Taking a resource out of the scope: exclusion

01In a nutshell #sec_8a53649c

A resource whose review makes no sense is withdrawn from the scope rather than being rejected in each campaign — but each exclusion requires a reason, a justification and a review deadline, and the exclusion rate is seen in the audit posture.

02Where #sec_25a39454

Governance › Sanctuarization. Two tabs: Active Exclusions and History. The subtitle, for the administrator: Remove resources from the scope of reviews. Each exclusion requires a reason, a justification and a review deadline.

03When to exclude #sec_89634fc3

A service account, a technical shared mailbox, a system group, a read-only archive site. The test is simple: if a reviewer answers “non-compliant” to each campaign and no one ever acts, the review produces nothing. Exclusion says this once, in writing, with a date to come back to it.

The empty screen puts it this way: All resources in the workspace are covered by current review campaigns. This is the starting state, and a good state.

04The gesture: Excluding a resource #sec_8ebec6be

The panel goes down the tree: platform, tenant, service, then the resource or object to be excluded — by its name or identifier. If the object is already excluded in this scope, the screen says so and refuses the duplicate.

Then the three fields that make the value of the exclusion. The panel comments on them itself: reason, justification and review deadline are mandatory — without a deadline, the exclusion is never reconsidered.

• Reason — chosen from a list.
• Justification — written, visible in the history and for auditors.
• Review deadline — 3 months, 6 months, 1 year, or a date. A reminder is set at

this date.

Write the justification for the person who will read it in a year without having you at hand. “Technical account” explains nothing; “payroll connector service account, owner: HR team, no human logs in” explains everything.

05The line, then #sec_4c14a46b

Each active exclusion carries its resource, its review deadline (In N months, or Overdue since N days), its reason, set by whom, and its scope: Workspace or Global.

A global exclusion comes from the subscription; it is displayed here but managed at the subscription level. You cannot lift or extend it.

06The exclusion pressure #sec_e3784ae4

At the top of the page, an indicator: N% of the scope is under active exclusion (N excluded resources out of N). It is visible in the audit posture of the workspace.

This is intended. A scope of which a quarter is excluded is no longer a certified scope; it is certified three-quarters, and the file will say so. Beyond a ceiling, the screen refuses to set a new exclusion: lift existing exclusions before setting new ones.

07Re-examine: lift or extend #sec_dab959b9

An exclusion whose deadline has passed is displayed Overdue since N days, and a reminder at the top indicates that exclusions have exceeded their re-examination deadline. Two outcomes.

Lift.... regains its place in the next review campaigns. The reason for the lift is mandatory, and its context is visible in the resource's history and for auditors. Lifting does not erase anything: the cycle closes.

Extend the deadline. The exclusion remains active; only the re-examination date is postponed — by 3 months, 6 months, 1 year, or to a specific date. Extending is legitimate when the reason still holds; extending without re-reading the justification is the most discreet way to let an exclusion become permanent.

08The history #sec_44b2ad32

N closed cycles, on N distinct resources — each line shows the most recent cycle; the total is in the file. Last placement, last lift, duration, campaigns concerned by the last cycle, and See the N cycles to go back.

A resource excluded, lifted, then excluded again has two cycles — and this repetition is readable. It is often a sign that an upstream rule is missing, not an additional exclusion.

09Import #sec_c4be0e32

Import places exclusions in bulk from a file. As with delegations: useful at the start, when the list of technical accounts is known; then, one by one, with their justification.

10What the configuration can prohibit #sec_d80584dc

If the workspace does not allow local exclusion, the screen says so: the current configuration of the workspace does not allow adding a local sanctuary. Exclusions then all come from the subscription.

11To remember #sec_fe8f12d7

Excluding means writing why and until when. The exclusion pressure is public in your audit posture; the deadline returns on its own; the lift is justified as much as the placement. What has been excluded is then read in the reports and the file.