Azure Policy installs Qualys extension to the AKS Nodes about microsoft-defender-for-cloud

[TomJanetscheck]

Hi @serxansherif
When assigning a policy definition, you can define a scope to exclude from the assignment. Doing so, you can make sure that the DINE policy is not applied to a particular scope, such as the AKS nodes' resource group. You can find further information here and here.

[serxansherif]

hi @TomJanetscheck

are there any options to excluding in the Policy definition without assigning exclusion to the Resource Groups?
I want to build a more dynamic Policy instead of assigning RGs.
In the following screenshot, Policy includes VMs, does it possible to exclude only AKS Nodes here?

[TomJanetscheck]

A policy definition will only define what the policy will do (and for what resource type), not where. The assignment is where you decide for which resources a policy will be effective. You can assign the policy on a level up to your Tenant Root Management Group, and exclude the resources, resource groups, and/or subscriptions you do not want to be touched by the policy.

[serxansherif]

Hi @TomJanetscheck
Thanks for the clarification. I have another issue related to this Azure Policy. Policy installed Qualys extension to the 4 VMs then it stopped to install the extension, other VMs (about 20) are shown non-compliant in the Policy.

[TomJanetscheck]

The policy will run a remediation task for all resources which are non-compliant. However, it may take a while to pick up remediation for all resources. If the issue persists, I suggest to open a support ticket as this issue then is related to the Qualys installation itself, not the DINE policy.

Closing this GitHub issue since answers to the initial request have been provided.