SecurityInsight settings · Settings > Data & retention

Retire at once: devices deleted in Intune

Key	SI_DeletionProof_Intune
Where	Settings > Data & retention > Assets no longer seen
Type	On / off
Default	Off: a device Intune no longer lists waits the not-seen grace period, as before
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Retires an asset at once when Intune PROVES its managed device was deleted: a successful Delete of the managed device in Intune's audit events. Merely missing from a list is never proof -- it keeps the not-seen grace period.

When enabled

Stages: the CI build checks the Intune records missing from a complete collection against Intune's audit events; a proven one is recorded, its CI retires at once ('retired at once: deleted in Intune') -- the proof wins over the grace period -- and its open vulnerabilities close as 'asset deleted in Intune', never as fixed. A CI another source still sees stays active. A device listed again is active again and its findings reopen. A read that is not complete (for example without the permission) decides nothing for what it did not return.

When disabled

a device Intune no longer lists waits the not-seen grace period, as before

Risk and how to reverse it

Assets of devices deleted in Intune retire from the next CI build and their vulnerabilities close as deleted (ServiceNow closures follow). Reversible: turn it off and the next build decides them by the grace period again.

Requires

Read access to Intune's audit events (DeviceManagementApps.Read.All -- not granted to the engine identity by setup today; without it the read answers 403 and decides nothing).