SecurityInsight settings · Settings > Collection scope & limits

Disabled accounts and devices: Risk Analysis

Key	SI_DisabledAssets_RiskAnalysis
Where	Settings > Collection scope & limits > Disabled accounts and devices
Type	On / off
Default	Off: the reports leave disabled assets out, except the reports where the disabled state is the finding
Edition	Community

What it does

Whether the Risk Analysis reports include disabled users, service principals, managed identities and computers.

When enabled

On lets every report see disabled assets. Two reports always see them, whatever this says, because the disabled state is the finding there: a disabled guest still holding a privileged role, and a disabled service principal still owning a publicly reachable resource. Reports that ask about usable accounts (for example accounts without MFA) keep their own enabled filter. Has no effect while collection of disabled assets is off.

When disabled

the reports leave disabled assets out, except the reports where the disabled state is the finding

Risk and how to reverse it

On adds findings for disabled accounts and devices to the reports: more rows to read. Off is the default; the two reports where the disabled state is the finding always include them. Reversible at once.

Requires

Works only while "Disabled accounts and devices: collect them" is on.