Defender for Cloud — Policy Exemptions Not Reflecting in SOC 2 Compliance Report

Question

Defender for Cloud — Policy Exemptions Not Reflecting in SOC 2 Compliance Report

Jim Evans 0

Subject: Defender for Cloud — Policy Exemptions Not Reflecting in SOC 2 Compliance Report

Subscription: Healthbot Cloud Service

Subscription ID: PII

Resource Group: HBRESOURCEGROUP

Affected Resource: HealthbotServer (Virtual Machine)

Region: Central US

ISSUE SUMMARY

We have created multiple policy exemptions for the recommendation "All network ports should be restricted on network security groups associated to your virtual machine" on HealthbotServer, but the exemptions are not being reflected in the Defender for Cloud SOC 2 Type 2 compliance report or in the Recommendations dashboard. This issue has persisted for several weeks.

DETAILED DESCRIPTION

EXEMPTIONS CREATED

The following policy exemptions have been created via Azure CLI and are confirmed present:

NSG-OpenPorts-HealthbotServer Scope: /subscriptions/9191c258-1479-48d0-b54f-320881e302c8/resourceGroups/HBRESOURCEGROUP/providers/Microsoft.Compute/virtualMachines/HealthbotServer Policy Assignment: SOC 2 Type 2 (Management Group level) — f054a6d5-aed5-47b2-9c40 Category: Waiver Expires: 2027-09-01
NSG-OpenPorts-HealthbotServer-RG Scope: Same resource Policy Assignment: SOC 2 Type 2 (Resource Group level) — 2773cd4a40d44a809a614b44 Category: Waiver Expires: 2027-09-01
NSG-OpenPorts-HealthbotServer-HIPAA Scope: Same resource Policy Assignment: HITRUST/HIPAA — 74ecbfa715494f9e85ba4999 Category: Waiver Expires: 2027-09-01

All exemptions verified present via: az policy exemption show --name <name> --scope <resource scope>

ASSESSMENT STATUS

Despite the exemptions, the underlying security assessment continues to return Unhealthy:

Assessment ID: 3b20e985-f71f-483b-b078-f30d73936d43

Assessment Name: All network ports should be restricted on network security groups associated to your virtual machine

Current status: Unhealthy

Cause: NetworkPortsAreOpenToAllSources

We attempted to set the assessment status to NotApplicable via az rest PUT to the assessment endpoint but received the error: "Assessment type must be CustomerManaged or VerifiedPartner for creation or update by user. The assessment you tried to modify is BuiltIn"

PORTAL EXEMPTION BUTTON

The Exemption button in the Defender for Cloud portal (Regulatory Compliance > SOC 2 > CC6.1 > recommendation detail) consistently has the Create button greyed out and non-functional, despite the user having Owner role on the subscription and Resource Policy Contributor role at the Management Group level.

POLICY SCAN

We have triggered multiple policy compliance scans via: az policy state trigger-scan --subscription 9191c258-1479-48d0-b54f-320881e302c8

The SOC 2 compliance report continues to show this finding as Failed under controls CC6.1, CC6.6, and CC6.7 despite the exemptions being in place for several weeks.

BUSINESS CONTEXT

The open ports are an operational requirement — port 443 is required for public kiosk connectivity (thousands of field devices) and FTPS ports 990/60000 are required for client PHI file transfers. The system has passed third-party penetration testing with this configuration. We are not able to close these ports without disrupting production services.

QUESTIONS FOR MICROSOFT SUPPORT

Why are valid policy exemptions not being reflected in the Defender for Cloud compliance report and recommendation status?
Why is the Exemption Create button in the portal consistently greyed out despite the user having Owner and Resource Policy Contributor roles?
Is there a known issue with BuiltIn assessments and policy exemption propagation?
What is the correct mechanism to suppress a BuiltIn assessment finding for a specific resource when the ports are an intentional operational requirement?

