Reconcile Machine Configuration guest assignments when granting a policy exemption

Source facts

Microsoft’s Machine Configuration troubleshooting guidance states that creating a policy exemption does not by itself stop the associated scan. To stop the agent from scanning, the corresponding guest assignment must be deleted. The requirement concerns the guest assignment associated with that policy. Microsoft Learn.

Applicability

Use this review when an approved exemption explicitly includes stopping a particular Machine Configuration scan. Identify the exempted policy, target machine and matching guest assignment. Keep other assignments and any remaining assessment requirements outside that exception’s scope.

DSE recommendation

DSE recommends asking the exemption owner to specify whether scanning should continue or stop. Where stopping is authorized, record the exact guest assignment and expected effect before removal. Review how it would be reinstated when the exception ends. Do not delete all guest assignments on a machine as a shortcut for one policy exemption.

Verification

Compare the exemption record with the targeted assignment before the approved change. Afterward, inspect the assignment state and relevant agent evidence to determine whether the intended scan has stopped. Confirm that unrelated assignments remain present and functioning. Record the owner and review point for restoring assessment so the exception does not silently become permanent.

Official references

Microsoft Learn: Troubleshooting Azure Machine Configuration.