Unable to add exclusions in discovery group within EASM

Question

Unable to add exclusions in discovery group within EASM

Adarsh Sheelavantar 0

We are trying to add discovery group exclusions in EASM but getting authentication required error after submitting the change. We are not sure about what changes in user role should we do, as i am already logged in to EASM but still it shows authentication required.

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-12T15:55:57.1533333+00:00
Hello Adarsh Sheelavantar,

Thank you for reaching out.

To better understand the issue, could you please share the following:

Your current role in EASM and Microsoft Defender.

Whether other users are able to add discovery group exclusions successfully.

A screenshot of the error message that appears after you submit the change.

Whether the same issue occurs in a different browser or an InPrivate/Incognito session.

Also, please let us know if you're able to make other changes in EASM, or if the problem only occurs when adding discovery group exclusions.

Once we have this information, we'll look into it further.

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-06-12T15:55:57.1533333+00:00

Hello Adarsh Sheelavantar,

Thank you for reaching out.

To better understand the issue, could you please share the following:

Your current role in EASM and Microsoft Defender.

Whether other users are able to add discovery group exclusions successfully.

A screenshot of the error message that appears after you submit the change.

Whether the same issue occurs in a different browser or an InPrivate/Incognito session.

Also, please let us know if you're able to make other changes in EASM, or if the problem only occurs when adding discovery group exclusions.

Once we have this information, we'll look into it further.

Answer 1

Adding or editing exclusions in a Defender EASM discovery group requires the same permissions as managing discovery groups and seeds. Being able to sign in to EASM is not sufficient if the account lacks the necessary role/rights on the discovery configuration.

To adjust exclusions successfully:

Verify that the account has the appropriate security/administrative role in the tenant that grants rights to manage Defender EASM discovery (for example, the role that allows creating and editing discovery groups and seeds). If the account is only a reader or has limited security roles, exclusion changes will fail even though the portal is accessible.
If role changes were just made, sign out of the Azure portal/EASM and sign back in to refresh the token, then retry adding the exclusion.
Ensure that exclusions are being added within an existing discovery group from the Discovery page, where seeds and exclusions are managed together. Exclusions are tied to a specific discovery group and only affect future runs for that group.
If the error persists after confirming roles and reauthentication, have a higher-privileged admin (such as a security admin for Defender EASM) attempt the same exclusion change to confirm it is a permission issue, then open a support case if both accounts fail.

References: