Define CIS 3.0.0 policy exemptions and ownership boundaries¶

Context and Problem Statement¶

The platform is introducing CIS 3.0.0 policy assignments. Following the decision in ADR-0002 to manage certain exemptions in platform code rather than per customer, this ADR records which CIS 3.0.0 policies the platform exempts and which it does not.

Decision Drivers¶

Platform compliance posture must be explicit and auditable for CIS 3.0.0

Decision Outcome¶

Platform-owned exemptions for CIS 3.0.0:

State storage account exemptions required while hardening and migration work is in progress:
Storage accounts should restrict network access
Storage accounts should disable public network access
Storage accounts should use private link
Storage accounts should allow access from trusted Microsoft services
Configure secure transfer of data on a storage account
Storage accounts should have infrastructure encryption
Landing zones management group exemption:
An activity log alert should exist for specific Policy operations

Customer-owned controls not exempted by the platform:

Ensure that 'Guest invite restrictions' are set to 'Only users assigned to specific admin roles can invite guest users'
Ensure that 'Guest users access restrictions' is set to 'Guest user access is restricted to properties and memberships of their own directory objects'

Consequences¶

Customer-owned tenant controls are not exempted by the platform layer
State storage account exemptions will be removed once hardening and migration work is complete

More Information¶

Current effective exemptions are tracked in docs/policy_exemptions/current-platform-exemptions.md.