Azure Advisor tells you what’s wrong. It doesn’t tell you what you’ve decided.

Ask an Azure administrator whether the tenant is well governed and you will usually get a pause, then a screenshot. It’s Azure Advisor, maybe Defender for Cloud, showing a few hundred recommendations and a score. The tools work. They found things. But the question was not “what could be better?” It was “are we in control?”, and a list of recommendations can’t answer that.

A list that forgets

Native recommendation engines show the state of the tenant right now. That’s useful, and it’s also the limit. They have no memory of what your team has already looked at, which items someone decided to accept, or who decided it and why.

So the same review happens every quarter. Someone opens the list, sees a storage account with public access, remembers it being discussed, can’t find where, and either spends an hour working out the history or moves on. Either way the organization learns nothing it can keep.

The same problem, counted twice

It gets worse when several tools each report what they see. Advisor’s security recommendations are largely Defender for Cloud’s assessments, republished. A team working through both is often triaging the same misconfiguration twice under two names, and the totals look bigger and more alarming than the real state of the estate.

Teams respond the way people always respond to noise. They stop reading.

Governance is a record of decisions

The missing piece isn’t another scanner. It’s somewhere to record what was decided about each finding:

• This is a real risk and someone owns fixing it.

• This is accepted, for a stated reason, until a stated date.

• This was fixed, and if it comes back we want to know.

Once those decisions are recorded, the tenant’s state can be compared over time. You can see whether last month’s fixes held, whether new problems are arriving faster than old ones close, and whether the exceptions you granted are still justified. That’s the difference between looking at a list and actually governing.

What this looks like in practice

This is why we built Praefic, Azure posture and governance for organizations that have outgrown the recommendation list.

Praefic connects to your Azure tenants with read-only access and scans them on a schedule. It covers networking, identity and privileged access, Key Vault, backup, storage, compute, databases, containers, cost and more. Every finding is stored, so a rescan updates what it already knows instead of starting over:

• Findings that disappear are resolved automatically.

• Findings that come back are reopened.

• Your acknowledgements and exceptions are kept between scans.

Where an Advisor recommendation says the same thing as one of Praefic’s own checks on the same resource, Praefic shows that problem once instead of twice. If your tenant doesn’t run Defender, or you’ve turned the matching check off, the Advisor recommendation stays visible. Nothing that would otherwise go unreported is hidden.

The result is short to say: a list of problems you’ve decided about, a trend showing whether it’s improving, and an answer when someone asks whether you’re in control.

See it. Own it. Clear it.

Praefic is built by Just Software.