SecurityInsight settings · Settings > Collection scope & limits

Only Defender-active endpoints

Key	SI_RequireMdeActive_Endpoint
Where	Settings > Collection scope & limits > Which assets are included
Type	On / off
Default	Off: a device seen recently by Defender, Exposure Management or Entra is kept
Edition	Community
Confirmation	SecurityInsight asks you to confirm before it is switched on.

What it does

Narrows the endpoint inventory to devices that Defender for Endpoint reports as active or recently seen.

When enabled

On drops devices known only to Exposure Management or Entra, such as some Azure VMs, personal and IoT devices: fewer rows, but less coverage. Ignored when SI_IncludeInactive_Endpoint is on.

When disabled

a device seen recently by Defender, Exposure Management or Entra is kept

Risk and how to reverse it

Drops every device known only to Exposure Management or Entra (some Azure VMs, personal and IoT devices): those devices disappear from profiles and reports, and their exposure with them. Reversible: the next run includes them again.

Requires

Nothing else.