SecurityInsight settings · Settings > Collection scope & limits

Azure exposure graph type list

Key	SI_AzureEgTypeAllowlist
Where	Settings > Collection scope & limits
Type	List
Default	Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.
Edition	Community

What it does

Fixes which Azure resource types are read from the Defender exposure graph, the Azure engine's main source.

When set

Replaces the automatically discovered type list entirely, so only the types you list are collected from the exposure graph. New Azure types are no longer picked up automatically, and the built-in exclusion of non-asset types no longer applies.

When blank or default

Left blank, the default applies: Every Azure type in the exposure graph, minus role/policy assignments, locks and diagnostic settings.

Risk and how to reverse it

Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.

Requires

Nothing else.