Merge pull request #5304 from limwainstein/mdvm-cve-exclusions

CVE exceptions

Author: limwainstein

defender-vulnerability-management/TOC.yml

@@ -66,8 +66,12 @@
         href: tvm-security-recommendation.md
       - name: Network share configuration assessment
         href: tvm-network-share-assessment.md
-      - name: Exceptions for security recommendations
-        href: tvm-exception.md
+      - name: Exceptions for security recommendations and CVEs
+        items:
+          - name: Overview
+            href: tvm-exception-overview.md
+          - name: Create and manage exceptions
+            href: tvm-exception.md
       - name: Plan for end-of-support software
         href: tvm-end-of-support-software.md
       - name: Mitigate zero-day vulnerabilities

defender-vulnerability-management/media/tvm-exception-overview/cve-exception-create.png

@@ -0,0 +1,111 @@
+---
+title: Exceptions in Microsoft Defender Vulnerability Management
+description: Learn about exceptions in Microsoft Defender Vulnerability Management.
+ms.service: defender-vuln-mgmt
+ms.author: lwainstein
+author: limwainstein
+ms.localizationpriority: medium
+manager: bagol
+audience: ITPro
+ms.collection:
+  - m365-security
+  - Tier1
+ms.topic: how-to
+search.appverid: met150
+ms.date: 10/20/2025
+appliesto:
+  - Microsoft Defender Vulnerability Management
+  - Microsoft Defender for Endpoint Plan 2
+  - Microsoft Defender XDR
+  - Microsoft Defender for Servers Plan 1 & 2  
+---
+
+# Exceptions in Microsoft Defender Vulnerability Management
+
+[!INCLUDE [Prerelease information](../includes/prerelease.md)]
+
+Microsoft Defender Vulnerability Management provides exceptions to help you control what type of data is relevant to your organization and to selectively exclude specific data from your remediation efforts.
+
+Exceptions provide more accurate risk reporting and prioritization, especially when you have alternate mitigations, accepted risk, or a remediation plan in place.
+
+This article describes how to create, view, and manage Defender Vulnerability Management exceptions.
+
+> [!TIP]
+> Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to [sign up for a free trial](defender-vulnerability-management-trial.md).
+
+## Types of exceptions
+
+Microsoft Defender Vulnerability Management supports two types of exceptions:
+
+- **Security recommendation exceptions**: Exclude specific security recommendations from analysis in your environment. You create this exception at the security recommendation level, which applies to all underlying CVEs associated with that recommendation.
+
+    :::image type="content" alt-text="Screenshot highlighting Exception options in a Recommendation pane." source="media/tvm-exception-overview/exception-button-small.png" lightbox="media/tvm-exception-overview/exception-button-small.png":::
+
+- **CVE exceptions** (Preview): Exclude specific Common Vulnerabilities and Exposures (CVEs) from analysis in your environment. You create a CVE exception from the **Weaknesses** page for a specific CVE.
+
+    :::image type="content" alt-text="Screenshot showing how to create a CVE exception." source="media/tvm-exception-overview/cve-exception-create.png" lightbox="media/tvm-exception-overview/cve-exception-create.png":::
+
+## Exception by device group
+
+You can apply an exception to all current device groups or to specific device groups. Future device groups aren't included in the exception. Device groups that already have an exception aren't displayed in the list. 
+
+After you create the exception:
+
+- For recommendation exceptions, if you select specific device groups, the recommendation state changes from **active** to **partial exception**. The state changes to **full exception** if you select all the device groups.
+- For CVE exceptions, the CVE no longer appears in the inventory lists for the selected scope.
+
+![Showing device group dropdown.](/defender/media/defender-vulnerability-management/tvm-exception-device-group-500.png)
+
+## Global exceptions
+
+If you have Security Administrator permission or a custom role that includes the exceptions handling permission, you can create and cancel a global exception. This exception affects **all** current and future device groups in your organization, and only users with similar permissions can change it.
+
+> [!IMPORTANT]
+> While the Global Administrator permission also allows you to create and cancel global exceptions, Microsoft recommends that you use roles with the fewest permissions. Using lower accounts with lower permissions helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
+
+After you create the exception:
+
+- For recommendation exceptions, the recommendation state changes from **active** to **full exception**.
+- For CVE exceptions, the CVE no longer appears in the inventory lists for the entire organization.
+
+![Showing global exception option.](/defender/media/defender-vulnerability-management/tvm-exception-global.png)
+
+Some things to keep in mind:
+
+- If a recommendation is under global exception, then newly created exceptions for device groups is suspended until the global exception has expired or been canceled. After that point, the new device group exceptions go into effect until they expire.
+- If a recommendation already has exceptions for specific device groups and a global exception is created, then the device group exception is suspended until it expires or the global exception is canceled before it expires.
+
+### Justification
+
+The following justifications are available for exceptions:
+
+- **Third party control**: A third party product or software already addresses this recommendation.
+- **Alternate mitigation**: An internal tool already addresses this recommendation.
+- **Risk accepted**: Poses low risk and/or implementing the recommendation is too expensive.
+- **Planned remediation (grace)**: Already planned but is awaiting execution or authorization.
+- **CVE with no patch** (CVE exceptions only): No patch is available from the vendor.
+
+## Exposed devices and impact after exceptions
+
+# [Recommendation exceptions](#tab/recommendation-exclusions)
+
+The impact (after exceptions) shows remaining impact to exposure score or secure score after exceptions are applied. Exception justifications that affect the scores include **third party control** and **alternate mitigation**. Other justifications don't reduce the exposure of a device, and so the exposure score and secure score don't change.
+
+![Showing the columns in the table.](/defender/media/defender-vulnerability-management/tvm-after-exceptions-table.png)
+
+# [CVE exceptions (Preview)](#tab/cve-exclusions)
+
+If the exception is global, no exposed devices are shown for that CVE during the exception period.
+
+If the exception is scoped to specific device groups, only devices outside those groups appear as exposed.
+
+The impact (after exceptions) shows remaining impact to exposure score or secure score after exceptions are applied. With CVE exceptions, the justification doesn't affect the impact score.
+
+---
+
+## Related topics
+
+- [Remediate vulnerabilities](tvm-remediation.md)
+- [Security recommendations](tvm-security-recommendation.md)
+- [Exposure score](tvm-exposure-score.md)
+- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)