Skip to main content

🛡️ Azure Subscription Activity Log Alert for Create or Update Policy Exemption does not exist🟢

  • Contextual name: 🛡️ Subscription Activity Log Alert for Create or Update Policy Exemption does not exist🟢
  • ID: /ce/ca/azure/subscription/activity-log-alert-for-create-or-update-policy-exemption
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Stats​

not available

Logic​

Description​

Open File

Description​

Create an activity log alert rule that notifies an action group whenever the activity log records the Create policy exemption operation in the Administrative category. The operation covers both new exemptions and changes to existing ones at or below the subscription scope.

Rationale​

A policy exemption removes a resource or scope from evaluation by a policy or initiative assignment, so a Deny effect stops blocking and an Audit effect stops reporting, while the assignment itself is unchanged. Compliance views then show the resource as Exempt rather than Non-compliant, which hides a deliberately weakened configuration from routine compliance review.

Audit​

This policy marks an Azure Subscription as INCOMPLIANT if no current enabled Activity Log Alert covers Administrative / Microsoft.Authorization/policyExemptions/write, has a resolved action group, and covers the subscription root. Category and operation must occur on their matching JSON fields, with no additional Level, Status, Caller, or other filter.

... see more

Remediation​

Open File

Remediation​

Create an enabled Activity Log Alert for Microsoft.Authorization/policyExemptions/write in the Administrative category across the affected subscription. Set the scope to /subscriptions/{{subscription-id}}.

Review existing alerts for this event before creating another. Select a current action group with enabled notification receivers for the responsible team, and review the expected notification volume and any charges for its notification channels.

Use an unused alert-rule name for the command examples. Before editing an existing rule, record its configuration and retain all action groups that are still required.

From Azure Portal​

  1. Go to Monitor > Alerts and select Create > Alert rule.
  2. On the Scope tab, select the affected subscription itself and select Apply.
  3. On the Condition tab, select See all signals, choose Create policy exemption (Policy exemption), and select Apply.
  4. Leave Event level, Status, and Event initiated by set to All. The condition should match only the Administrative category and the specified operation.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS Azure v7.0.0 → 💼 6.1.2.14 Ensure that Activity Log Alert Exists for Create or Update Policy Exemption (Automated)1no data
💼 Cloudaware Framework → 💼 Alerting and Notification49no data