We can configure the exclusion of machines based on tags in the environment settings under Defender plans > Settings & monitoring at the subscription level. This process is detailed in the documentation.

However, configuring the exclusion of certain tags for all subscriptions at scale is not straightforward. Neither the Configure Microsoft Defender for Servers plan nor the Configure Microsoft Defender CSPM plan Azure Policy provides such a parameter.

The following PowerShell command works: 

Set-AzSecurityPricing -Name “CloudPosture” -PricingTier “Standard” -Extension ‘[{“name”:”SensitiveDataDiscovery”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”ContainerRegistriesVulnerabilityAssessments”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”AgentlessDiscoveryForKubernetes”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”AgentlessVmScanning”,”isEnabled”:”True”,”additionalExtensionProperties”:{“ExclusionTags”:”[{“key”:”Microsoft”,”value”:”Defender”},{“key”:”For”,”value”:”Cloud”}]”}}]’

Is directly calling the Azure Resource Manager API (e.g. via Az PowerShell) for every subscription or creating a custom Azure Policy definition the only option? Would be great if this is supported by the built-in policy definition.

​We can configure the exclusion of machines based on tags in the environment settings under Defender plans > Settings & monitoring at the subscription level. This process is detailed in the documentation. However, configuring the exclusion of certain tags for all subscriptions at scale is not straightforward. Neither the Configure Microsoft Defender for Servers plan nor the Configure Microsoft Defender CSPM plan Azure Policy provides such a parameter. The following PowerShell command works:  Set-AzSecurityPricing -Name “CloudPosture” -PricingTier “Standard” -Extension ‘[{“name”:”SensitiveDataDiscovery”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”ContainerRegistriesVulnerabilityAssessments”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”AgentlessDiscoveryForKubernetes”,”isEnabled”:”True”,”additionalExtensionProperties”:null},{“name”:”AgentlessVmScanning”,”isEnabled”:”True”,”additionalExtensionProperties”:{“ExclusionTags”:”[{“key”:”Microsoft”,”value”:”Defender”},{“key”:”For”,”value”:”Cloud”}]”}}]’ Is directly calling the Azure Resource Manager API (e.g. via Az PowerShell) for every subscription or creating a custom Azure Policy definition the only option? Would be great if this is supported by the built-in policy definition.   Read More

​