Handle extension exceptions by recording each one with a named requester, a business reason, a narrow scope and an expiry date, then reviewing it before it lapses. Exceptions that never expire quietly turn a default-deny policy into default-allow. A small, written process keeps the policy credible and the audit trail clean.
Why exceptions need their own process
A default-deny extension policy will always meet a case it did not expect: a designer needs a color picker, a developer needs a debugging tool. If the answer is slow or unclear, people find a way around the control. If the answer is always yes, the control is for show. An exception process sits between the two.
The exception record
| Field | Notes |
|---|---|
| Extension and ID | The exact 32 character ID, not just the name |
| Requester and team | A real person |
| Business reason | One or two sentences |
| Scope | Which group or users, never everyone |
| Permissions reviewed | Date and reviewer |
| Expiry date | Typically a few months out |
| Compensating control | For example, restricted to a non-production profile |
| Approver | Someone other than the requester |
Steps
- Request. The employee submits the form, linked from your blocked install message.
- Triage. The reviewer applies the approve, restrict or reject guide.
- Decide. Approve for a named scope, restrict permissions, or reject with a reason.
- Implement. Add an allow entry scoped to the group. Keep the change in your policy repository.
- Set the expiry. Put the date in a calendar, not in someone's memory.
- Review. Before expiry, ask whether the need still exists. Renew only with a fresh look at permissions and publisher.
- Remove. On expiry, remove the entry unless it is renewed.
Service levels
Decide how fast you will answer and measure it. For example, aim to answer routine requests within two working days. Slow answers are the main driver of shadow IT, as people reach for personal profiles and unmanaged devices.
Metrics worth tracking
- Number of open exceptions
- Number past expiry
- Median time to decision
- Share of requests approved, restricted and rejected
- Extensions requested by many people, a sign of a gap in your standard list
Good practice and pitfalls
- Scope narrowly. An exception for one team is not an exception for the company.
- Do not renew automatically. A renewal is a new decision.
- Keep the paper trail. An auditor asking how you control extensions wants to see requests, decisions and expiries. Confirm requirements with your own auditor. We make no claim that this satisfies any specific framework.
- Watch for patterns. Ten exceptions for the same extension means it belongs on the standard approved list, after a proper review.
Try it yourself
Click through it at your own pace, or open it full screen.
See how one piece of evidence can map to several control requirements. An exception log works the same way.
Quick check
How long should an exception last?
Short enough that you will actually review it, commonly a few months. Pick a period you can keep.
Who approves an exception?
Someone other than the requester, usually security with the extension's business owner.
Last reviewed: 19 October 2026.
