SecurityInsight settings · Settings > Collection scope & limits

Disabled accounts and devices: CI correlation

Key	SI_DisabledAssets_Correlate
Where	Settings > Collection scope & limits > Disabled accounts and devices
Type	On / off
Default	On: disabled assets are correlated into CIs
Edition	Community

What it does

Whether disabled users, service principals, managed identities and computers take part in the correlation that builds configuration items (CIs).

When enabled

disabled assets are correlated into CIs

When disabled

Off keeps disabled assets out of the CI build: no CI is built or changed from them, and the findings of an existing CI are kept as they are (never resolved or closed) until the account is enabled again. Has no effect while collection of disabled assets is off -- they are not collected then. Each run logs how many were left out.

Risk and how to reverse it

Disabled assets are not built into CIs from the next run; findings of existing CIs are kept (never closed). Reversible: the next run correlates them again.

Requires

Works only while "Disabled accounts and devices: collect them" is on.