Interpret vulnerability exceptions without reporting excluded exposure as repaired

Source facts

Defender Vulnerability Management can except an entire recommendation or an individual CVE. Applying an exception can suppress associated threat analytics and alerts and change exposure or secure scores. Microsoft allows up to an hour for exposed-asset counts and exposure-score changes to process. An exception’s duration cannot be extended; continuing beyond expiry requires another exception. The documented management surface is the Defender portal, not a public API. Microsoft Learn.

Applicability

Identify the exception type, authorized device-group or global scope, duration and operator’s exception-handling permission. Microsoft distinguishes preview navigation from existing-customer navigation; this brief does not require adopting the preview interface. For recommendation reporting, compare the explicit after-exceptions columns rather than assuming every displayed count uses the same basis.

DSE recommendation

Reconcile exception-adjusted reporting with the unchanged remediation obligation before explaining a score movement. Label the decision as an exclusion with its reason and affected scope, not as a completed software correction. Ask the detection owner to assess the documented suppression consequence before approval. Plan a fresh decision at expiry rather than promising an extension of the existing object. Preserve the pre-exception view alongside the adjusted result for management reporting.

Verification

Following an approved exception, allow for the documented processing interval and inspect its scope, state and adjusted counts. Confirm that the reporting explanation identifies excluded items separately from repaired ones. At cancellation or expiry, review the current recommendation or CVE and the outstanding action owner. Investigate discrepancies between report columns before interpreting a lower number as a reduction in underlying vulnerability.

Official references

Microsoft Learn: Create, view, and manage exceptions. Source reviewed September 9, 2026.