SecurityInsight settings · Settings > Advanced / diagnostics

Dry run

Key	WhatIfMode
Where	Settings > Advanced / diagnostics
Type	On / off
Default	Off: a normal run.
Edition	Community

What it does

Requests a run that shows what would change without changing anything.

When enabled

In the configuration it is read only by asset tagging, which then only reports the tags it would apply or remove. Every other engine ignores it in the configuration (scheduled runs always publish, and each run says the value was ignored): a dry run of profiling, Risk Analysis or the tier classifier is asked for per run -- start the launcher with -WhatIfMode, or set SI_WHATIF=1 on one container job execution. Such a run says so at its start and its end. Profiling and Risk Analysis then write their results to local files only -- nothing goes to Log Analytics, the mail, the export location or the caches; the run-health record says dry run. The tier classifier writes its result beside the catalog, never over it.

When disabled

a normal run.

Risk and how to reverse it

A tuning or diagnostic setting: it mostly changes run time, cost or log detail. Leave it at the default unless support asks. Reversible at once.

Requires

Read by: azure, endpoint, identity, publicip, risk-analysis.