Defender for Cloud: Exemptions Not Persisting After Deletion — Reappear After Some Time

I need this escalated to a human engineer with product knowledge of Microsoft Defender for Cloud and the Security Resource Provider specifically. The case summary I received does not reflect the diagnostic work already carried out, and I do not want another AI generated response repeating general Azure Policy troubleshooting steps that do not apply to this issue.

WHY GENERAL POLICY EXEMPTION TROUBLESHOOTING DOES NOT APPLY

An earlier response suggested az policy exemption commands and checking Microsoft.Authorization policyExemptions delete permissions. This does not apply. The resource type actually involved is Microsoft.Security standardAssignments, which is Defender for Cloud's own native exemption type, introduced with the January 2026 consolidated Exemptions view. This is a separate resource provider from Azure Policy exemptions, with no CLI equivalent. I confirmed this directly by capturing the browser network traffic behind the Environment Settings Exemptions page, which queries Azure Resource Graph specifically for type equals microsoft.security slash standardassignments. Our actual Azure Policy exemptions, 17 in total, confirmed via Get-AzPolicyExemption with the IncludeDescendent parameter, are correct and functioning normally. This issue is isolated to the Defender native exemption type.

THE ACTUAL ROOT CAUSE, NOW IDENTIFIED

The reappearing exemption count is not random or a simple caching delay. It is isolated almost entirely to two specific recommendations:

Guest accounts with read permissions on Azure resources should be removed Guest accounts with write permissions on Azure resources should be removed

The Defender for Cloud recommendations page shows these two recommendations with active resource counts of 367 and 35 respectively, both listed as type Subscriptions. Our tenant contains exactly 9 subscriptions in total. Every other recommendation in our environment shows accurate, sane active resource counts in the single or low double digits, matching the real number of affected resources.

This strongly indicates the underlying assessment data feeding these two specific recommendations is corrupted or duplicated at source, generating phantom subscription level findings at roughly 40 times the real count. We believe the exemption system is attempting to create and track one exemption per each of these duplicated phantom entries, which explains both the scale of the reappearing exemptions, approaching 300, and why this is isolated to only these two guest account recommendations rather than affecting exemptions generally across the tenant.

WHAT WE NEED

Please have an engineer investigate why the active resource count for these two specific recommendations is returning approximately 367 and 35 Subscriptions against a tenant with 9 real subscriptions, and whether this is the source of the exemption reappearance issue.

SEPARATE ISSUE ALSO STILL OPEN

Six Microsoft.Security standardAssignments records remain permanently undeletable. Their parent VM resources were deleted several months ago. These records are visible in the portal grid, are not returned by an Azure Resource Graph query against securityresources for this type, and return 404 Not Found when a DELETE is attempted directly via REST against their full resource ID, because the parent VM resource path in the scope no longer resolves. We need a supported method to remove these orphaned records, since the standard REST DELETE path cannot reach them.

Support request number 2609100050001040.