SecurityInsight settings · Settings > Data & retention

Retire at once: objects deleted in Entra ID

Key	SI_DeletionProof_Entra
Where	Settings > Data & retention > Assets no longer seen
Type	On / off
Default	Off: a user, device or group Entra ID no longer lists waits the not-seen grace period, as before
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Retires an asset at once when Entra ID PROVES its object was deleted: the user, device or group is in Entra ID's deleted items. Merely missing from a list is never proof -- it keeps the not-seen grace period.

When enabled

Stages: the CI build checks the Entra ID records (and the Exposure Graph users and groups) missing from a complete collection against Entra ID's deleted items; a proven one is recorded, its CI retires at once ('retired at once: deleted in Entra ID') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Entra ID', never as fixed. A CI another source still sees stays active. An object restored in Entra ID is listed again: its CI is active again and its findings reopen. A read that is not complete decides nothing for what it did not return.

When disabled

a user, device or group Entra ID no longer lists waits the not-seen grace period, as before

Risk and how to reverse it

Assets of objects deleted in Entra ID retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.

Requires

Read access to Entra ID's deleted items (Directory.Read.All, which the engine identity already has).