CONTACT

PII

Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-27T15:14:05.26+00:00
Hey Jim, it looks like you’ve created policy exemptions via CLI but Defender for Cloud isn’t honouring them in the SOC 2 report or Recommendations blade—so the built-in NetworkPortsAreOpenToAllSources check still shows as Unhealthy. Here’s what’s usually happening and how to fix it:

Exemptions must be created via the Defender for Cloud “Exempt” button • Exemptions you create manually with az policy exemption are valid at the Policy layer, but Defender for Cloud only fully integrates exemptions that are created through the Defender for Cloud recommendations experience. • Go to Microsoft Defender for Cloud > Regulatory compliance > SOC 2 Type 2 > CC6.1 (All network ports…) > click Exempt in the toolbar. Pick your HealthbotServer VM scope, select “Waiver” (or “Mitigated” if you want it to count healthy), set expiration/description, and Create. • This automatically generates the proper built-in policy exemption under the covers so that the assessment flips to “NotApplicable.”

Verify you have the right permissions at the right scope • Creating exemptions on an initiative assigned at the management-group level requires the built-in Security Admin (or Owner) role on that same management group. Subscription-level Owner does NOT inherit upward. • You also need Microsoft.Authorization/policyExemptions/write and policyAssignments/exempt/action at the target scope. If your portal Exempt button is greyed out, double-check your role assignment in Access control (IAM) on the MG and subscription.

Ensure the Microsoft Cloud Security Benchmark (MCSB) initiative is assigned • If the SOC 2 Type 2 initiative (MCSB) isn’t assigned at the subscription, the portal experience for exemptions can misbehave and the compliance dashboard won’t pick up your waivers. • In Defender for Cloud > Environment settings > Compliance standards, confirm SOC 2 Type 2 is present and healthy.

Check for orphaned or mis-scoped exemptions • Run this Resource Graph query to find any exemptions that aren’t tied to a policyAssignmentId (or are at the wrong scope): policyresources | where type == "microsoft.authorization/policyexemptions" | extend pa = tostring(properties.policyAssignmentId) | where pa == "" or isnull(pa) • If you see entries here, delete them (Remove-AzPolicyExemption) and recreate via the Defender for Cloud UI.

Wait for the next evaluation cycle • After creating the exemption through Defender for Cloud, allow up to 24 hours for the backend scan to re-evaluate and for the SOC 2 report to refresh.

If you truly can’t use exemptions (eg, the button remains dead) you can “Disable rule” • In the recommendation detail pane, there’s a “Disable rule” option. Provide the Assessment ID (NetworkPortsAreOpenToAllSources) and it will stop evaluating that check for this resource going forward.

Built-in assessments can’t be altered via REST/PUT • The error you saw (“Assessment type must be CustomerManaged or VerifiedPartner…”) is expected—built-in assessments are read-only. Exemptions or disabling the rule are the supported suppression methods.

Reference docs

Exempt resources from Defender for Cloud recommendations https://docs.microsoft.com/azure/defender-for-cloud/exempt-resource

Exempt resources at scale https://docs.microsoft.com/azure/defender-for-cloud/exempt-resources-at-scale

Azure Policy exemption structure https://docs.microsoft.com/azure/governance/policy/concepts/exemption-structure

Azure Policy RBAC permissions https://docs.microsoft.com/azure/governance/policy/overview#azure-rbac-permissions-in-azure-policy

Manage recommendation settings (MCSB) https://docs.microsoft.com/azure/defender-for-cloud/manage-mcsb#manage-recommendation-settings

Hope this helps you get your exemptions surfaced in the SOC 2 report! Let me know if any of the steps above aren’t clear or if you run into something unexpected.

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Jim Evans 0 Reputation points

2026-05-27T15:42:19.0366667+00:00

Update from further investigation:

Permissions are correct — Security Admin and Resource Policy Contributor are confirmed at the Tenant Root Group (Management Group) level. Permissions are not the issue.

Portal Exempt button is permanently greyed out — The exemption panel shows "0 subscriptions" at the top regardless of what scope is selected. When switching to "Selected subscriptions" it shows "3 selected" but all three subscriptions are greyed out — only "Select all" is available. Create button never activates.

Root cause identified — The SOC 2 Type 2 initiative is assigned at the Management Group level. The portal exemption UI appears unable to properly scope exemptions to individual subscriptions when the policy assignment is at the MG level.

CLI exemptions exist but are not honored — We have valid policy exemptions created via CLI against both SOC 2 assignments and HIPAA, but the recommendation continues to show Unhealthy.

Next step we are trying — Creating an exemption against the Microsoft Cloud Security Benchmark (MCSB) assignment specifically, as the portal warning indicated this finding is included in MCSB, SOC 2, and HIPAA HITRUST simultaneously.

Question: Is the "0 subscriptions" display in the Exempt panel a known bug when the policy initiative is assigned at the Management Group level? And is there a supported workaround?
Jim Evans 0 Reputation points

2026-05-27T15:43:58.46+00:00

Update from further investigation:

Permissions are correct — Security Admin and Resource Policy Contributor are confirmed at the Tenant Root Group (Management Group) level. Permissions are not the issue.

Portal Exempt button is permanently greyed out — The exemption panel shows "0 subscriptions" at the top regardless of what scope is selected. When switching to "Selected subscriptions" it shows "3 selected" but all three subscriptions are greyed out — only "Select all" is available. Create button never activates.

Root cause identified — The SOC 2 Type 2 initiative is assigned at the Management Group level. The portal exemption UI appears unable to properly scope exemptions to individual subscriptions when the policy assignment is at the MG level.

CLI exemptions exist but are not honored — We have valid policy exemptions created via CLI against both SOC 2 assignments and HIPAA, but the recommendation continues to show Unhealthy.

Next step we are trying — Creating an exemption against the Microsoft Cloud Security Benchmark (MCSB) assignment specifically, as the portal warning indicated this finding is included in MCSB, SOC 2, and HIPAA HITRUST simultaneously.

Question: Is the "0 subscriptions" display in the Exempt panel a known bug when the policy initiative is assigned at the Management Group level? And is there a supported workaround?
Jim Evans 0 Reputation points

2026-05-27T16:04:45.6333333+00:00

Further update: Confirmed user account is a Member (not Guest) of the tenant with Global Administrator role at the directory level, Owner at the subscription level, Security Admin and Resource Policy Contributor at the Management Group level. Permissions are not the issue. The portal Exempt Create button remains greyed out despite all fields being correctly filled in. This appears to be a portal bug specific to policy initiatives assigned at the Management Group level.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T10:07:34.5433333+00:00
Hello @Jim Evans

I appreciate you verifying the extra information. This doesn't seem to be a permissions problem because RBAC has already been verified at the Tenant Root Management Group level and the account is a Member user with Global Administrator, Security Admin, Resource Policy Contributor, and Owner permissions.

When the Defender for Cloud compliance endeavor is inherited from a Management Group assignment (SOC2/MCSB/HIPAA), the "0 subscriptions" behavior and the permanently grayed-out Create button are consistent with a known portal constraint.

Workaround:

Since the recommendation is assessed by the Microsoft Cloud Security Benchmark (MCSB) and carried over into SOC2/HIPAA, expressly create the exception against the MCSB assignment.

Make that the exemption makes use of the precise policyAssignmentId that is presently being used to evaluate the resource.

If at all possible, create the exception at the Management Group assignment level rather than only the resource scope.

After creation, start a policy scan and give Defender up to 24 to 48 hours to recalculate cloud compliance.

Since the BuiltIn assessment itself cannot be changed directly through REST/PUT APIs, the supported suppression mechanism is exemption.

