Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Transition from disable rules to exemptions

4 September 2026Doc updateAction required+74 / −4 lines

In brief

The article now explains how to migrate existing disable rules to exemptions and includes a Standard Assignments REST API example for vulnerability-based exemptions matching CVE ID, severity, and CVSS score.

What Defender admins need to know

Administrators with existing vulnerability assessment disable rules should use the documented migration steps to recreate them as exemptions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Transition from disable rules to exemptions

Microsoft Defender for Cloud is transitioning its recommendation model from grouped recommendations to individual recommendations. This article explains how to migrate your existing disable rules to the new exemption model, including how to map each disable rule type to its exemption equivalent and the steps to complete the migration before grouped recommendations are deprecated. As part of this change:

  • Grouped recommendations are being deprecated and replaced with individual recommendations. Learn more about the transition from grouped to individual recommendations.
  • Disable rules, which are used with grouped recommendations, are being deprecated.
  • Exemption rules are the new approach for individual and risk-based recommendations.

Exemptions give you a more scalable, flexible, and centralized way to manage exceptions.

  1. Centralized management across recommendations: Disable rules apply per recommendation. If you wanted to disable the same CVECommon Vulnerabilities and Exposures (CVE) across multiple recommendations, you had to create a separate rule for each one. With exemptions, you apply a rule once and it affects all relevant recommendations.
  2. Resource-level granularity: Disable rules don't support fine-grained control for a specific resource. Exemptions let you apply rules at the individual resource level, such as a VM or container.
  3. Central visibility and tracking: With disable rules, you had to open each recommendation to view its rules. With exemptions, you can view and manage all rules in one centralized experience.
  4. Exemption lifecycle with expiry dates: Disable rules remain in effect until you remove them manually. Exemptions support expiry dates, which helps you reduce long-lived risk and review accepted vulnerabilities regularly.

Recommended migration steps

Use the following steps to migrate your existing disable rules to exemptions.

  1. Identify existing disable rules: Review the rules configured for each recommendation and note the conditions you use, such as CVE and severity. Alternatively, you can use the following Azure Resource Graph (ARG) query to retrieve all existing disabled rules:

    :::image type="content" source="./media/transition-disable-rules-exemptions/create-new-exemption.png" alt-text="Screenshot showing how to create a new exemption in Defender for Cloud." lightbox="./media/transition-disable-rules-exemptions/create-new-exemption.png":::

  2. Prefer reusable rules: Where possible, use broader exemption conditions that apply across multiple recommendations to reduce duplication.

Recreate a vulnerability-based exemption by using the REST API

When you migrate vulnerability assessment disable rules, you can use the Standard Assignments REST API to create an equivalent vulnerability-based exemption.

The following example exempts vulnerability findings that match all the specified conditions: CVE ID, severity, and CVSS score.

Replace {subscriptionId} with your Azure subscription ID and {standardAssignmentName} with a unique GUID for the exemption.

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/standardAssignments/{standardAssignmentName}?api-version=2024-08-01

Use the following request body:

{
  "properties": {
    "description": "Exempts vulnerability findings that match the specified conditions.",
    "displayName": "Vulnerability assessment exemption",
    "excludedScopes": [],
    "effect": "Exempt",
    "assignedStandard": null,
    "exemptionData": {
      "exemptionCategory": "Waiver",
      "assignedAssessment": {
        "assessmentKey": "122e0164-4019-4126-8c64-b0816b49505f"
      },
      "subAssessmentExemptionRule": {
        "if": {
          "allOf": [
            {
              "field": "va.cve.cveId",
              "operationType": "ContainedInOperation",
              "operation": {
                "values": [
                  {
                    "title": "CVE-2020-1347"
                  }
                ]
              }
            },
            {
              "field": "va.cve.severity",
              "operationType": "LessThanFilterOperation",
              "operation": {
                "value": "Low"
              }
            },
            {
              "field": "va.cve.cvss",
              "operationType": "LessThanFilterOperation",
              "operation": {
                "value": "8.0"
              }
            }
          ]
        }
      }
    }
  }
}

The allOf operator applies the exemption only to vulnerability findings that match all three conditions. Change the assessment key and condition values to match the disable rule that you're recreating.

For more information, see Standard Assignments - Create.

Next steps