a VM idle for weeks; buy a reservation for a steady, year-round workload
Security	Gaps in identity and resource hardening	Enable multi-factor authentication for a privileged account; close an open management port
Reliability	Missing resiliency configuration	Turn on backup for a VM that has none; strengthen storage redundancy
Operational Excellence	Process and management practices	Adopt consistent ARM templates and tagging instead of ad hoc manual configuration
Performance	Resource-fit and throughput issues	Upgrade a VM SKU that’s been running at sustained high CPU and memory

A single subscription can show recommendations from all five categories at once, since Advisor evaluates every category continuously and independently — a Reliability suggestion about storage redundancy and an unrelated Performance suggestion about database caching can both appear for the same environment at the same time.

Where security recommendations actually come from

Advisor’s Security category isn’t generated by Advisor in isolation. It surfaces posture assessments produced by Microsoft Defender for Cloud, which continuously evaluates things like whether privileged accounts have MFA enabled or whether a resource has an unnecessarily open management port. Advisor’s role here is to bring that data into the same view as your cost, reliability, and performance findings, so you aren’t checking multiple separate dashboards for a full picture of your environment’s health.

The Advisor Score

The Advisor Score is an aggregated percentage from 0 to 100, calculated both overall and separately for each of the five categories, that shows how closely your current configuration matches Advisor’s best-practice recommendations. A higher score means fewer open recommendations remain, or that the ones remaining carry lower impact; acting on recommendations raises the score, and the score updates as your environment changes. It’s worth being precise about what it isn’t: it’s not an SLA uptime guarantee, not a billing figure, and not the same thing as Defender for Cloud’s secure score — secure score feeds specifically into the Security category, but the overall Advisor Score spans all five categories together.

A recommender, not an automator

A common point of confusion is assuming Advisor will act on its own findings. It won’t. If Advisor flags an idle VM for resizing, nothing changes until a person implements that change manually, or until the organization has built a separate automation — a Logic App triggered off the recommendation, for instance — to act on it. This hands-off behavior is consistent across every resource type and every category; there’s no category where Advisor applies changes automatically.

Staying on top of new recommendations

Because Advisor analyzes continuously rather than on a fixed schedule, new recommendations can appear at any time as usage patterns shift. Rather than relying on someone remembering to open the Advisor blade in the portal, teams can configure an Advisor alert: a notification rule that emails or otherwise notifies recipients whenever a new recommendation matching chosen criteria — category, impact level — is generated. This turns Advisor from something you have to remember to check into something that reaches out when it has a finding worth acting on — the same pattern used by the condition-and-action-group alert rules in Azure Monitor, just scoped to configuration recommendations instead of telemetry.

Cost, always

Advisor’s core recommendations, across all five categories and all supported resource types, are included with every Azure subscription at no additional charge. There’s no per-recommendation fee, no fee tied to how many resources it scans, and no requirement to buy a premium support plan first. Acting on a specific recommendation — say, purchasing a reservation — carries its own separate cost, but viewing and using Advisor itself never does.

How the AZ-900 exam tests this

• A scenario describes idle or underutilized VMs and asks which free, built-in tool would flag them — the answer is Advisor’s Cost category, not Azure Policy or Service Health.
• A question names a specific recommendation (enable MFA, resize an oversized VM, adopt consistent tagging) and asks which category it belongs to — match the action to Security, Performance, or Operational Excellence rather than guessing by resource type.
• A question asks where Advisor’s security recommendations originate — the expected answer names Microsoft Defender for Cloud as the source, not Advisor generating them independently.
• A scenario asks whether Advisor can automatically resize or delete a flagged resource — the correct answer is no; a person or separate automation has to act.
• A question describes wanting the Advisor Score explained — expect it framed as a 0–100 aggregated percentage per category and overall, not as cost, uptime, or a security clearance level.

Quick reference

• Azure Advisor analyzes actual resource configuration and usage to generate personalized recommendations, at no extra charge, as part of every subscription.
• The five categories are Cost, Security, Reliability, Operational Excellence, and Performance.
• Security recommendations are sourced from Microsoft Defender for Cloud’s posture assessments.
• The Advisor Score (0–100%) shows overall and per-category alignment with best practices; it is not an SLA, a bill, or a security clearance.
• Advisor only recommends — implementing a suggestion always requires manual action or separately built automation.
• Analysis runs continuously, so recommendations refresh automatically as usage changes; Advisor alerts push notifications instead of requiring manual checks.
• For a broader look at how Advisor’s incident-adjacent cousin works, see Azure Service Health vs Resource Health, and for the Defender-driven security findings feeding Advisor’s Security tab, see zero trust, defense in depth, and Defender for Cloud.

If you want to see how the exam phrases these category distinctions in practice, work through AZ-900 practice questions built around real Advisor scenario patterns.