SecurityInsight settings · Settings > Collection scope & limits

Exposure Graph: no asset for groups Entra ID no longer has

Key	SI_Identity_SkipDeletedGroups
Where	Settings > Collection scope & limits > Exposure Graph identities without an asset
Type	On / off
Default	On: a group becomes an asset only while Entra ID still has it
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

A customer's choice for groups the Exposure Graph still lists although Entra ID no longer has them (neither active nor in its deleted items). On, only groups that still exist in Entra ID (active or recently deleted) become assets. The others are counted and get no asset.

When enabled

a group becomes an asset only while Entra ID still has it

When disabled

Stages: the identity collection reads the ids of Entra ID's groups and deleted groups once per run and records no asset for an Exposure Graph group with an Entra object id that Entra ID does not return; the run log and the Data health page show how many per run; the CI build retires the existing CI of such a group at once, with a reason naming this setting. A run whose Entra ID group read is not complete decides nothing: groups keep their last state. On-premises groups that were never synced, users, devices and findings are not affected. Off again, the next run records them again and their CIs come back.

Risk and how to reverse it

Groups the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). A run whose Entra ID group read is not complete changes nothing. Reversible: turn it off and the next run records them again and their CIs come back.

Requires

The identity collection with the Exposure Graph, and read access to Entra ID groups (Group.Read.All or Directory.Read.All, which the engine identity already has).