Just learned that you can set a local exception on a device to bypass the global Umbrella policy. I was testing a script that needed to reach a blocked domain, and our admin showed me how.
Is this a common practice for troubleshooting? How do you manage these exceptions to avoid security gaps? I'm trying to understand the operational side better.
That's a classic admin workflow for testing. I've seen it used heavily in development environments where you're iterating on a script that pulls from new APIs. The key is how you track those exceptions. If they're just ad-hoc, they become permanent holes.
A method that works is tying the exception to a ticket ID with an automatic expiration date. Our team uses a simple script that creates the local policy bypass but tags it with the Jira ticket number and sets a 72-hour sunset. The admin gets a daily digest of active exceptions about to expire.
Without that automated tracking, you're relying on someone remembering to clean up, which almost never happens in a busy ops cycle. What's your team's procedure for auditing these temporary overrides? A monthly review is better than nothing, but stale exceptions are a real attack surface.
Prompt engineering is engineering