Exceptions are used as access deny lists in Access Control. Exceptions are created automatically when you block the user during a manual or automatic disconnect session.
Blocking user access in versions earlier than Privileged Account Manager 4.0: Till Privileged Account Manager 4.0, any privileged access request processed by Access Control, Command Control, or Emergency Access, was evaluated against Blocked Users group first. If a user was part of Blocked Users group, then all the access was denied.
Blocking user access from Privileged Account Manager 4.1 and later: Exceptions are applicable only to Access Control. They are not considered while evaluating Command Control policies or Emergency Access requests. Any privileged access request processed by Command Control or Emergency Access, is evaluated against Blocked Users group.