PIM Manager settings · Settings > Hybrid AD & workloads
Workload exemptions
| Key | WorkloadExemptions |
|---|---|
| Where | Settings > Hybrid AD & workloads > Workload exemptions |
| Type | List |
| Default | Empty (no exemptions) |
| Feature | Entra ID, Azure, Intune and Defender XDR from one model · Community, Pro Business, Pro Enterprise, Pro MSP |
What it does
A list of workload role bindings (for example a Defender XDR or Intune role for a group) that you deliberately do not want created. Each entry names a workload and/or a role, optionally a group tag and a scope, a reason, and an expiry date or No expiry. A blank group tag or scope means 'any'.
When set
When an entry is active: the workload reconciliation shows the binding as 'exempted' instead of 'missing', and on its next run the engine's workload connector reports it and does not create it. It never removes a binding that already exists. The day after the expiry date the exemption stops counting, the binding shows as missing again and the next run creates it.
When blank or default
When the list is empty: every desired workload binding is expected to exist, and the engine creates any that are missing on its next run.
Risk and how to reverse it
An entry with only a workload (no role) excuses every role of that workload. Removing an entry, or letting it expire, lets the engine create that role assignment in your tenant on its next run. Only the generic workload connector honours exemptions; a Defender XDR row that carries its own custom role definition is applied by a separate step that does not read this list. Reversible: add or remove entries at any time.
Requires
Admin to add or remove entries; anyone can read them. Free (Community) and Pro. Takes effect only where the workload connectors are on and the engine has the workload's own permissions.
Recommended
Use it sparingly, always with a real reason and an expiry date, so an exemption is reviewed instead of becoming permanent.
Related settings
- Workload connectors: Intune + Defender XDR FeatureGates.connectors.workload
Documented for PIM Manager 3.0.70. Written by the PIM Manager team; Invardia publishes it. · All settings · Security review pack