Enabling the Compliance Security Profile (CSP) for HIPAA on Azure Databricks
July 29, 2026Find Alternative Azure VM SKUs with azqr
July 29, 2026
When a policy is applied, some resources in scope may need to be temporarily exempted from enforcement, whether it be during a migration, an incident, or while an app team works through its compliance requirements.
However, the moment you grant an exemption, that resource’s compliance result flips to “Exempt” and that’s all you see. The underlying state is hidden behind the exemption. This leads to questions like, is the resource violating the policy right now? Or has it quietly come into compliance since the exemption was granted, and can I safely remove the exemption? The “Exempt” status alone can’t tell you.
To solve this, we’ve introduced a new compliance substate property on Azure Policy compliance results. This property tells you what the resource’s compliance state would be if the exemption were removed so you never lose sight of the underlying state.
Before and after
- Before: Your compliance report lists 40 resources, all showing “Exempt” and nothing more. You have no idea which exemptions still matter, so you either leave them all in place or audit each one by hand.
- After: The same 40 resources still show Exempt, but now each carries a substate – 28 Compliant (safe to retire) and 12 non-compliant (still needed). Your cleanup list just wrote itself.
How to see the sub-state
The primary way you will interact with Compliance Substate is right where you already review compliance today, the Compliance tab of the Azure Policy blade. It surfaces as an optional column in the resource compliance table of an assignment’s compliance report.
How to show the Compliance Substate column
- Open the assignment’s compliance report. In the Azure portal, go to Policy > Compliance, then open the report of the assignment you want to view.
- Click on the “Edit Column” button to edit which columns are shown by default.
3. Add the new property. In Edit Options, add a new property and select the “Compliance sub state” and then select save. You can drag to reorder the columns.
4. Read the results. Exempt resources now show Compliant or Non-compliant. Non-exempt resources show blank for compliance substate.
Additionally, you can click on the “Waiver” or “Mitigated” status under the “Compliance details” column and the details tab will include the compliance substate by default.
Querying the property
The portal column is perfect for reviewing a single assignment. For org wide exemption audits you will want to query across every subscription at once. Compliance Substate is also surfaced in Azure Resource Graph (ARG) under properties.stateDetails.complianceSubState, so you can build reports, dashboards, and automation on top of it.
The core query. List every exempted resource and its substate:
policyresources
| where type == “microsoft.policyinsights/policystates”
| extend complianceState = tostring(properties.complianceState)
| extend complianceSubState = tostring(properties.stateDetails.complianceSubState),
resourceId = tostring(properties.resourceId),
policyAssignmentId = tostring(properties.policyAssignmentId)
| where complianceState == “Exempt”
| project resourceId, policyAssignmentId, complianceState, complianceSubState
Conclusion
Exemptions will always be part of governance, but they no longer have to be a blind spot. Compliance Substate shows you what is really happening underneath every exemption, so you can remediate resources, confirm they are green, and retire exemptions with confidence instead of guesswork. Give it a try and let us know what you think by sharing your thoughts to policypm@microsoft.com!