Skip to content

Exempt the landing zone subscriptions from specific policies

Context and Problem Statement

Our landing zone implementation adheres to the Azure Security Benchmark (ASC), ISO 27001:2013, CIS 1.4.0, and NIS2 compliance standards. We choose not to meet all policies defined in these standards by default. This ADR describes which policies we exempt for subscriptions belonging to the landing zone and why.

Decision Drivers

  • The requirement to be compliant with the Azure Security Benchmark
  • The requirement to be compliant with ISO 27001:2013
  • The requirement to be compliant with CIS 1.4.0
  • The requirement to be compliant with NIS2
  • The ability to manage customer landing zones with our Xebia account
  • The requirement to be diligent about the costs of resources in the landing zone

Considered Options

  • Exempt the landing zone subscriptions from specific policies

Exempt the landing zone subscriptions from specific policies

For ISO 27001:2013, CIS 1.4.0, ASC, and NIS2 we exempt the following policies:

  • "Guest accounts with write permissions on Azure resources should be removed" because we (often) use our Xebia account in customer tenants
  • "Guest accounts with owner permissions on Azure resources should be removed" because we (often) use our Xebia account in customer tenants
  • "A maximum of 3 owners should be designated for your subscription" because our entire team needs owner access to service landing zone subscriptions
  • "There should be more than one owner assigned to your subscription" because there is a group with multiple members that has the Owner role assignment

Because we use our Xebia account, as a guest in the customer tenant, where possible to manage customer landing zones.

Additionally, for CIS 1.4.0 we exempt the following policies:

  • "Microsoft Defender for APIs should be enabled"

Because this adds an extra 250 euros per months per subscription.

Decision Outcome

Chosen option: "Exempt the landing zone subscriptions from specific policies", because: * This allows us to operate customer landing zones

Implementation Update (2026-10-06)

The Defender for APIs plan is configurable through the defender_for_apis post-deployment object. The enabled gate defaults to false and leaves plan settings unchanged. Once enabled, default_plan sets the plan across managed subscriptions. Entries in subscription_overrides take precedence. Supported configuration values are Free and P1 through P5. The compliance control is not exempted, so subscriptions with the plan set to Free remain noncompliant.

The cost estimate above records the rationale at the time of this ADR and has not been revalidated as part of this implementation. Environment defaults remain disabled until pricing is confirmed and approved.