Question: How to manage exemptions created through Defender for Cloud

[teemukom]

Users can create exemptions through Defender for Cloud. How should we take care of these and manage them through EPAC?

[anwather]

A couple of ways: a) Prevent them from doing it via Defender and make them use EPAC. b) Have a regular process to extract exemptions and redeploy them so EPAC can manage them. c) Not manage exemptions at all using EPAC.

[teemukom]

A couple of ways: a) Prevent them from doing it via Defender and make them use EPAC. b) Have a regular process to extract exemptions and redeploy them so EPAC can manage them. c) Not manage exemptions at all using EPAC.

Thanks for a rapid response! We would prefer option B of course. Are there any examples of how to do this?

[anwather]

Yes you can use the export process to extract everything from the environment including exemptions - then if you are already managing exemptions you can update the CSV file. If you are not already managing them the documentation has instructions on how to get set up.

https://azure.github.io/enterprise-azure-policy-as-code/start-extracting-policy-resources/