How to Mark Dev/Test Resources as Out of Scope for SOC 2 Audits Without Risking Compliance Issues

Curious how others have handled marking dev/test resources as out of scope. We're going through our first SOC 2 audit at Helmet Security. Vanta is detecting several development instances we use for integration testing and applying the same controls as our production environments. The setup: one Azure account containing a test VM and a test Sentinel instance (Azure's equivalent of Splunk). No real workloads, no customer data: purely a test environment. Is there a clean way to scope these out so they're not held to the same standards, without raising an auditor's eyebrow?