Introducing Compliance Substate for Azure Policy Exemptions!
When you’re applying a policy, you might find that some resources need a temporary exemption from enforcement. This often occurs during migrations, incidents, or as app teams navigate their compliance needs.
However, once you grant an exemption, the compliance status of that resource changes to “Exempt,” and that’s all you can see. This can raise important questions: Is the resource currently out of compliance? Has it actually complied since the exemption was issued, allowing you to lift the exemption safely? The “Exempt” label alone doesn’t provide this information.
To address this issue, we’ve launched a new compliance substate property for Azure Policy compliance results. This feature reveals what the resource’s compliance status would be if the exemption were lifted, keeping you informed about the underlying situation.
- Before: Your compliance report lists 40 resources, all marked as “Exempt” with no further details. You’re left wondering which exemptions are still relevant. As a result, you either keep all exemptions active or have to check each one individually.
- After: You still see the same 40 resources marked as Exempt, but now each one has a substate. For example, 28 are Compliant (meaning you can remove the exemption) and 12 are Non-Compliant (which still need attention). Your cleanup process just became much simpler!
The main place to interact with the Compliance Substate is where you currently review compliance — in the Compliance tab of the Azure Policy blade. It appears as an optional column in the resource compliance table of an assignment’s compliance report.
- Access the assignment’s compliance report. In the Azure portal, navigate to Policy > Compliance, and open the report for the assignment you wish to examine.
- Click on the “Edit Column” button to adjust which columns are displayed by default.
3. Incorporate the new property. In the Edit Options, add a new property, select “Compliance sub state,” and click save. You can also drag to rearrange the columns.
4. Interpret the results. Now, exempt resources will display as either Compliant or Non-compliant. Resources that are not exempt will show a blank for the compliance substate.
Additionally, if you click on the “Waiver” or “Mitigated” status in the “Compliance details” column, the details tab will automatically include the compliance substate.
Utilising the portal column is great for examining a single assignment. However, if you need to perform organisation-wide exemption audits, querying across every subscription at once is advisable. The Compliance Substate is also accessible via Azure Resource Graph (ARG) under properties.stateDetails.complianceSubState, enabling you to create reports, dashboards, and automation around it.
The core query to list every exempted resource along with its substate is as follows:
policyresources
| where type == "microsoft.policyinsights/policystates"
| extend complianceState = tostring(properties.complianceState)
| extend complianceSubState = tostring(properties.stateDetails.complianceSubState),
resourceId = tostring(properties.resourceId),
policyAssignmentId = tostring(properties.policyAssignmentId)
| where complianceState == "Exempt"
| project resourceId, policyAssignmentId, complianceState, complianceSubState
While exemptions will always be a part of governance, they don’t have to create uncertainty. With Compliance Substate, you can clearly see what’s happening behind each exemption, allowing you to manage resources effectively, ensure they comply, and remove exemptions when it’s safe to do so. Give it a go and let us know your feedback at [email protected]!
Share this content:
Discover more from Qureshi
Subscribe to get the latest posts sent to your email.
