Exceptions Register¶
This page is the single list of places where the platform knowingly departs from its own rules. Each entry is either an accepted exception (a deliberate choice with an owner and a review date) or a known gap (something that doesn't yet meet the standard and needs work). If a departure isn't listed here, it hasn't been accepted.
- Security Model
- Azure Policy (EPAC): policy exemptions are tracked in EPAC, not here.
How to use this register
Add an entry in the same MR that introduces the exception. Review every entry at least quarterly. When an exception is removed, move it to Closed with the date, rather than deleting it.
Accepted exceptions¶
| ID | Exception | Rule it breaks | Why it's accepted | Mitigations | Review |
|---|---|---|---|---|---|
| EX-002 | azure-privileged-access-packages pipeline holds tenant-wide EntitlementManagement.ReadWrite.All, RoleManagementPolicy.ReadWrite.AzureADGroup and Group.ReadWrite.All, and applies on merge. During a new persona's onboarding it briefly owns that persona's group |
Tier 0 changes go through Lane A | PIM for Groups policies and access packages can't be managed by a human az login (the Azure CLI can't get those Graph scopes, AADSTS65002). Group.ReadWrite.All and temporary ownership are what Graph requires to add a group to a catalog |
Trimmed and verified end to end: no directory role, no PIM eligibility permissions, no RoleManagement.ReadWrite.Directory, no Azure RBAC, OIDC only. Group.ReadWrite.All can't touch role-assignable groups — every persona, approver and requestor group is one — so it can't change who holds, approves or requests Tier 0 access. Onboarding ownership is removed once the group is in the catalog. Two-reviewer MR approval. |
Quarterly |
| EX-003 | EPAC deploy identity holds Role Based Access Control Administrator at mg-intermediate-root and applies from CI |
Tier 0 changes go through Lane A | EPAC must assign roles to the managed identities used by DeployIfNotExists policies |
CODEOWNERS on the repository, all assignments currently DoNotEnforce |
Quarterly |
| EX-004 | Two break-glass accounts hold standing Global Administrator and are excluded from all Conditional Access | No standing Tier 0 privilege | Emergency access must work when PIM, MFA or Conditional Access is broken | Credentials in a physical safe, no other group memberships. Sign-in alerting is planned (GAP-006). | Quarterly, with a sign-in test |
| EX-005 | MCSB control "more than one owner on subscriptions" is disabled | Benchmark compliance | Subscriptions have no standing Owner by design. Owner is granted just-in-time. | Disabled through azure-mcsb-overrides |
Annually |
Known gaps¶
| ID | Gap | Impact | Fix | Tracked in |
|---|---|---|---|---|
| GAP-001 | All policy assignments are DoNotEnforce, including tags |
No guardrail blocks anything. Non-compliance is only reported. | Promote guardrails one at a time | ADR-0001 checklist |
| GAP-002 | New subscriptions don't get Activity Log export automatically | New subscriptions have no exported audit trail until someone runs remediation | enforcementMode: Default on psa-mon-actlog-001 |
Subscription Activity Logs |
| GAP-003 | Resource diagnostic settings are audit-only | Logs from resources inside subscriptions are not collected | Decide between the allLogs and audit-only initiatives, then enforce | Log Analytics Costs |
| GAP-004 | No Privileged Access Workstations | Tier 0 apply may run on everyday laptops | Choose a PAW model | Privileged Access Workstations |
| GAP-005 | No access reviews configured | Access builds up and is never removed | Set up the review scopes | Access Reviews |
| GAP-006 | No alerting on break-glass sign-in, diagnostic setting deletion or log silence | Misuse or loss of logging goes unnoticed | Alert rules on log-platform-prod |
Threat Detection |
| GAP-007 | Defender plan coverage is low (about 11% of plan instances) | Limited threat protection for workloads | Decide which plans to enable | Defender Plans |
| GAP-008 | Conditional Access runs report-only | MFA and the other controls are not enforced by Conditional Access | Review report-only results, then cut over | Conditional Access |
| GAP-009 | NIST SP 800-53 is not assigned as a measured standard | Documentation cites NIST, but compliance isn't measured | Assign the built-in initiative | Regulatory Compliance |
| GAP-010 | Management group activity logs are not exported | Role assignments and policy changes at management group scope, including Tier 0 scopes, are not in the central workspace | Add a diagnostic setting on mg-intermediate-root and the tenant root |
Threat Detection |
| GAP-011 | subscription-vending-workload applies from CI but is still Tier 0 in effect: its state (container subscription-vending) is in sa17452008tenantroot beside Tier 0 state, and its GitLab token is group-wide. The RBAC part is fixed: sp-pla-tf-subscription-vending-rw now holds RBAC Administrator at mg-landingzones and mg-sandboxes only, and subscription-vending-platform is Lane A with a read-only identity |
A compromised workload-vending pipeline could reach Tier 0 state, or other projects through the token | Move its state out of rg-terraform-state; scope its GitLab token to deployments/workloads |
Role Tier Mapping |
Closed¶
| ID | What it was | Closed | How |
|---|---|---|---|
| EX-001 | azure-entra-diagnostics pipeline held Security Administrator and applied from CI |
2026-10-17 | Moved to Lane A. CI plans as sp-pla-tf-entra-diagnostics-ro (Security Reader only); a human applies with ./apply.ps1 |
| EX-006 | azure-conditional-access pipeline held Policy.ReadWrite.ConditionalAccess and applied from CI |
2026-10-19 | Moved to Lane A as t0-azure-conditional-access. CI plans as sp-pla-tf-conditional-access-ro (read-only Graph); a human applies with ./apply.ps1 |