SecurityInsight settings · Settings > Collection scope & limits

Exposure Graph: no asset for never-synced AD accounts that are not privileged

Key	SI_Identity_SkipNeverSyncedAd
Where	Settings > Collection scope & limits > Exposure Graph identities without an asset
Type	On / off
Default	Off: never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the privileged ones become assets, whether they are enabled or disabled: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset. It is the wider form of SI_Identity_SkipNeverSyncedDisabledAd: while it is on, that setting decides nothing.

When enabled

Stages: the identity collection records no asset for a never-synced AD account that is not privileged, whatever its enabled state (the Exposure Graph often lists such accounts with their name only); the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Only on-premises AD accounts are affected (a domain SID, or an account name and domain): accounts synced to Entra ID, identities from other sources, groups, devices and findings are not. Off, SI_Identity_SkipNeverSyncedDisabledAd decides these accounts again (only disabled ones are left out), and the next run records the others again and their CIs come back.

When disabled

never-synced on-premises AD accounts are decided by SI_Identity_SkipNeverSyncedDisabledAd (only disabled, non-privileged ones are left out)

Risk and how to reverse it

Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, identities from other sources, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.

Requires

The identity collection with the Exposure Graph (Defender XDR advanced hunting).