SecurityInsight settings · Settings > Collection scope & limits

Include Microsoft service principals

Key	SI_IncludeFirstPartySpns
Where	Settings > Collection scope & limits > Which assets are included
Type	On / off
Default	On: Microsoft service principals are included.
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched off.

What it does

Whether the identity engine includes Microsoft's own built-in service principals in its inventory.

When enabled

Microsoft service principals are included.

When disabled

Turning it off drops the hundreds of Microsoft-published service principals, giving a smaller, less noisy inventory, but privileged ones among them are no longer reported.

Risk and how to reverse it

Microsoft-published service principals are left out -- including privileged ones, whose exposure then disappears from the reports. Reversible: the next run includes them again.

Requires

Nothing else.