> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Excluding Devices from Vulnerability Management
> Exclude specific devices from vulnerability reporting and notifications in Iru Endpoint. Manage exclusions from a device record or from a CVE Devices tab.
This guide applies to Mac computers and Windows devices
### About Excluding Devices
Some devices in your fleet may not need to be included in vulnerability reporting, such as dedicated test devices, devices assigned to employees on extended leave, or devices undergoing decommissioning. Excluded devices no longer contribute to affected-device counts, detection counts, the CVE **Devices** view, or vulnerability notifications.
Please see our [Vulnerability Management Overview](/en/endpoint/vulnerability-management/vulnerability-management-overview) article for more information about vulnerabilities.
### How It Works
Device exclusion lets you remove specific devices from fleet-wide vulnerability counts, views, and notifications. When you exclude a device, it no longer appears in CVE affected device totals or the **Devices** tab across Vulnerability Management, and vulnerability notifications for that device are suppressed.
Detections remain visible on the device record, so you keep full visibility at the device level without those results affecting top-line reporting. If a [Vulnerability Response Library Item](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item) is scoped to an excluded device, automated patching continues according to the configured remediation rules.
You can exclude a device from its device record or from the **Devices** tab in any CVE detail view. You can remove an exclusion at any time to resume monitoring. If a device is deleted from Iru Endpoint, its exclusion is removed automatically.
### Excluding a Device
You can exclude a device from the device record in Iru Endpoint or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app and select the device you want to exclude.
Click the **Device Action Menu** at the top right of the device record.
Click **Exclude device**.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the device until you remove the exclusion
* **Ignore until a specific date** to exclude the device until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion.
Click **Save**.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE that includes the device you want to exclude.
Select the **Devices** tab if it is not already selected.
Click **Exclude device** (shield icon) for the device you want to exclude.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the device until you remove the exclusion
* **Ignore until a specific date** to exclude the device until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion.
Click **Save**.
### Modifying or Removing a Device Exclusion
You can modify or remove an exclusion from the device record or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app and select the excluded device.
In the banner near the top of the device record, click **Modify** or **Remove exclusion**.
If you clicked **Modify**, update the **Enforcement timeframe**, **Ticket**, or **Comment** as needed, then click **Save**. The dialog matches the one used when you first exclude a device.
If you clicked **Remove exclusion**, confirm in the dialog by clicking **Remove exclusion** again.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE for the excluded device you want to manage.
Select the **Devices** tab if it is not already selected.
Click the **Filters** button at the top right of the device list.
Toggle **Show excluded devices**. Excluded devices appear in the list with an **Excluded** badge.
For an excluded device, use **Modify exclusion** (pencil icon) or **Remove exclusion** (shield-off icon).
If you are modifying the exclusion, click **Modify exclusion**, update the **Enforcement timeframe**, **Ticket**, or **Comment** as needed, then click **Save**.
If you are removing the exclusion, click **Remove exclusion** (shield-off icon).
In the confirmation dialog, click **Remove exclusion** again.
After you remove an exclusion, the device is included again in vulnerability scanning at the next scan cycle.
### Considerations
Excluding a device removes it from all CVE affected device counts across every vulnerability in Vulnerability Management. Exclusion is not scoped to a single CVE. Vulnerability detections remain visible on the device record. Exclusion affects top-level Vulnerability Management counts, views, and notifications only. To suppress a specific CVE without excluding the device entirely, use [Accepting CVE Risks](/en/endpoint/vulnerability-management/accepting-cve-risks) instead.
If a [Vulnerability Response Library Item](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item) is scoped to an excluded device, it continues to patch the device according to the configured remediation rules. Exclusion does not prevent automated remediation.
If a device is deleted from Iru Endpoint, its exclusion is removed automatically. If the same device re-enrolls, it is monitored by default. Re-apply the exclusion manually if needed.
An excluded device does not count toward the affected-device total for any CVE. Excluding a device does not change the **Remediated** status of a CVE by itself. Remediation status is based on active (non-excluded) devices only. If excluding a device means all remaining affected devices for a CVE are remediated, the CVE status updates to **Remediated**.
Excluded devices are not hidden from the **Devices** section of Iru Endpoint. They are hidden from Vulnerability Management views and counts only. Exclusions are auditable. Each exclusion records who applied it, when, and any comment provided.
Vulnerability notifications for excluded devices are suppressed while the exclusion is active. Removing an exclusion resumes notifications at the next scan cycle.
### Related Articles
Detect CVEs across your fleet, prioritize by severity, and track remediation progress
Accept CVE risks when patching is not feasible, set expiration dates, and track exceptions
Automate remediation for vulnerable Auto Apps on macOS based on CVE severity