• Intro
• Build the delete URI
• Delete the exemption

Intro

This article is part of a series: Navigate to series page

In this post I show how to delete a Defender for Cloud recommendation exemption by using REST API.

If needed, read the previous posts first:

• Microsoft Defender for Cloud - Get exemptions using REST API
• Microsoft Defender for Cloud - Create exemptions using REST API

Build the delete URI

Instead of relying on copied IDs or display names, you can calculate the same standardAssignmentName deterministically and build the delete URI from known inputs:

function New-DeterministicGuidFromText {
    param([Parameter(Mandatory)][string]$InputText)

    $bytes = [System.Text.Encoding]::UTF8.GetBytes($InputText)
    $hash = [System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes)
    $hashHex = ($hash | ForEach-Object { $_.ToString("x2") }) -join ""
    return "{0}-{1}-{2}-{3}-{4}" -f $hashHex.Substring(0, 8), $hashHex.Substring(8, 4), $hashHex.Substring(12, 4), $hashHex.Substring(16, 4), $hashHex.Substring(20, 12)
}

$displayName = "ckj-test-exemption-privileged-role-subscription-level"
$identityObjectId = "12345678-1234-1234-ab12-12345678abcd"
$assessmentKey = "706b33f0-129e-4ed0-a179-f450b9ee4145"

$assignmentSeed = "$subscriptionId|$identityObjectId|$assessmentKey|$displayName"
$standardAssignmentName = New-DeterministicGuidFromText -InputText $assignmentSeed

$resourceScope = "/subscriptions/$subscriptionId/providers/Microsoft.Security/pricings/CloudPosture/securityentitydata/$identityObjectId"
$uri = "https://management.azure.com/$resourceScope/providers/Microsoft.Security/standardAssignments/$standardAssignmentName?api-version=2024-08-01"

This ensures you target the exact same assignment every time.

Delete the exemption

# For endpoint details, see:
# https://learn.microsoft.com/en-us/rest/api/defenderforcloud/standard-assignments/delete?view=rest-defenderforcloud-2024-08-01
Invoke-RestMethod -Uri $uri -Method Delete -Headers $headers

You should receive a success response for the delete operation.

Final remark: keep your exemptions time-bound where possible by using expiration and periodic review, so accepted risk does not become permanent by default.