SecurityInsight settings · Settings > Sign-in & Azure resources
Jobs sign in with a client secret
| Key | SI_Bootstrap_UseClientSecret |
|---|---|
| Where | Settings > Sign-in & Azure resources |
| Type | On / off |
| Default | Off: the jobs sign in as a managed identity, unless the configuration already carries a client secret. |
| Edition | Community |
| Confirmation | SecurityInsight asks you to confirm before it is switched on. |
What it does
Makes all container jobs sign in as the app registration (service principal) with its client secret instead of a managed identity.
When enabled
On, every job carries the client secret as a job secret. Queue scaling is not available with it. A supported choice, never the default.
When disabled
the jobs sign in as a managed identity, unless the configuration already carries a client secret.
Risk and how to reverse it
Every job carries the client secret: a secret to store, rotate and protect, and queue scaling is not available. A supported choice, but weaker than a managed identity. Reversible: run setup with the managed identity.
Requires
Kept in the install's Key Vault.
Recommended
Off (the managed identity).
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack