SecurityInsight settings · Settings > Connectors & CMDB
Grant asset tagging write rights
| Key | SI_Bootstrap_GrantTaggingRoles |
|---|---|
| Where | Settings > Connectors & CMDB > Asset tagging |
| Type | On / off |
| Default | Off: rights are only listed, and the job can only report. |
| Edition | Community |
| Confirmation | SecurityInsight asks you to confirm before it is switched on. |
What it does
Lets container setup give the asset tagging job's own identity the rights it needs, including writing tags.
When enabled
When on, setup grants the tagging identity its read rights plus write rights for Defender machine tags, Azure resource tags and Entra security attributes. Tags are written only when asset tagging is also set to apply.
When disabled
rights are only listed, and the job can only report.
Risk and how to reverse it
Gives the asset tagging identity WRITE rights in your tenant (Defender machine tags, Azure tags, Entra security attributes). Reversible: remove the role assignments; turning the setting off does not remove rights already granted.
Requires
Nothing else.
Recommended
Off unless asset tagging should write; then on for one setup run.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack