Azure Policy Exemptions and Compliance Scoring

Azure Policy is a governance service that enforces rules on resources to ensure compliance with organizational standards. However, there are legitimate reasons why a resource might need to be temporarily or permanently excluded from a policy's effect. For example, a development server may need to be exempt from a policy that mandates specific security configurations because it is used for testing. An exemption allows you to mark a resource or resource group as 'exempt' from a specific policy assignment, meaning the policy will not evaluate that resource for compliance. Exemptions are not the same as exclusions (which remove resources from the scope entirely) or policy overrides (which change the policy definition). They are a targeted waiver that preserves the policy assignment while acknowledging that the resource does not need to comply for a specified reason.

When you create an exemption, Azure Policy adds an entry to the policy assignment's metadata that identifies the exempted scope (resource or resource group) and the exemption details. During a compliance scan, the engine checks whether a resource is within an exemption scope. If it is, the resource is marked as 'Exempt' rather than 'Compliant' or 'Non-compliant'. The exemption does not change the policy evaluation logic; it simply skips the evaluation for that resource. The exemption has an expiration date (optional but recommended), after which the resource reverts to being evaluated normally. Exemptions are stored as child resources of the policy assignment and can be viewed in the Azure portal, via Azure CLI, PowerShell, or REST API.

az policy exemption create --name MyExemption --policy-assignment MyAssignment --scope /subscriptions/.../resourceGroups/MyRG/providers/Microsoft.Compute/virtualMachines/MyVM --exemption-category Waiver --expires-on 2025-12-31T23:59:00Z --description "Temporary waiver for testing"

Compliance scoring is the process of calculating the percentage of compliant resources for a given policy assignment. The formula is:

Compliance Percentage = (Compliant Resources / (Total Resources - Exempt Resources)) * 100

Wait, that's not entirely accurate. Let's clarify: The compliance score is calculated as:

Compliance Percentage = (Compliant Resources / (Compliant + Non-compliant)) * 100

Exempt resources are excluded from both the numerator and denominator. So if you have 100 resources, 80 compliant, 10 non-compliant, and 10 exempt, the compliance percentage is 80 / (80+10) = 88.9%, not 80%. This is a common exam trap. Exempt resources do not count as compliant or non-compliant; they are simply removed from the calculation. This means exemptions can artificially inflate compliance scores if used excessively.

In the Azure portal, the Policy Compliance blade shows a pie chart of Compliant, Non-compliant, and Exempt resources. You can filter by exemption category. The compliance state is also available via Azure Resource Graph queries:

policyresources
| where type == 'microsoft.authorization/policyexemptions'
| project exemptionName, policyAssignmentId, scope, exemptionCategory

After creation, the resource will appear as 'Exempt' in the compliance view. You can also list exemptions via CLI:

az policy exemption list --policy-assignment MyAssignment

Exemptions can be defined in ARM templates or Bicep files for infrastructure-as-code deployments. Example ARM template snippet:

{
  "type": "Microsoft.Authorization/policyExemptions",
  "apiVersion": "2022-06-01",
  "name": "MyExemption",
  "properties": {
    "policyAssignmentId": "/subscriptions/.../providers/Microsoft.Authorization/policyAssignments/MyAssignment",
    "exemptionCategory": "Waiver",
    "expiresOn": "2025-12-31T23:59:00Z",
    "displayName": "My Exemption"
  }
}

Now, let's dive into the step-by-step process of how exemptions affect compliance scoring.

A financial services company has a policy that requires all virtual machines to use managed disks. However, they have a legacy application running on a VM that uses unmanaged disks because the application code directly accesses the VHD files. The migration to managed disks is planned for next quarter. The security team creates an exemption for that specific VM with category 'Waiver' and an expiration date set to the end of the quarter. This allows the VM to remain non-compliant temporarily without affecting the overall compliance score. The exemption is documented with a description referencing the migration ticket. The security team sets up a monthly review to check pending exemptions. When the migration is complete, they remove the exemption and the VM becomes compliant. In production, they have hundreds of such exemptions, each with a unique expiration date. They use Azure Policy to enforce that exemptions must have an expiration date, using a custom policy that audits exemptions without an expiration date.

A healthcare organization has a policy that mandates encryption at rest using Azure Disk Encryption. However, some of their VMs are using Azure Storage Service Encryption (SSE) which is also encryption at rest but not the specific type required by the policy. The security team determines that SSE is an acceptable compensating control because it meets the regulatory requirement for encryption. They create exemptions with category 'Mitigated' for these VMs. The exemption description explains that SSE is in place. The compliance dashboard shows these VMs as exempt, not non-compliant. This avoids false positives in reports. The team also has a separate policy that requires SSE, so the overall security posture is maintained. In production, they have a process to review mitigated exemptions annually to ensure the compensating control still applies.

A tech company uses Azure Policy to enforce strict security configurations on production resources. However, their development environment needs more flexibility. They have a management group for development with a policy assignment that includes exemptions for all resources in that group. The exemption category is 'Waiver' with a permanent expiration (no expiration date). This allows developers to experiment without policy violations. However, this also means the development environment is not compliant, which is acceptable for non-production. The compliance score for the overall subscription is calculated excluding these exempt resources, so it reflects only production compliance. The security team regularly audits the exemptions to ensure no production resources are mistakenly exempted. They use Azure Resource Graph to list all exemptions and verify the scope.

Exemptions are metadata and do not impact policy evaluation performance significantly. However, having thousands of exemptions can make compliance reports harder to manage. Best practice is to use exemptions sparingly and review them regularly.