Understanding the Difference Between Inclusions and Exclusions
Inclusions name the identities a policy applies to. Exclusions name the identities it does not apply to.
Both controls define the scope of a policy, but from opposite directions.
Table 1. Inclusions compared with exclusions
| Inclusions | Exclusions | |
|---|---|---|
| What the list names | The identities the policy applies to. | The identities the policy does not apply to. |
| Who is in scope | Only the identities you list. | Everyone except the identities you list. |
| Effect of adding an identity | Brings that identity into scope. | Takes that identity out of scope. |
| Best suited to | A policy that should cover a known, limited set of identities. | A broad policy that should cover everyone apart from a few exceptions. |
Steps
-
Determine whether the policy should cover a limited set of identities or nearly everyone.
-
Select the control that matches.
-
Add the identities to the list.
Result
The policy scope names the identities you intend, in the direction you intend.