By default, Secure Configuration Manager allows you to apply exceptions to security check results or endpoints immediately. However, your console administrator can require that exceptions receive approval before being applied to security check results, an endpoint, or a group of endpoints. This option gives you the flexibility to add an exception approval level to your change management workflow.
If you enable the approval process, the exceptions created and applied in the Web console must be approved in the Windows console before they can go into effect. For more information, see “Enabling Exception Approvals” in the User’s Guide to Secure Configuration Manager.