SecurityInsight settings · Settings > Connectors & CMDB
Asset tagging writes tags
| Key | SI_Pro_AssetTagging_Apply |
|---|---|
| Where | Settings > Connectors & CMDB > Asset tagging |
| Type | On / off |
| Default | Off: report only, every planned tag is logged, nothing is changed |
| Edition | pro |
| Confirmation | SecurityInsight asks you to confirm before it is switched on. |
What it does
Lets the asset-tagging job actually write the tags its rules select in Defender, Azure and Entra, instead of only reporting them.
When enabled
On, the job changes Defender machine tags, Azure resource tags and Entra custom security attributes in your tenant. Only a real true turns it on; the job identity also needs the write roles.
When disabled
report only, every planned tag is logged, nothing is changed
Risk and how to reverse it
Writes to your tenant: the job changes Defender machine tags, Azure resource tags and Entra custom security attributes. A wrong rule tags or untags many objects at once. Reversible only by changing the rules and running again (or by hand); every change is on the audit trail.
Requires
The asset tagging identity's write rights (granted by setup only when asked). A SecurityInsight Pro licence.
Recommended
Off until the report-only plan has been reviewed on the Asset tagging page; then on.
Documented for SecurityInsight 3.0.79. Written by the SecurityInsight team; Invardia publishes it. · All settings · Security review pack