SecurityInsight settings · Settings > Data & retention

Retire at once: resources deleted in Azure

Key	SI_DeletionProof_Azure
Where	Settings > Data & retention > Assets no longer seen
Type	On / off
Default	Off: an Azure resource Azure no longer lists waits the not-seen grace period, as before
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Retires an asset at once when Azure PROVES its resource was deleted: a Delete in Azure Resource Graph's resource changes (the last 14 days). Merely missing from a list is never proof -- it keeps the not-seen grace period.

When enabled

Stages: the CI build checks the Azure records missing from a complete collection against the resource changes; a proven one is recorded, its CI retires at once ('retired at once: deleted in Azure') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Azure', never as fixed. A CI another source still sees stays active. A resource listed again is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.

When disabled

an Azure resource Azure no longer lists waits the not-seen grace period, as before

Risk and how to reverse it

Assets of resources deleted in Azure retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.

Requires

Read access to Azure Resource Graph (Reader, which the engine identity already has).