Transition from disable rules to exemptions

Microsoft Defender for Cloud is transitioning its recommendation model from grouped recommendations to individual recommendations. This article explains how to migrate your existing disable rules to the new exemption model, including how to map each disable rule type to its exemption equivalent and the steps to complete the migration before grouped recommendations are deprecated. As part of this change:

Important

Grouped recommendations are deprecated on July 31, 2026. We recommend completing your migration to exemptions before that date.

Grouped recommendations are being deprecated and replaced with individual recommendations. Learn more about the transition from grouped to individual recommendations.
Disable rules, which are used with grouped recommendations, are being deprecated.
Exemption rules are the new approach for individual and risk-based recommendations.

What's changing

In the old model, which is deprecated on July 31, 2026, grouped recommendations use disable rules to suppress findings.

In the new model, individual and risk-based recommendations use exemption rules. Learn more in Exempt resources at scale and Exempt resources from recommendations.

Disable rules that you created for grouped recommendations aren't supported in the new model.

Why use exemptions?

Exemptions give you a more scalable, flexible, and centralized way to manage exceptions.

Centralized management across recommendations: Disable rules apply per recommendation. If you wanted to disable the same Common Vulnerabilities and Exposures (CVE) across multiple recommendations, you had to create a separate rule for each one. With exemptions, you apply a rule once and it affects all relevant recommendations.
Resource-level granularity: Disable rules don't support fine-grained control for a specific resource. Exemptions let you apply rules at the individual resource level, such as a VM or container.
Central visibility and tracking: With disable rules, you had to open each recommendation to view its rules. With exemptions, you can view and manage all rules in one centralized experience.
Exemption lifecycle with expiry dates: Disable rules remain in effect until you remove them manually. Exemptions support expiry dates, which helps you reduce long-lived risk and review accepted vulnerabilities regularly.

Migration guidance

There's no automatic migration from disable rules to exemptions. However, you can recreate your existing rules by using exemption conditions.

Map disable rules to exemption conditions

Use this table to translate your existing disable rules into exemption conditions.

Disable rule action	Exemption condition
IDs	Use the Selected recommendations condition and search for the relevant recommendation.
Categories	Use Recommendation category. For example, use categories such as System updates or Service upgrade.
Security checks	Use the Selected recommendations condition and search for the relevant recommendation.
CVEs	Use the Vulnerabilities condition and enter the CVE value in the CVE property.
CVSS	Use the Vulnerabilities condition and enter the CVSS value in the CVSS property.
Minimum severity	Use the Vulnerabilities condition and enter the severity value in the Minimum severity property.
Non-patchable	Use the Vulnerabilities condition and select Non-patchable.

Recommended migration steps

Use the following steps to migrate your existing disable rules to exemptions.

Identify existing disable rules: Review the rules configured for each recommendation and note the conditions you use, such as CVE and severity. Alternatively, you can use the following Azure Resource Graph (ARG) query to retrieve all existing disabled rules:
```
policyresources
| where type =~ "microsoft.authorization/policyassignments"
| extend filters = todynamic(properties).metadata.subAssessmentSettings.filters
| where filters != ""
```
Translate to exemption conditions: Use the preceding mapping table to convert each rule to its exemption equivalent.
Create the exemptions: To create and manage exemptions, see Exempt resources at scale and Exempt resources from recommendations.
Prefer reusable rules: Where possible, use broader exemption conditions that apply across multiple recommendations to reduce duplication.

Recreate a vulnerability-based exemption by using the REST API

When you migrate vulnerability assessment disable rules, you can use the Standard Assignments REST API to create an equivalent vulnerability-based exemption.

The following example exempts vulnerability findings that match all the specified conditions: CVE ID, severity, and CVSS score.

Replace {subscriptionId} with your Azure subscription ID and {standardAssignmentName} with a unique GUID for the exemption.

PUT https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/standardAssignments/{standardAssignmentName}?api-version=2024-08-01

Use the following request body:

{
  "properties": {
    "description": "Exempts vulnerability findings that match the specified conditions.",
    "displayName": "Vulnerability assessment exemption",
    "excludedScopes": [],
    "effect": "Exempt",
    "assignedStandard": null,
    "exemptionData": {
      "exemptionCategory": "Waiver",
      "assignedAssessment": {
        "assessmentKey": "122e0164-4019-4126-8c64-b0816b49505f"
      },
      "subAssessmentExemptionRule": {
        "if": {
          "allOf": [
            {
              "field": "va.cve.cveId",
              "operationType": "ContainedInOperation",
              "operation": {
                "values": [
                  {
                    "title": "CVE-2020-1347"
                  }
                ]
              }
            },
            {
              "field": "va.cve.severity",
              "operationType": "LessThanFilterOperation",
              "operation": {
                "value": "Low"
              }
            },
            {
              "field": "va.cve.cvss",
              "operationType": "LessThanFilterOperation",
              "operation": {
                "value": "8.0"
              }
            }
          ]
        }
      }
    }
  }
}

The allOf operator applies the exemption only to vulnerability findings that match all three conditions. Change the assessment key and condition values to match the disable rule that you're recreating.

For more information, see Standard Assignments - Create.

Next steps

Transition from grouped to individual recommendations — Learn about the broader recommendation model change that this transition is part of.
Exempt resources from recommendations — Create an exemption for a specific resource or subscription.
Exempt resources at scale — Manage exemptions centrally across multiple scopes.
Review exemptions — View and audit all active exemption rules.
Disable vulnerability findings on images (risk-based) — Learn about the disable rules feature that's being deprecated.
Security recommendations in Defender for Cloud — Understand how recommendations work in the new individual recommendations model.

Last updated on 2026-08-07