Blog Post

Microsoft Defender for Cloud Blog
5 MIN READ

How to keep track of Resource Exemptions in Microsoft Defender for Cloud

Tom_Janetscheck's avatar
Tom_Janetscheck
Icon for Microsoft rankMicrosoft
Oct 13, 2020
Microsoft Defender for Cloud has a builtin export capability called continuous export, that helps you to export security alerts and recommendations once they are generated to Azure Log Analytics, and...
Updated Oct 21, 2021
Version 4.0
hspinto's avatar
hspinto
Icon for Microsoft rankMicrosoft
Feb 09, 2023

akssingh_shs, ARG does not give you the details of each configured Policy exemption at the moment. However, with a query such as the one below, you can extract a list of all the exempted resources (in this case, in the context of the Microsoft Defender for Cloud default initiative):

 

policyresources
| where type == 'microsoft.policyinsights/policystates'
| where properties.complianceState == 'Exempt' and properties.policySetDefinitionId == '/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8'
| extend policyDefinitionId = tolower(properties.policyDefinitionId)
| join kind=inner ( 
    policyresources
    | where type == 'microsoft.authorization/policydefinitions'
    | project policyDefinitionId = tolower(id), policyName = tostring(properties.displayName)
) on policyDefinitionId
| project policyName, resourceGroup, subscriptionId, resourceId = properties.resourceId