SecurityInsight settings · Settings > Collection scope & limits

Users' sign-in methods in full: which users are read

Key	SI_Identity_SignInMethodsPerUser
Where	Settings > Collection scope & limits > Users' sign-in methods in full
Type	enum
Default	All: every member user is read in the background, privileged users first
Edition	Community

What it does

Which users get their sign-in methods read in full: every method with its details (phone number and type, e-mail address, Microsoft Authenticator app and version, FIDO2 key or passkey model and attestation, Windows Hello key strength, Temporary Access Pass) and, for a Windows Hello or Microsoft Authenticator key, the device it lives on (name, operating system, compliant, managed) linked to that device's CI. It also decides whether a user has a password and signs in passwordless only. This needs one read per user, which Microsoft throttles, so it runs in the background: a slice every 15 minutes in its own job (caj-si-signin-methods), privileged users first, then users whose methods changed, then users never read, then the oldest. Collections never wait for it; each collection shows what was read, with the date it was read. The tenant-wide registration report (MFA registered and capable, passwordless capable, self-service password reset, the registered and preferred methods) is read for every user on every collection, whatever this setting is.

When set

All: every member user. At 150,000 users the first full read takes about 8-9 hours of reading, spread through the day (about 2,000 users per 15-minute slice); after that only users whose methods changed, and each user again after the maximum age. Until a user is read, its per-user facts (each method's details and device, password present, passwordless only) show as unknown, never as no. Privileged: only users with an Entra role (permanent or eligible, also through a group), an Azure role, or marked admin -- a few minutes on any tenant; every other user keeps those facts unknown. Off: no per-user read at all; only the registration report's facts, and the per-user facts are unknown for everyone. Changing it takes effect at the next 15-minute slice and the next collection.

When blank or default

Left blank, the default applies: All: every member user is read in the background, privileged users first

Risk and how to reverse it

All reads every member user's sign-in methods one by one in the background: on a large tenant the first full read takes 8-9 hours of reading spread over the day, and the users not read yet show unknown, never no. Privileged and off leave every other user's per-user facts (each method's details and device, password present, passwordless only) unknown, so reports cannot say who still has a password or which devices hold sign-in keys. No collection waits for it either way. Reversible: change it back; the next slices read again.

Requires

The Microsoft Graph application permission UserAuthenticationMethod.Read.All for the collection identity (the setup grants it), and the install's database.