Daily Defender News
Aboutmerill.net
Microsoft Defender for Cloud
Cloud and workloads

Disable Vulnerability Findings on Images (risk-based) - Microsoft Defender for Cloud | Microsoft Learn

29 September 2026Doc update+26 / −23 lines

In brief

The article was retitled and updated with a clearer introduction, revised formatting, refreshed links, and clarified descriptions and examples for CVE, image digest, OS version, severity, and fix-status exclusions.

What Defender admins need to know

Administrators can use the revised guidance when configuring exemptions; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Disable vulnerability findingsVulnerability Findings on imagesImages (risk-based) - Microsoft Defender for Cloud | Microsoft Learn

Use this article to create exemptions and disable vulnerability assessment findings for container registry images and running images in Microsoft Defender for Cloud.

Create and manage disable rules for vulnerability findings

Important

You can use a combination of any of the following criteria:

  • Common Vulnerabilities and Exposures (CVE) -. Enter the CVEs of the findings you want to exclude. Ensure the CVEs are valid. Separate multiple CVEs with a semicolon. For example, CVE-2020-1347; CVE-2020-1346.1346.
  • Image digest -. Specify images for which vulnerabilities should be excluded based on the image digest. Separate multiple digests with a semicolon, for example: sha256:9b920e938111710c2768b31699aac9d1ae80ab6284454e8a9ff42e887fa1db31;sha256:ab0ab32f75988da9b146de7a3589c47e919393ae51bbf2d8a0d55dd92542451c.
  • OS version -. Specify images for which vulnerabilities should be excluded based on the image OS.operating system. Separate multiple versions with a semicolon, for example: ubuntu_linux_20.04;alpine_3.17.
  • Minimum Severity -. Select low, medium, high, or critical to exclude vulnerabilities less than the specified severity level.
  • Fix status -. Select the option to exclude vulnerabilities based on their fix status.

Disable rules apply per recommendation. For example, to disable the CVE-2017-17512 vulnerability on both registry images and runtime images, configure the rule in both recommendations. For CVE details,more information, see CVE-2017-17512.

Note

To create a disable rule for vulnerability findings, follow these steps:

  1. Sign in to the Azure portal.

  2. Go to Microsoft Defender for Cloud > Recommendations.

  3. Search for one of the following recommendations:

    • Container registry images should have vulnerability findings resolved powered by Microsoft Defender Vulnerability Management

  4. Select the relevant scope.

  5. Define your criteria. You can use any of the following criteria:

    • Common Vulnerabilities and Exposures (CVE) -. Enter the CVEs of the findings you want to exclude. Ensure the CVEs are valid. Separate multiple CVEs with a semicolon. For example, CVE-2020-1347; CVE-2020-1346.1346.
    • Image digest -. Specify images for which vulnerabilities should be excluded based on the image digest. Separate multiple digests with a semicolon, for example: sha256:9b920e938111710c2768b31699aac9d1ae80ab6284454e8a9ff42e887fa1db31;sha256:ab0ab32f75988da9b146de7a3589c47e919393ae51bbf2d8a0d55dd92542451c.
    • OS version -. Specify images for which vulnerabilities should be excluded based on the image OS.operating system. Separate multiple versions with a semicolon, for example: ubuntu_linux_20.04;alpine_3.17.
    • Minimum Severity -. Select low, medium, high, or critical to exclude vulnerabilities less than and equal to the specified severity level.
    • Fix status -. Select the option to exclude vulnerabilities based on their fix status.

  6. In the justification text box,For Justification, explain why you disabled a specific vulnerability. This explanation helps anyone who reviews the rule.

  7. Select Apply rule.

    Screenshot showing where to create a disable rule for vulnerability findings on registry images.

To manage existing disable rules, follow these steps:

  1. From the recommendations detail page, select Disable rule.

  2. From the scope list, subscriptions with active rules show as Rule applied.

  3. To view or delete the rule, select the ellipsis menu ("...") (ellipsis menu).

  4. Do one of the following:

    • To view or override a disable rule -rule, select View rule, make any changes you want, and select Override rule.
    • To delete a disable rule -rule, select Delete rule.

    Warning

    Deleting a disable rule re-enables vulnerability findings for the affected scope. Previously suppressed findings will reappear in the findings list and affect your secure score.

    Screenshot showing where to view, delete, or override a rule for vulnerability findings on registry images.

\ No newline at end of file