Azure Policy Exemption Permissions Guide

Azure Policy exemption creation is optional and disabled by default. It is a separate consent from the existing Azure Advisor and Storage Inventory write capability. Regulatory compliance reads continue without it.

Exact required actions

Action	Required scope	Purpose
Microsoft.Authorization/policyExemptions/write	The subscription, resource group, or resource where the exemption is created	Creates or updates the child exemption resource.
Microsoft.Authorization/policyAssignments/exempt/action	The policy or initiative assignment scope	Authorizes an exemption against that assignment.

The role should not include policy assignment/definition write, remediation actions, exemption delete, or broad Resource Policy Contributor access unless your organization independently requires them.

Setup operator prerequisites

The person running Automatic setup, Terraform, PowerShell, or manual setup needs both of these operator permissions at every subscription and management group where the custom roles are created:

• Microsoft.Authorization/roleDefinitions/write
• Microsoft.Authorization/roleAssignments/write

Owner or User Access Administrator provides both at the relevant scope. Role Based Access Control Administrator can create role assignments but cannot create the custom role definition by itself. These elevated setup permissions belong to the temporary operator, not the Spotto service principal. See Azure onboarding operator permissions.

Direct and inherited assignments

For an initiative assigned at the selected subscription, assign both actions through the Spotto Policy Exemptions custom role on that subscription.

For an initiative inherited from a management group:

1. Keep policyExemptions/write at the intended target subscription/resource hierarchy.
2. Grant policyAssignments/exempt/action at the management group that owns the assignment.
3. Select only management groups whose inherited assignments Spotto must exempt. Do not default to tenant root.

Setup methods

• Assisted setup: in either Connect Azure or Update Azure Access, select the paired policy-exemption items separately from the Advisor/Storage role. The choices are off by default. Spotto discovers management groups visible to the signed-in operator and offers one exact-scope action-only pair per group, including the tenant root group. Selecting one management-group pair also checks both target-write items for every subscription currently selected in setup; unrelated management groups remain off. Clearing the management-group pair later leaves those subscription items selected for direct assignments, so clear them separately when target writes are no longer required.
• Terraform: set grant_policy_exemption_permissions = true. Add exact management-group resource IDs to policy_assignment_exempt_scopes only when inherited initiatives require them. The module creates one action-only custom role per selected management group because Azure allows only one management group in a custom role's assignable scopes.
• PowerShell: answer yes to the separate policy-exemption prompt. The management-group selector defaults to none and requires a second exact-scope confirmation; the script likewise creates one action-only custom role per confirmed management group.
• Manual: create the subscription role with both actions and an action-only management-group role when required, then assign them to the Spotto service principal.

RBAC changes can take several minutes to propagate. Setup configuration cannot safely prove the mutation without changing Azure state, so Spotto performs the authoritative check when the exemption is submitted.

Assisted setup gives every subscription and management-group role a deterministic scope-specific name. Before it creates or assigns the role, it rejects existing role definitions that contain unrelated actions, data actions, exclusions, or additional assignable scopes. This fail-closed check prevents a same-name broad role from being silently reused.

Rollback

Remove the policy-exemption role assignments, then remove the custom role definitions when they are no longer used. This revokes future writes but does not delete existing Azure exemption resources. Keep exemption records according to your organization's governance and audit policy.

Troubleshooting

• A direct assignment fails: confirm both actions are assigned at the subscription and that the dedicated Spotto write credential is current.
• An inherited assignment fails: confirm policyAssignments/exempt/action at the exact management-group assignment scope, not only the child subscription.
• Azure returns invalid_client: the dedicated write credential is stale or invalid. Run Update Azure Access for the cloud account, allow Azure time to propagate the credential, and retry. If it still fails, contact Spotto support rather than pasting the secret into logs or support messages.
• Azure returns 403: wait for propagation, confirm the correct service principal and scope, and rerun validation/sync.
• Automatic setup or PowerShell reports that the role contains permissions outside the Spotto action set: inspect the existing same-name custom role. Both paths deliberately refuse to extend or assign a broader policy role to new scopes.
• The exemption succeeds but is not visible: Azure Policy evaluation and Spotto evidence refresh are asynchronous; check the action status, then refresh the regulatory compliance view.

For workflow and evidence semantics, see Azure Policy Regulatory Compliance.