the compliance when create a new subscription: CIS controls v8.1, how to change its status from non-compliant to compliant?

Hello @rain purple ,

Thanks for reaching out to Microsoft Q&A

What you’re seeing is expected on a newly created subscription. When a subscription is onboarded to Microsoft Defender for Cloud (or inherits assignments from a management group), the Microsoft Cloud Security Benchmark / ASC Default initiative and CIS Controls v8.1 are applied. Many of those controls are shared-responsibility or process-oriented, so they show as non-compliant until the required resources or configurations exist.

• Centralize security event alerting (CIS Controls v8.1) This control expects a centralized alerting solution (SIEM such as Microsoft Sentinel, or a Log Analytics workspace with security correlation alerts). On a new/empty subscription there is nothing to evaluate yet, so it appears non-compliant. Implementing the SIEM or Log Analytics + alerts satisfies the control. Until then, an exemption is a normal and supported approach.
• No related resources match the effect details in the policy definition This is the standard Azure Policy reason for auditIfNotExists / deployIfNotExists policies when the expected related resource (diagnostic setting, alert rule, etc.) does not exist. It is common on new subscriptions and clears once the required resources are deployed, or you can exempt the control.

Recommended next steps

1. Decide for each control whether you will remediate it or accept the risk temporarily.
2. Create an exemption where appropriate:
   • Go to Microsoft Defender for Cloud → Recommendations, open the finding, and select Exempt.
     • Choose scope (subscription / resource group / specific resources), category (Mitigated if another tool covers it, Waiver if you are accepting the risk for now), add a clear justification, and optionally set an expiration date.
       • Alternatively, create the exemption from Policy → Compliance.

Official documentation:

• Exempt resources from recommendations (Defender for Cloud)
• Azure Policy exemption structure
• Determine causes of non-compliance

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Many non-compliant controls on a new subscription are expected; CIS Controls v8.1 and ASC/MCSB are Azure Policy initiatives, not a single switch. In Defender for Cloud > Regulatory compliance, open each control and the recommendation or policy.

“No related resources match the effect details” means an auditIfNotExists policy cannot find a required related resource, such as alerting or log configuration. Create it, or start a remediation task when the policy supports deployIfNotExists or modify, then wait for reevaluation. For manual controls such as SIEM alerting, submit an attestation and evidence if the initiative uses the manual effect.

Do not create blanket exemptions to clear status. Exempt only when a control does not apply, is mitigated elsewhere, or the risk is accepted; include scope, justification, evidence, and expiry. The Developer support plan allows a request through Help + support > Create a support request, selecting Defender for Cloud or Azure Policy.