SecurityInsight settings · Settings > Collection scope & limits
Subscriptions skipped for identity roles
| Key | SI_AzureSubscriptionExcludePatterns |
|---|---|
| Where | Settings > Collection scope & limits > Which assets are included |
| Type | List |
| Default | No subscriptions skipped; every visible subscription is scanned. |
| Edition | Community |
What it does
Subscription names (wildcards allowed) skipped when the identity engine scans Azure role assignments.
When set
Role assignments in matching subscriptions are ignored, which speeds up the scan but hides privileges granted there, so identities may get a lower tier than they really hold.
When blank or default
Left blank, the default applies: No subscriptions skipped; every visible subscription is scanned.
Risk and how to reverse it
Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.
Requires
Read by: identity.
Recommended
Keep the default. Change it when: To skip personal, trial or lab subscriptions that do not matter for privilege.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack