Request for specific Registry/Repository exclusion in Defender for Containers vulnerability scanning

Question

Request for specific Registry/Repository exclusion in Defender for Containers vulnerability scanning

Aashish Divyaraj 0

Hi Microsoft Support Team,

We are currently using Microsoft Defender for Containers in our Azure environment and have enabled it at the subscription level as per the standard architecture.

Our primary concern is regarding the cost and optimization of vulnerability scanning for Container Registries (ACR). Currently, it seems that once the plan is enabled at the subscription level, it scans all active registries and repositories within that subscription upon image push/pull.

We have multiple environments (Dev, QA, and Prod) sharing the same subscription. We only want to enable Vulnerability Assessment scanning for our Production repositories and explicitly exclude Dev/QA repositories or specific test registries to avoid unnecessary scanning costs.

Could you please confirm and clarify the following points?

Is there any native configuration or workaround available to exclude a specific Azure Container Registry (ACR) or a specific repository/image tag from being scanned by Defender for Containers?
If this is strictly a subscription-level enforcement with no granular control, is there any roadmap/ETA to introduce this feature?
What is the recommended Microsoft best practice to handle this scenario if we want to reduce scanning costs for non-production images in the same subscription?

We have reviewed the documentation, which states: "When you enable the plan, it's enabled for the entire subscription and all of its resources," but we want to officially confirm if any granular exclusion filters exist.

Looking forward to your official confirmation.

0 comments

1 answer

Your answer

Answer 1

Welome to Microsoft Q&A @Aashish Divyaraj I hope you are doing well today,

Based on the current Microsoft documentation, there isn't a documented exclusion mechanism to exclude a specific ACR repository, image, or tag from Defender for Containers registry vulnerability assessment while keeping Registry Access enabled for the subscription.

Granular Exclusion Capability

Native Registry/Tag Exclusion: Not supported. You cannot selectively disable scanning for specific registries, repositories, or tags while keeping registry protection active on the subscription.
Finding Disable Rules vs. Cost Optimization: Microsoft Defender for Cloud allows creating "Disable Rules" based on CVE, severity, or image digest. However, these rules only suppress recommendations from appearing in the portal; the underlying image is still scanned in a sandbox environment, meaning it does not reduce scanning costs.

BUT What i would do ...:

Subscription-Level Isolation (Recommended Azure Landing Zone Pattern):

The standard Microsoft Cloud Adoption Framework (CAF) guidance is to isolate environments across separate subscriptions (e.g., Sub-Workload-Prod and Sub-Workload-NonProd). This allows you to enable Defender for Containers on the Production subscription while leaving it disabled on Dev/QA to eliminate unwanted scanning charges.

Shift-Left Scanning for Non-Production:

Disable registry assessment for non-prod environments and instead scan images directly in your CI/CD pipelines (e.g., using GitHub Actions, Azure Pipelines, Trivy, or Microsoft Defender for DevOps). This catches vulnerabilities during the build stage before pushing, avoiding runtime ACR scanning costs entirely.

ACR Cache / Staging Repositories:

If you must keep everything in one subscription, ensure Dev/QA pipelines only push release-ready images to ACR rather than intermediate build artifacts on every commit to minimize billable image events.

References:

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.