{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "slug": "dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption", "url": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/" }, "title": "Reconcile Machine Configuration guest assignments when granting a policy exemption", "summary": "An exemption alone does not complete a request to stop the associated agent scan.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:50+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 203, "potentially_affected": "Use this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception's scope.", "dse_recommendation": "DSE recommends asking the exemption owner to specify whether scanning should continue or stop.", "primary_source": { "name": "Troubleshooting Azure Machine Configuration - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. Microsoft Learn.

\n

Applicability

\n

Use this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.

\n

DSE recommendation

\n

DSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.

\n

Verification

\n

Compare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.

\n

Official references

\n

Microsoft Learn: Troubleshooting Azure Machine Configuration.

", "content_text": "Source facts\nMicrosoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. Microsoft Learn.\nApplicability\nUse this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.\nDSE recommendation\nDSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.\nVerification\nCompare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.\nOfficial references\nMicrosoft Learn: Troubleshooting Azure Machine Configuration.", "content_markdown": "## Source facts\n\nMicrosoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting).\n\n## Applicability\n\nUse this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.\n\n## DSE recommendation\n\nDSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.\n\n## Verification\n\nCompare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.\n\n## Official references\n\n[Microsoft Learn: Troubleshooting Azure Machine Configuration](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "url": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Reconcile Machine Configuration guest assignments when granting a policy exemption", "item": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "url": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/", "headline": "Reconcile Machine Configuration guest assignments when granting a policy exemption", "description": "An exemption alone does not complete a request to stop the associated agent scan.", "abstract": "An exemption alone does not complete a request to stop the associated agent scan.", "articleBody": "Source facts\nMicrosoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. Microsoft Learn.\nApplicability\nUse this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.\nDSE recommendation\nDSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.\nVerification\nCompare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.\nOfficial references\nMicrosoft Learn: Troubleshooting Azure Machine Configuration.", "datePublished": "2026-09-17T16:33:50+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Reconcile Machine Configuration guest assignments when granting a policy exemption" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 203, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshooting Azure Machine Configuration - Azure Machine Configuration | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting" } } ] } }