SecurityInsight settings · Settings > Collection scope & limits
Azure access identity types
| Key | SI_AzureExposureGraph_IdentityLabels |
|---|---|
| Where | Settings > Collection scope & limits |
| Type | List |
| Default | User, service principal, managed identity and group. |
| Edition | Community |
What it does
Which exposure graph node types are treated as identities when mapping who can access Azure resources.
When set
Changes which kinds of identity are counted as having access to Azure resources. Leaving a type out hides access held by that kind of identity.
When blank or default
Left blank, the default applies: User, service principal, managed identity and group.
Risk and how to reverse it
Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.
Requires
Nothing else.
Recommended
Keep the default. Change it when: Only if your Defender exposure graph uses non-standard node names.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack