SecurityInsight settings · Settings > Connectors & CMDB

Asset tagging on a server writes tags

Key	SI_AssetTagging_Apply
Where	Settings > Connectors & CMDB > Asset tagging
Type	On / off
Default	Off: report only, every planned tag is logged, nothing is changed
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Lets the asset-tagging script on a server (launcher.community-vm.ps1) write the tags its rules select in Defender, Azure and Entra on every run, instead of only reporting them.

When enabled

On, every run changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant; -WhatIfMode on a run still makes that run report only. The identity also needs the write grants. For one run only, use -Apply instead.

When disabled

report only, every planned tag is logged, nothing is changed

Risk and how to reverse it

Writes to your tenant: every run changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); the audit trail records every change.

Requires

Read by: asset-tagging.