Defender for Cloud: Exclusion Not Working for Kubernetes Pods — Recommendations Exemptions Issue

Problem description

I am facing an issue where the exclusion configured for the 'istio-init' pods in my AKS cluster does not seem to be effective. Despite having set an image-exclusion parameter in the policy, Defender for Cloud continues to raise the 'Running containers as root user should be avoided' recommendation for these workloads.

The source of the recommendation however belongs to the Azure CSPM Standard displayed within the environment settings.

Policy based findings are assigned from the initiative ASC Defult. The exclude image parameter of this initiative is set, but seems to be uneffective in case of the mentioned recomenndation.

Environment

The affected environment involves an AKS cluster being assessed by Microsoft Defender for Cloud for Kubernetes and container security recommendations.

What I've already tried

I have verified that the exclusion parameter is set correctly in the policy assignment and confirmed that it has been in place for some time. I also checked the recommendation instance's last visible change date, which was 2026-10-08. However, the recommendation still persists for the given pods.

Current status

I am seeking guidance on whether the current exclusion settings should suppress the recommendation for these workloads. Specifically, I want to know if the exclusion is correctly wired to prevent the finding, or if there is a mismatch in how Defender for Cloud evaluates the exclusion versus the recommendation. Any steps to troubleshoot or confirm the effective policy application would be appreciated.

From our perspective it would make sense to use the same mechanism for our workloads, we apply for the ASC Default initiative to fulfil our requirements.