Defender "action recommended"

Hi, Steve Harris

Welcome to Microsoft Q&A forum.

“Action recommended” is a warning badge that Defender uses when something on that specific device still needs attention, most often a pending security update, an unfinished scan, or a protection feature that is turned off.

Here are some suggestions you can try in this situation:

Check what Windows Security is asking for on that device

On the affected PC, open Windows Security and look at the yellow “Actions recommended” message under Security at a glance. Then open Virus & threat protection > Protection updates > Check for updates, and run a Quick scan right after. The badge is commonly triggered by outdated security intelligence or a scan that has not completed.

Install pending Windows updates and reboot

Go to Settings > Windows Update > Check for updates, install everything offered, then restart the device. The warning often clears only after the OS and security components fully apply updates and reload.

Hope this helps. Feel free to get back if you need further assistance.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment."    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.