Resource Visibility Is Now Closed by Default ​

July 11, 2026 · InfraScout Team

Resource visibility decides who sees what in InfraScout. You scope an agent, agent group, tool group, playbook, or AI provider connection to one or more Entra groups, and only members of those groups can see it — while admins always see everything. As of this release, the default changes: a resource with no visibility groups assigned is visible to admins only, not to every authenticated user in your tenant.

This is the safer default. A newly registered agent is no longer exposed to the whole tenant before anyone has decided who should see it. It also means the first thing you should do after this release is open up the resources your users legitimately need.

Action required for tenant admins

After this release, non-admin users see nothing until an admin opens things up. Until you scope your resources, users will find an empty agent list, no playbooks, and no AI provider to pick. Work through the checklist below — it takes a few minutes per tenant.

Closed by default ​

Previously, leaving a resource unscoped meant "everyone can see it." Assigning groups was how you narrowed access, so the safe state was the one you had to remember to configure. That is backwards for anything that appears in your tenant automatically — most obviously an agent, which registers itself the moment it connects and, under the old default, became visible to every user in the tenant on arrival.

Now the unscoped state is the restrictive one. A resource with no groups assigned is visible to admins and nobody else, so every widening of access is a deliberate act. Nothing about how scoping itself works has changed: assign one or more Entra groups to a resource and members of those groups can see it, exactly as before. What changed is what happens when you assign nothing.

Say "Everyone" when you mean everyone ​

Plenty of resources genuinely should be visible tenant-wide — the standard playbooks, the default AI provider connection, the tool groups everyone works with. You can still do that; you just have to say so. Mark a resource Everyone and it becomes visible to every authenticated user in the tenant.

Everyone behaves like any other principal in the visibility model, which means it inherits the same way. Mark an agent group Everyone and its member agents become tenant-visible through that group, without touching each agent individually.

Block inheritance on sensitive hosts ​

An agent normally inherits visibility from the groups it belongs to, and that additive behavior is what makes group-level scoping worth doing. It also creates an awkward case: a sensitive host that happens to sit in an otherwise broadly visible group. A pentest VM in Windows Servers, a jump box in All Hosts — inheritance would hand it to everyone who can see the parent.

A per-agent block inheritance switch solves this. Turn it on and the agent stops inheriting from its groups entirely, staying hidden even when a parent group is marked Everyone. The agent then shows only to admins, or to the narrow visibility group you give it directly. It is the tool for the handful of hosts where the group's answer is the wrong answer.

Three states, readable at a glance ​

Because the default now carries real meaning, the visibility shield on each resource tells you which of three states it is in without opening anything. A globe means the resource is marked Everyone and visible tenant-wide. A shield means it is scoped to specific groups. A lock means it is admin-only — the new default, and your cue that nobody else can see it yet.

Scanning a list for locks is the fastest way to find what still needs attention after this release.

What to do after this release ​

Each tenant admin should walk their tenant once. In practice this is four passes:

  • Mark the default AI provider connection Everyone, or scope it to groups, so users can pick a connection to chat with.
  • Mark or scope the standard tool groups and playbooks your users work with day to day.
  • Scope the agent groups — member agents inherit automatically, so this is the pass that covers your fleet with the least effort.
  • Set block inheritance on sensitive hosts, and optionally give each one a narrow visibility group of its own.

Start with agent groups. Because visibility flows down to member agents, scoping a handful of groups usually covers most of your fleet, leaving only the exceptions to handle individually.

The Groups admin page is where you confirm which Entra groups InfraScout has synced and who belongs to them, and where you can force a recompute of inherited visibility if you want your changes to reach member agents immediately rather than on the next scheduled pass.

Learn more ​

Visibility is covered end to end in Core Concepts, with the group-level model described on Agent Groups and the administration surface on the Groups page.

Questions or feedback? Reach us at info@infrascout.cloud.