There are two ways you can remediate failed baseline rules with a single click:

• One-Click Remediation: Resolve security gaps instantly by deploying industry best practices directly within Syncro. This streamlined workflow allows you to maintain a hardened security posture with minimal labor, shrinking the window of vulnerability while maximizing your team's operational efficiency.
• One-Click Ticketing: Generate service tickets from failed security baseline rules, ensuring that all remediation work is captured, tracked, and billable. By cataloging your security actions, you can clearly demonstrate value to your clients, improve their security posture, and ensure your business is compensated for its expertise.

For rules that support remediation, both options may appear in the Rule Details panel. In these instances, Remediate is the primary action, while Create Ticket is the secondary. 

Watch this short video to learn more:

About One-Click Remediation

To maintain a secure environment, identified gaps must be addressed promptly. One-Click Remediation streamlines the transition from detection to resolution by allowing you to fix security drifts directly within the Syncro dashboard. This automated approach reduces manual labor and minimizes the window of vulnerability, ensuring a consistently hardened security posture.

One-Click Remediation is available for select baseline rules. You can identify these rules by the “Automated” status in the Remediation column of the (Tenant) Compliance Details Page:

Any Syncro User can initiate remediation of failed rules through the following workflows:

• Individual Rule Remediation: When viewing a specific rule, click the Remediate button at the bottom of the Rule Details panel.
• Bulk Remediation: On the (Tenant) Compliance Details page, check the boxes next to one or more rules labeled Automated, then select “Remediate” from the Bulk Rule Actions section under the Manage button. (Checkboxes are only enabled for rules with a "Failed" status.)

A notification will confirm if the remediation started successfully or failed. The process can take several minutes; during this time, the rule status will show as “Remediating.”

Once complete, the status may show as “Reassessing” for up to an hour. This allows time for the changes to sync with Microsoft and for the system to re-verify the rule’s compliance.

About One-Click Ticketing

One-Click Ticketing converts Microsoft 365 security risks into actionable service tasks. By instantly generating tickets from failed or errored baseline rules, you ensure all remediation work is captured, documented, and tracked within your workflow. This process allows your team to demonstrate tangible value to stakeholders and maintain a complete audit trail of all security improvements.

One-Click Ticketing is available for all baseline rules.

Any Syncro User can initiate the ticketing process through the following workflows:

• Individual Rule Ticketing: When viewing a specific failed rule, click the Create Ticket button at the bottom of the Rule Details panel.
• Bulk Ticketing: On the (Tenant) Compliance Details Page, check the boxes next to one or more failed rules, then select “Create Tickets” from the Bulk Rule Actions section under the Manage button. (Checkboxes are only enabled for rules with a "Failed" status.)

When you initiate One-Click Ticketing, a pop-up window appears:

• For Individual Rules: Select the Customer Organization and provide an Issue Type. Optionally select an Assignee and Priority. The Details section previews what will be added as the Initial Issue in the Ticket Communications. Keep the box checked to open the new Ticket in a separate tab after you click Create:
  
• For Bulk Ticketing: Select the Customer Organization and provide an Issue Type, then click Create. The Tickets tab/page displays so you can view the newly created tickets.

Note: If a ticket already exists for one or more tickets, the system prompts you to skip those so you don't create duplicates:

The subject/title for created tickets is “Remediate” followed by the rule name. For example: 

Remediate "SharePoint External Sharing Is Restricted"

The system automatically populates each ticket with a Ticket Communication describing the initial issue: