Azure - Defender for Cloud

Introduction

The Microsoft Defender for Cloud integration with SAFE enables organizations to bring cloud assets and security recommendations from Microsoft Defender for Cloud into SAFE for centralized cloud exposure visibility and risk quantification.

This integration support multiple cloud types:

• Microsoft Azure
• Amazon Web Services (AWS)

If your AWS environment is connected to and monitored by Microsoft Defender for Cloud, SAFE can ingest supported AWS assets and their associated security recommendations through the same Microsoft Defender for Cloud integration.

During configuration, you can select the cloud environments you want SAFE to ingest:

• Azure only
• AWS only
• Azure and AWS

Important: Azure remains the default cloud type. To ingest AWS data, you must explicitly select AWS in the Cloud Type field.

SAFE uses Microsoft APIs to retrieve the cloud resources and recommendations available through Microsoft Defender for Cloud.

After synchronization, both Azure and AWS assets are onboarded into the Cloud attack surface in SAFE and can be distinguished using their Cloud Type tag.

Prerequisites

Before configuring the integration, make sure the following prerequisites are met. Ensure that:

• Microsoft Defender for Cloud is enabled and returning security recommendations for the cloud environments you want to ingest.
• You have the required Azure permissions to create and configure the credentials used by SAFE.

If generating credentials using the SAFE-provided PowerShell script

You need:

• Access to Azure Cloud Shell
• Permission to execute the provided PowerShell script

If creating the application manually

You need sufficient privileges to:

• Create an application in Microsoft Entra ID
• Create a Service Principal
• Assign the required Reader access to subscriptions

AWS

To ingest AWS resources through this integration:

• Your AWS environment must be connected to and monitored through Microsoft Defender for Cloud.
• The AWS resources and associated recommendations must be available to Microsoft Defender for Cloud.
• AWS must be selected as a Cloud Type when configuring the integration in SAFE.

SAFE retrieves AWS information through Microsoft Defender for Cloud. This integration does not require configuring a separate SAFE AWS connector solely for retrieving AWS resources available through Defender for Cloud.

Configure Microsoft Defender for Cloud in SAFE

Configuring the integration consists of two main steps:

1. Generate the Microsoft Azure connector credentials:
   • Tenant ID
   • Client ID
   • Client Secret
2. Configure the integration in SAFE, select the required cloud types, and initiate synchronization.

Step 1: Generate Connector Credentials

SAFE requires a Microsoft Entra ID application and Service Principal to authenticate with Microsoft APIs.

You can generate the required credentials using the SAFE-provided PowerShell script or create them manually.

Generate Credentials Using the PowerShell Script

1. Navigate to Integrations.
2. Click the + button and seach for the Defender for Cloud integration card.
3. Click the Card to configure it.
4. Sign in to the Azure Portal.
5. Open the Cloud Shell PowerShell terminal.
6. Run the attached script to generate Tenant ID, Client ID, and Client Secret.

Option A — Grant Reader access to selected subscriptions

Run:

PS /home/user1> ./azureSafeOnboardingScript.ps1 "MySubscription1" "MySubscription2"

This provides Reader access only to the subscriptions specified in the command.

Option B — Grant Reader access to all available subscriptions

Run:

PS /home/user1> ./azureSafeOnboardingScript.ps1

The script creates a Service Principal named:

SAFE-Azure-App

The Service Principal is assigned Reader access to the applicable subscriptions.

1. After the script completes, copy and securely save the following values:

• Tenant ID
• Client ID
• Client Secret

You will need these credentials when configuring the integration in SAFE.

Alternative: Create Credentials Manually

You can also generate the Tenant ID, Client ID, and Client Secret manually instead of using the PowerShell script.

If you create the credentials manually, proceed to the next section after obtaining the required credentials.

Step 2: Configure the Integration and Select Cloud Types

Once you have the required credentials:

1. Open the Azure - Defender for Cloud integration configuration.
2. Enter Integartion name.
3. Enter:
   • Tenant ID
   • Client ID
   • Client Secret
4. Configure the Auto-Sync Frequency.

This determines how frequently SAFE synchronizes with Microsoft Defender for Cloud to retrieve the latest available information.

A sync frequency of 1 day is recommended to maintain an up-to-date view of your cloud risk posture.

Select Cloud Types

In the Cloud Type field, select the cloud environments you want SAFE to ingest.

Available options are:

Default Behavior

Azure is the default cloud type.

If you leave the Cloud Type field blank, SAFE continues to ingest Azure data, maintaining backward compatibility with existing configurations.

AWS data is ingested only when AWS is explicitly selected.

For existing customers: If your integration was configured before AWS support was introduced, no configuration change is required to continue ingesting Azure data. To start ingesting AWS data, edit the existing configuration and select AWS in the Cloud Type field.

Step 3: Test and Save the Connection

After entering your credentials and selecting the required cloud types:

1. Click Test Connection.
2. Wait for SAFE to validate the connection.
3. After successful validation, click Save.

The Microsoft Defender for Cloud integration is now configured.

Step 4: Synchronize Data

After saving the configuration, SAFE synchronizes data based on the configured Auto-Sync Frequency.

To initiate synchronization immediately:

1. Open the integration configuration.
2. Click Sync Now.

This starts an on-demand synchronization outside the regular auto-sync schedule.

SAFE retrieves data for the cloud types selected in your integration configuration.

FAQs

1. Does the Microsoft Defender for Cloud integration now support AWS?

Yes.

SAFE has enhanced the integration to support AWS in addition to the existing Azure support.

AWS resources must be available through Microsoft Defender for Cloud, and AWS must be explicitly selected as a Cloud Type in the SAFE integration configuration.

2. Do existing Azure customers need to update their configuration?

No.

Existing configurations continue to ingest Azure data without requiring any changes.

Azure remains the default cloud type.

If you want to start ingesting AWS data, edit the existing integration configuration and select AWS under Cloud Type.

3. Can I ingest both Azure and AWS from the same integration?

Yes.

Select both Azure and AWS in the Cloud Type field.

SAFE will retrieve the supported resources and recommendations available through Microsoft Defender for Cloud for both selected cloud environments.

4. What happens if I don't select a Cloud Type?

SAFE defaults to Azure.

This behavior maintains compatibility with integrations configured before AWS support was introduced.

AWS data is retrieved only when AWS is explicitly selected.

5. Does SAFE connect directly to AWS through this integration?

No.

For this integration, SAFE consumes the AWS information made available through Microsoft Defender for Cloud.

Therefore, the AWS environment must first be connected to and monitored by Microsoft Defender for Cloud.

6. Where are Azure and AWS assets onboarded?

Both Azure and AWS resources are onboarded under the:

Cloud attack surface

The assets can be differentiated using their Cloud Type tag:

• Azure
• AWS

7. How does SAFE prevent duplicate AWS assets?

SAFE uses the AWS resource's ARN for asset matching.

This is the same identity used by SAFE's native AWS connector. Therefore, if the same AWS resource is discovered through both Microsoft Defender for Cloud and the native AWS integration, SAFE can resolve the resource to the same asset instead of creating duplicate assets.

8. How can I manually synchronize the latest data?

Open the Microsoft Defender for Cloud integration configuration and click Sync Now.

This triggers an on-demand synchronization independently of the configured Auto-Sync Frequency.

9. What are the possible synchronization stages?

The integration may also display synchronization progress information to help you monitor the current sync.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.