# Reconcile Machine Configuration guest assignments when granting a policy exemption

> An exemption alone does not complete a request to stop the associated agent scan.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:50+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

An exemption alone does not complete a request to stop the associated agent scan.

## Potentially affected

Use this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception's scope.

## DSE recommendation

DSE recommends asking the exemption owner to specify whether scanning should continue or stop.

## Article

## Source facts

Microsoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting).

## Applicability

Use this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.

## DSE recommendation

DSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.

## Verification

Compare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.

## Official references

[Microsoft Learn: Troubleshooting Azure Machine Configuration](https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting).

## Primary reference

- Name: Troubleshooting Azure Machine Configuration - Azure Machine Configuration | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Reconcile Machine Configuration guest assignments when granting a policy exemption,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-070-reconcile-machine-configuration-guest-assignments-when-granting-a-policy-exemption/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.