The Defender for Cloud product team will probably need to do a backend investigation if the portal still displays "0 subscriptions" after targeting the MCSB assignment, as this indicates a portal-side problem with MG-scoped inherited initiatives.

Let me know if any further queries - feel free to reach out!
Jim Evans 0 Reputation points

2026-05-28T11:16:59.28+00:00

Thank you. We have created exemptions via CLI against all relevant assignments: SOC 2 Type 2 (MG level), SOC 2 Type 2 (RG level), MCSB (MG level), and HITRUST/HIPAA. All set to Mitigated category. We also created a Defender internal exemption via Environment settings → Exemptions → Create, also set to Mitigated, scoped to the specific VM resource. It has been 17 hours. The exemption shows correctly in Defender Inventory (Contains exemptions filter). However Recommendations → Status=Exempted still shows no results for this VM and recommendation. The SOC 2 CSV export still shows the finding as Failed. Should the exemption be scoped to the Management Group level rather than the specific VM resource? We are concerned that scoping at MG level would exempt all resources not just HealthbotServer. Is there a way to scope it to just this VM at the MG assignment level?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T11:44:11.0466667+00:00
Hello @Jim Evans

In order to avoid exempting all matching resources, you should not extend the exemption to the entire Management Group.

The proper configuration is:

Policy assignment within the purview of the Management Group

Only the HealthbotServer virtual machine resource is exempt. Only this virtual machine should be exempt from that setting, which is supported.

The exemption itself is set up correctly because it already shows up in Defender Inventory. Backend propagation and synchronization between Azure Policy and Defender for Cloud Regulatory Compliance seem to be the current problem.

Suggestion:

Limit the scope of the exemption to the virtual machine

Give yourself up to 48 hours to recalculate compliance.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-06-01T17:22:49.5266667+00:00

Hello @Jim Evans

Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Your answer

Jim Evans 0 Reputation points

2026-05-27T15:42:19.0366667+00:00

Update from further investigation:

Permissions are correct — Security Admin and Resource Policy Contributor are confirmed at the Tenant Root Group (Management Group) level. Permissions are not the issue.

Portal Exempt button is permanently greyed out — The exemption panel shows "0 subscriptions" at the top regardless of what scope is selected. When switching to "Selected subscriptions" it shows "3 selected" but all three subscriptions are greyed out — only "Select all" is available. Create button never activates.

Root cause identified — The SOC 2 Type 2 initiative is assigned at the Management Group level. The portal exemption UI appears unable to properly scope exemptions to individual subscriptions when the policy assignment is at the MG level.

CLI exemptions exist but are not honored — We have valid policy exemptions created via CLI against both SOC 2 assignments and HIPAA, but the recommendation continues to show Unhealthy.

Next step we are trying — Creating an exemption against the Microsoft Cloud Security Benchmark (MCSB) assignment specifically, as the portal warning indicated this finding is included in MCSB, SOC 2, and HIPAA HITRUST simultaneously.

Question: Is the "0 subscriptions" display in the Exempt panel a known bug when the policy initiative is assigned at the Management Group level? And is there a supported workaround?
Jim Evans 0 Reputation points

2026-05-27T15:43:58.46+00:00

Update from further investigation:

Permissions are correct — Security Admin and Resource Policy Contributor are confirmed at the Tenant Root Group (Management Group) level. Permissions are not the issue.

Portal Exempt button is permanently greyed out — The exemption panel shows "0 subscriptions" at the top regardless of what scope is selected. When switching to "Selected subscriptions" it shows "3 selected" but all three subscriptions are greyed out — only "Select all" is available. Create button never activates.

Root cause identified — The SOC 2 Type 2 initiative is assigned at the Management Group level. The portal exemption UI appears unable to properly scope exemptions to individual subscriptions when the policy assignment is at the MG level.

CLI exemptions exist but are not honored — We have valid policy exemptions created via CLI against both SOC 2 assignments and HIPAA, but the recommendation continues to show Unhealthy.

Next step we are trying — Creating an exemption against the Microsoft Cloud Security Benchmark (MCSB) assignment specifically, as the portal warning indicated this finding is included in MCSB, SOC 2, and HIPAA HITRUST simultaneously.

Question: Is the "0 subscriptions" display in the Exempt panel a known bug when the policy initiative is assigned at the Management Group level? And is there a supported workaround?
Jim Evans 0 Reputation points

2026-05-27T16:04:45.6333333+00:00

Further update: Confirmed user account is a Member (not Guest) of the tenant with Global Administrator role at the directory level, Owner at the subscription level, Security Admin and Resource Policy Contributor at the Management Group level. Permissions are not the issue. The portal Exempt Create button remains greyed out despite all fields being correctly filled in. This appears to be a portal bug specific to policy initiatives assigned at the Management Group level.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T10:07:34.5433333+00:00

Hello @Jim Evans

I appreciate you verifying the extra information. This doesn't seem to be a permissions problem because RBAC has already been verified at the Tenant Root Management Group level and the account is a Member user with Global Administrator, Security Admin, Resource Policy Contributor, and Owner permissions.

When the Defender for Cloud compliance endeavor is inherited from a Management Group assignment (SOC2/MCSB/HIPAA), the "0 subscriptions" behavior and the permanently grayed-out Create button are consistent with a known portal constraint.

Workaround:

Since the recommendation is assessed by the Microsoft Cloud Security Benchmark (MCSB) and carried over into SOC2/HIPAA, expressly create the exception against the MCSB assignment.

Make that the exemption makes use of the precise policyAssignmentId that is presently being used to evaluate the resource.

If at all possible, create the exception at the Management Group assignment level rather than only the resource scope.

After creation, start a policy scan and give Defender up to 24 to 48 hours to recalculate cloud compliance.

Since the BuiltIn assessment itself cannot be changed directly through REST/PUT APIs, the supported suppression mechanism is exemption.

The Defender for Cloud product team will probably need to do a backend investigation if the portal still displays "0 subscriptions" after targeting the MCSB assignment, as this indicates a portal-side problem with MG-scoped inherited initiatives.

Let me know if any further queries - feel free to reach out!
Jim Evans 0 Reputation points

2026-05-28T11:16:59.28+00:00

Thank you. We have created exemptions via CLI against all relevant assignments: SOC 2 Type 2 (MG level), SOC 2 Type 2 (RG level), MCSB (MG level), and HITRUST/HIPAA. All set to Mitigated category. We also created a Defender internal exemption via Environment settings → Exemptions → Create, also set to Mitigated, scoped to the specific VM resource. It has been 17 hours. The exemption shows correctly in Defender Inventory (Contains exemptions filter). However Recommendations → Status=Exempted still shows no results for this VM and recommendation. The SOC 2 CSV export still shows the finding as Failed. Should the exemption be scoped to the Management Group level rather than the specific VM resource? We are concerned that scoping at MG level would exempt all resources not just HealthbotServer. Is there a way to scope it to just this VM at the MG assignment level?
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-05-28T11:44:11.0466667+00:00

Hello @Jim Evans

In order to avoid exempting all matching resources, you should not extend the exemption to the entire Management Group.

The proper configuration is:

Policy assignment within the purview of the Management Group

Only the HealthbotServer virtual machine resource is exempt. Only this virtual machine should be exempt from that setting, which is supported.

The exemption itself is set up correctly because it already shows up in Defender Inventory. Backend propagation and synchronization between Azure Policy and Defender for Cloud Regulatory Compliance seem to be the current problem.

Suggestion:

Limit the scope of the exemption to the virtual machine

Give yourself up to 48 hours to recalculate compliance.
Rukmini 43,915 Reputation points Microsoft External Staff Moderator

2026-06-01T17:22:49.5266667+00:00

Hello @Jim Evans

Following up to see if the above provided information was helpful. If you have any further queries do let us know.