SecurityInsight settings · Settings > Collection scope & limits

Exposure Graph: no asset for never-synced, disabled AD accounts

Key	SI_Identity_SkipNeverSyncedDisabledAd
Where	Settings > Collection scope & limits > Exposure Graph identities without an asset
Type	On / off
Default	On: a never-synced on-premises AD account becomes an asset only while it is enabled or privileged
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

A customer's choice for on-premises Active Directory accounts that the Exposure Graph lists but that were never synced to Entra ID (no Entra object id). On, only the enabled or privileged ones become assets: privileged = an admin count, a critical or tier 0/1 AD group (Domain Admins, Enterprise Admins ...), an assigned role, a service account, a sensitive account or a Microsoft criticality level. The others are counted and get no asset.

When enabled

a never-synced on-premises AD account becomes an asset only while it is enabled or privileged

When disabled

Stages: the identity collection records no asset for a never-synced AD account that is disabled and not privileged; the run log and the Data health page show how many per run; the CI build retires the existing CI of such an account at once, with a reason naming this setting (its findings close as asset retired, never as fixed). Disabled = the account says so itself (accountEnabled false, or the disabled flag of userAccountControl); an account that does not say is kept. Accounts synced to Entra ID, groups, devices and findings are not affected. Off again, the next run records them again and their CIs come back.

Risk and how to reverse it

Objects the customer chose not to keep stop being assets from the next run and their CIs retire (CMDB / ServiceNow closures follow the retired CIs). Accounts synced to Entra ID, groups, devices and findings are not affected. Reversible: turn it off and the next run records them again and their CIs come back.

Requires

The identity collection with the Exposure Graph (Defender XDR advanced hunting).