SecurityInsight settings · Settings > Collection scope & limits

Disabled accounts and devices: collect them

Key	SI_DisabledAssets_Collect
Where	Settings > Collection scope & limits > Disabled accounts and devices
Type	On / off
Default	On: disabled accounts and devices are collected
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched off.

What it does

Whether disabled users, service principals and managed identities, and disabled computers are collected from the sources. Disabled means the account is disabled in its own directory (Entra accountEnabled false, AD account disabled); it is never guessed from inactivity.

When enabled

disabled accounts and devices are collected

When disabled

Off leaves them out of the profiles, so no later stage can see them -- the correlation, Risk Analysis, finding actions and connector settings below then have no effect for disabled assets. Their open findings, actions and tickets are kept as they are (never resolved or closed). The state is read on every run: an account that is enabled again is collected again on the next run. Each run logs how many were left out.

Risk and how to reverse it

Disabled accounts and devices disappear from profiles, CIs, reports and connectors from the next run; their open findings and tickets are kept (never closed). Reversible: the next run collects them again.

Requires

Nothing else.