Lesson 18 — Exemptions and Suppression
Not every security recommendation can be remediated immediately.
This lesson explains how Microsoft Defender for Cloud exemptions document accepted risk, how suppression controls unwanted findings, and why every exception requires ownership, justification and review.
What you will learn
This lesson explains how to manage security exceptions without losing visibility or accountability.
Exception-management workflow
Exemption and suppression compared
| Control | Purpose | Appropriate use |
|---|---|---|
| Exemption | Documents an approved exception to a security recommendation or policy requirement. | A legacy system cannot yet be remediated and the risk has been formally accepted. |
| Suppression | Prevents selected findings from continuing to appear where they are confirmed as irrelevant, duplicate or unsuitable. | A finding is consistently generated for an expected and validated configuration. |
| Remediation | Corrects the underlying security weakness. | The resource can be changed safely and the recommendation is valid. |
| Compensating control | Reduces exposure while the primary issue remains unresolved. | Network isolation, additional monitoring or restricted access protects a legacy workload. |
Common reasons for an exemption
- Legacy application: the application depends on an unsupported configuration.
- Vendor appliance: the product cannot be modified without vendor support.
- Business dependency: immediate remediation would interrupt a critical service.
- Planned replacement: the affected resource is scheduled for retirement or migration.
- Temporary maintenance: a short-term exception is required during an approved change window.
- Compensating controls: alternative safeguards reduce the practical risk.
- Not applicable: the recommendation does not apply to the resource's architecture or purpose.
Agent Foskett investigation: “The vulnerability wasn’t forgotten…”
Key takeaways
- Exemptions document accepted risk; they do not remediate it.
- Suppression should be used only for validated, irrelevant or unsuitable findings.
- Every exception needs a clear business and technical justification.
- Scope should be as narrow as possible.
- Temporary exceptions should always have expiry and review dates.
- Risk owners must approve material exceptions.
- Compensating controls should be documented and tested.
- Expired exemptions should return to active review.
- Permanent exceptions require stronger evidence and oversight.
- Exception reporting should remain visible to security and governance teams.
Learning objectives
After completing this lesson, you should be able to distinguish exemptions from suppression and manage approved cloud security exceptions.
What is an exemption?
An exemption records that a recommendation or policy requirement will not be remediated for an approved reason.
What an exemption does not do
An exemption does not patch a vulnerability, remove exposure or make an insecure configuration safe.
What is suppression?
Suppression prevents selected findings from continuing to surface when they have been validated as irrelevant or unsuitable.
Risk acceptance
Risk acceptance is a formal business decision to tolerate known exposure for a defined period.
Risk owner
The risk owner has authority to accept the business consequences of the exception.
Technical owner
The technical owner explains the constraint, maintains compensating controls and plans remediation.
Security owner
Security validates the finding, assesses exposure and confirms that governance requirements are met.
Exemption scope
Apply exemptions only to the subscriptions, resource groups or resources that genuinely require them.
Narrow scope
A resource-level exception is safer than excluding an entire subscription when only one workload is affected.
Broad scope risk
Broad exemptions can hide unrelated resources and create unintended posture gaps.
Temporary exemptions
Temporary exemptions support migrations, maintenance and planned replacement work.
Permanent exemptions
Permanent exemptions should be rare and require strong evidence and ongoing review.
Expiry dates
Set an expiry date so the exception automatically returns for reassessment.
Review dates
Review the exception before expiry to confirm whether the original justification still applies.
Thirty-day review
Short-lived operational exceptions may be reviewed after 30 days.
Ninety-day review
A 90-day period may support remediation planning or vendor engagement.
Six-month review
Longer exceptions should include stronger compensating controls and executive oversight.
Mitigated
Use a mitigated category when compensating controls sufficiently reduce the risk.
Waiver
Use a waiver when the organisation knowingly accepts the remaining risk.
Not applicable
Use not applicable only when the recommendation genuinely does not apply.
Business justification
Describe why remediation cannot occur and what would happen if the change were forced.
Technical justification
Record the technical limitation, dependency or architecture involved.
Compensating controls
Document network restrictions, monitoring, access controls or other safeguards.
Evidence
Attach tickets, approvals, diagrams, vendor statements and validation results.
Approval workflow
Material exceptions should pass through security, technical and business approval.
Audit trail
Keep a record of who requested, reviewed, approved, changed and closed the exception.
Recommendation visibility
Security teams should still be able to report on exempted and suppressed findings.
Secure Score impact
Understand how exemptions affect posture reporting and Secure Score interpretation.
Regulatory obligations
An internal exemption does not override legal, contractual or regulatory requirements.
Compliance reporting
Accepted risk should remain visible in compliance and governance reporting.
Expired exemptions
Expired exemptions should be reassessed rather than silently renewed.
Renewal
Renew only when the justification, ownership and compensating controls remain valid.
Removal
Remove the exemption as soon as the resource is remediated or retired.
Orphaned exceptions
Exceptions can become orphaned when owners leave or teams are reorganised.
Ownership review
Review exception ownership during organisational and subscription changes.
Suppression criteria
Suppress only findings that have been investigated and shown to be irrelevant, duplicate or unsupported.
Suppression danger
Poorly governed suppression can hide real deterioration in security posture.
False positive review
Confirm the finding is genuinely inaccurate before suppressing it.
Vendor limitation
Record vendor evidence when a product cannot support the recommended configuration.
Legacy systems
Legacy systems should have a replacement plan, compensating controls and a defined risk owner.
Planned retirement
The retirement date should align with the exemption expiry date.
Change management
Link exceptions to approved change, problem or risk records.
Exception register
Maintain a central register of active, expired, renewed and closed exceptions.
Metrics
Track active exceptions, ageing, upcoming expiry, overdue review and repeated renewal.
Executive reporting
Report material accepted risks and overdue exceptions to leadership.
Annual audit
Review all long-running exceptions at least annually.
What Agent Foskett checked
Agent Foskett checked scope, justification, owner, approval, evidence, compensating controls and expiry.
Best practices
- Use remediation instead of exemption whenever practical.
- Keep the exception scope as narrow as possible.
- Require named business and technical owners.
- Document the risk and compensating controls.
- Set review and expiry dates.
- Avoid automatic renewal.
- Preserve reporting visibility.
- Audit long-running exceptions.
- Remove exceptions after remediation or retirement.
- Escalate expired exceptions without owners.
Related Agent Foskett resources
Continue learning
What are Microsoft Defender for Cloud exemptions and suppression?
Microsoft Defender for Cloud exemptions document approved exceptions to security recommendations, while suppression prevents selected findings from continuing to appear when they have been validated as irrelevant or unsuitable.
Exemptions and Suppression Lesson
This Agent Foskett lesson explains risk acceptance, exemption scope, business justification, compensating controls, expiry dates, review cycles, suppression criteria and exception governance.
