Exceptions Register¶
This page is the single list of places where the platform knowingly departs from its own rules. Each entry is either an accepted exception (a deliberate choice with an owner and a review date) or a known gap (something that doesn't yet meet the standard and needs work). If a departure isn't listed here, it hasn't been accepted.
- Security Model
- Azure Policy (EPAC): policy exemptions are tracked in EPAC, not here.
How to use this register
Add an entry in the same MR that introduces the exception. Review every entry at least quarterly. When an exception is removed, move it to Closed with the date, rather than deleting it.
Accepted exceptions¶
| ID | Exception | Rule it breaks | Why it's accepted | Mitigations | Review |
|---|---|---|---|---|---|
| EX-001 | azure-entra-diagnostics pipeline holds Security Administrator (a standing directory role) and applies from CI |
Tier 0 changes go through Lane A | No Graph application permission exists for Entra diagnostic settings. One resource, rarely changed. | Single-purpose identity and repository, no Graph permissions, manual apply gate, protected main branch |
Quarterly |
| EX-002 | azure-privileged-access-packages pipeline holds tenant-wide EntitlementManagement.ReadWrite.All, the PIM-for-Groups Graph permissions, Group.ReadWrite.All and the Identity Governance Administrator role, and applies on merge |
Tier 0 changes go through Lane A | PIM for Groups policies and access packages can't be managed by a human az login (the Azure CLI can't get those Graph scopes, AADSTS65002), so the only alternative is managing the persona groups' access by hand |
No RoleManagement.ReadWrite.Directory, no Azure RBAC. Can't change who approves or requests: those groups are role-assignable and live in Lane A. Two-reviewer MR approval. Open: Group.ReadWrite.All and Identity Governance Administrator are more than it needs. |
Quarterly |
| EX-003 | EPAC deploy identity holds Role Based Access Control Administrator at mg-intermediate-root and applies from CI |
Tier 0 changes go through Lane A | EPAC must assign roles to the managed identities used by DeployIfNotExists policies |
CODEOWNERS on the repository, all assignments currently DoNotEnforce |
Quarterly |
| EX-004 | Two break-glass accounts hold standing Global Administrator and are excluded from all Conditional Access | No standing Tier 0 privilege | Emergency access must work when PIM, MFA or Conditional Access is broken | Credentials in a physical safe, no other group memberships. Sign-in alerting is planned (GAP-006). | Quarterly, with a sign-in test |
| EX-005 | MCSB control "more than one owner on subscriptions" is disabled | Benchmark compliance | Subscriptions have no standing Owner by design. Owner is granted just-in-time. | Disabled through azure-mcsb-overrides |
Annually |
| EX-006 | azure-conditional-access pipeline holds Policy.ReadWrite.ConditionalAccess and applies from CI |
Tier 0 changes go through Lane A | Conditional Access policy is changed often, and needs review in code | Cannot change groups or roles. Break-glass exclusion enforced in code. Manual apply gate. Report-only by default. | Quarterly |
Known gaps¶
| ID | Gap | Impact | Fix | Tracked in |
|---|---|---|---|---|
| GAP-001 | All policy assignments are DoNotEnforce, including tags |
No guardrail blocks anything. Non-compliance is only reported. | Promote guardrails one at a time | ADR-0001 checklist |
| GAP-002 | New subscriptions don't get Activity Log export automatically | New subscriptions have no exported audit trail until someone runs remediation | enforcementMode: Default on psa-mon-actlog-001 |
Subscription Activity Logs |
| GAP-003 | Resource diagnostic settings are audit-only | Logs from resources inside subscriptions are not collected | Decide between the allLogs and audit-only initiatives, then enforce | Log Analytics Costs |
| GAP-004 | No Privileged Access Workstations | Tier 0 apply may run on everyday laptops | Choose a PAW model | Privileged Access Workstations |
| GAP-005 | No access reviews configured | Access builds up and is never removed | Set up the review scopes | Access Reviews |
| GAP-006 | No alerting on break-glass sign-in, diagnostic setting deletion or log silence | Misuse or loss of logging goes unnoticed | Alert rules on log-platform-prod |
Threat Detection |
| GAP-007 | Defender plan coverage is low (about 11% of plan instances) | Limited threat protection for workloads | Decide which plans to enable | Defender Plans |
| GAP-008 | Conditional Access runs report-only | MFA and the other controls are not enforced by Conditional Access | Review report-only results, then cut over | Conditional Access |
| GAP-009 | NIST SP 800-53 is not assigned as a measured standard | Documentation cites NIST, but compliance isn't measured | Assign the built-in initiative | Regulatory Compliance |
| GAP-010 | Management group activity logs are not exported | Role assignments and policy changes at management group scope, including Tier 0 scopes, are not in the central workspace | Add a diagnostic setting on mg-intermediate-root and the tenant root |
Threat Detection |
Closed¶
None yet.