Entra Policy Suite settings · Settings > Device tagging
Never tag these devices
| Key | DeviceTagging.ExcludeObjects |
|---|---|
| Where | Settings > Device tagging |
| Type | List |
| Default | (empty) |
| Feature | Device tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Devices that the tagging job never touches - e.g. a directory sync service account. They are left out before the plan is made.
When set
From the next run, a matching object gets no tag, no change and no fallback; the run log says how many were left out.
When blank or default
Empty (the default): every object in scope is tagged by the rules.
Risk and how to reverse it
An excluded object keeps whatever tags it has now, also when they are wrong, and a Conditional Access policy that reads them still applies. Keep the list short. Reversible: remove the entry and the next run tags it.
Requires
Admin.
Recommended
Only technical accounts that must not be tagged (e.g. the directory sync account).
Related settings
- Device tagging DeviceTagging.Enabled
- Device tagging mode (scheduled runs) DeviceTagging.Mode
- Also tag a device at once when it changes DeviceTagging.RunOnDirectoryChange
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack