ASR Exclusions don't seem to work

Question

ASR Exclusions don't seem to work

ComputerHabit 1,051

TAGS are horrible with Microsoft Q and A so don't even say I put it in the wrong area... just don't... :)

I'm working on ASR rule specific exclusions. They don't seem to work. I'm following procedure by reading reports in Security center and adding exclusions to the rules.

I am setting policy to WARN instead of Block.

Users are still blocked, Warn does not Warn.

The exclusions can be seen on the system using Get-MPPreference.

What am I missing with ASR Rules? Why aren't exclusions working?

Shweta Mathur 30,426 Reputation points Microsoft Employee Moderator

2023-10-26T08:22:39.1266667+00:00

Hi @ComputerHabit ,

Thanks for reaching out.

Could you please confirm how you are trying to configure rule specific exclusions. As of now, Per Rule exclusions also known as rule specific exclusions are not configured using PowerShell or Group Policy.

Reference - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide#configure-asr-per-rule-exclusions

Thanks,

Shweta
ComputerHabit 1,051 Reputation points

2023-10-26T14:01:36.35+00:00

I'm using Intune. I'm using the policies in Endpoint Security.
Aaron Broomhall 0 Reputation points

2025-11-19T16:05:58.6133333+00:00

I have faced the same issue with getting a certain ForcePoint exe excluded, I can see it has an exception in place for the rules I am seeing a block from the report in defender, however it doesn't seem to be applying the exception. I have also had a similar issue with WDAC to be honest, maybe it's time to contact MS support.

2 answers

Your answer

Shweta Mathur 30,426 Reputation points Microsoft Employee Moderator

2023-10-26T08:22:39.1266667+00:00

Hi @ComputerHabit ,

Thanks for reaching out.

Could you please confirm how you are trying to configure rule specific exclusions. As of now, Per Rule exclusions also known as rule specific exclusions are not configured using PowerShell or Group Policy.

Reference - https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-deployment-test?view=o365-worldwide#configure-asr-per-rule-exclusions

Thanks,

Shweta
ComputerHabit 1,051 Reputation points

2023-10-26T14:01:36.35+00:00

I'm using Intune. I'm using the policies in Endpoint Security.
Aaron Broomhall 0 Reputation points

2025-11-19T16:05:58.6133333+00:00

I have faced the same issue with getting a certain ForcePoint exe excluded, I can see it has an exception in place for the rules I am seeing a block from the report in defender, however it doesn't seem to be applying the exception. I have also had a similar issue with WDAC to be honest, maybe it's time to contact MS support.

Answer 1

Bruno Santos (Magic4N) 85

I use Defender and Intune to do this, send me a print so I can see how you did it

Answer 2

ComputerHabit 1,051

I had to contact MS support. There was an issue with a version of Defender that made exclusions not work. I had to wait get updates to resolve the problem.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

ASR Exclusions don't seem to work

2 answers

Your answer