SecurityInsight settings · Settings > Collection scope & limits
Azure access relationship types
| Key | SI_AzureExposureGraph_AccessEdgeLabels |
|---|---|
| Where | Settings > Collection scope & limits |
| Type | List |
| Default | The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'. |
| Edition | Community |
What it does
Which exposure graph relationship types count as an identity having access to an Azure resource.
When set
Changes which access paths are counted when the engine works out which privileged identities can reach each Azure resource. A list that misses real relationship names leaves those counts empty.
When blank or default
Left blank, the default applies: The shipped list of 6 relationship types, such as 'has access to' and 'has permissions to'.
Risk and how to reverse it
Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.
Requires
Nothing else.
Recommended
Keep the default. Change it when: Only if your Defender exposure graph uses non-standard relationship names.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack