Microsoft Defender for Cloud

About this document

This document provides step-by-step instructions to configure the Microsoft Defender for Cloud integration in SAFE and pull cloud assets, vulnerabilities and cloud misconfigurations for Azure, AWS and GCP resources assessed by Microsoft Defender for Cloud.

Introduction

Microsoft Defender for Cloud is Microsoft's Cloud Security Posture Management (CSPM) and workload protection platform. It assesses resources in Azure, AWS accounts, and GCP projects connected to it, and reports each failed security recommendation as an assessment.

The SAFE integration with Microsoft Defender for Cloud ingests the resources that Defender for Cloud assesses (name, type, cloud account, resource group, region and tags), the vulnerabilities it finds on them, and the misconfigurations it reports.

What SAFE Pulls from Microsoft Defender for Cloud

Prerequisites

1. An Azure subscription with Microsoft Defender for Cloud enabled. The free foundational CSPM plan is enough for assets and misconfigurations.
2. For vulnerabilities: Paid Defender CSPM plan with agentless scanning enabled. Without it, Defender for Cloud returns no CVE data and SAFE ingests only assets and misconfigurations.
3. For AWS accounts and GCP projects: Each must already be connected to Defender for Cloud (Environment settings > Add environment). SAFE needs no AWS or GCP credentials. It reads them through the Azure subscription that hosts the connection.
4. Permissions in Microsoft Entra ID to register an App, and permissions in Azure to assign the Reader role on every subscription you want to sync.
5. SAFE admin access.
6. Outbound HTTPS connectivity from SAFE to:
   • Microsoft Entra login host (default login.microsoftonline.com)
   • Azure Resource Manager host (default management.azure.com)Azure Government uses different hosts.

Generate connection details

You need three values from Microsoft Entra ID: Tenant ID, Client ID and Client Secret.

Register an application

1. Sign in to the Azure Portal as an administrator.
2. Go to Microsoft Entra ID > App registrations > New registration.
3. Enter a name (for example, SAFE Integration) and select Single tenant.
4. Click Register.
5. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

Create a client secret

1. In the App Registration, go to Certificates & secrets > New client secret.
2. Enter a description and an expiry (recommended: 12 months).
3. Click Add and copy the secret Value immediately. It is not shown again.

Note: Record the expiry date and rotate the secret before it lapses (see the FAQ). Once it expires, syncs fail with authentication errors.

Assign the Reader role

SAFE reads Defender for Cloud data through Azure Resource Graph, which returns only resources the App Registration can read. Assign the Reader role on every subscription you want SAFE to sync.

1. In the Azure Portal, open Subscriptions and select the subscription.
2. Go to Access control (IAM) > Add > Add role assignment.
3. Select the Reader role and click Next.
4. Click + Select members, search for the App Registration name, select it and click Select.
5. Click Review + assign, review, then click Review + assign again.
6. Repeat for each subscription to sync. A subscription without the Reader assignment is not synced.

For AWS accounts and GCP projects, assign the role on the Azure subscription that hosts their Defender for Cloud connection. No role is assigned in AWS or GCP.

Login URLs

The defaults apply to the Azure commercial cloud. For Azure Government, select the Government cloud environment in SAFE and use an App Registration created in the Azure Government portal. Selecting Government automatically switches the Login URL, the Resource Graph host and the token audience.

• Commercial/Public: https://login.microsoftonline.com
• Government (US Gov): https://login.microsoftonline.us

Configure in SAFE

1. Sign in to SAFE as an admin and go to Integrations.
2. Click the + icon at the top right and search for Microsoft Defender for Cloud.
3. Click the Microsoft Defender for Cloud card.
4. Enter a unique Integration Name (mandatory).
5. Enter the Tenant ID, Client ID and Client Secret.
6. Keep the default Login URL. It switches automatically when you select Government.
7. Leave Cloud Environment as Commercial, or change it to Government (US Gov) if your business requires it.
8. Under Cloud Types, select the clouds to ingest. Azure, AWS and GCP are selected by default. Remove any you don’t need.
9. (Optional) Enter Subscription IDs as a comma-separated list of Azure subscription IDs to sync. Leave this field empty to sync every subscription the App Registration can read.
10. Enter the Auto Sync (in Days) interval at which SAFE runs a sync automatically. It must be a positive integer. The default is 7.
11. Click Test Connection.
12. Once the connection is verified, click Save.
13. Click Sync Now to run an on-demand sync.

Configuration notes

• Cloud Types: A cloud that is not selected is not ingested at all. Leave all three selected to sync every cloud.
• Subscription IDs: This is an include list. Only the subscriptions you list are synced. To include AWS accounts or GCP projects, add the Azure subscription ID that hosts their Defender for Cloud connection.
• AWS and GCP scoping: There is no per-account or per-project setting. To leave one out, remove its hosting Azure subscription from Subscription IDs. This also removes that subscription’s Azure resources and every other AWS account or GCP project connected through it.
• Asset last-seen filter: This connector has no asset last-seen filter. An asset stays in scope for as long as Defender for Cloud assesses it.

View Result

To view the assets and the findings:

1. From the SAFE Integrations page, click on the Microsoft Defender for Cloud card.

2. A page with "Finding View" and "Asset View" tabs will open up.

3. Asset View will list all the cloud resources pulled or updated from Defender for Cloud, for Azure, AWS and GCP.

4. Open an asset to see its cloud account, resource group, region, tags and the integration on the Sources tab.

5. Finding View will list the vulnerabilities, misconfigurations, security control findings and compliance findings described.

API Details

The Microsoft Defender for Cloud connector uses the Azure Resource Graph API. Authentication is OAuth2 client_credentials against Microsoft Entra ID; all data calls send the resulting token as Authorization: Bearer <access_token>.

FAQs

Q: How frequently does SAFE sync data from Defender for Cloud?
A: Sync frequency depends on the Auto Sync configuration. Default is every 7 days. You can also trigger an on-demand sync at any time using Sync Now.

Q: Does the integration support incremental / delta sync?
A: No. Every run is a full sync. Azure Resource Graph has no change feed, so each run reads the whole scope.

Q: Test Connection fails.
|A: Check the Tenant ID, Client ID and Client Secret, that the client secret has not expired, and that the App Registration has the Reader role on at least one subscription that has Defender for Cloud assessments.

Q: Test Connection passes, but no assets were synced.
A: Check that the App Registration has the Reader role on the subscriptions to sync, that Subscription IDs lists them (or is empty), that the cloud is selected under Cloud Types, and that the resources have at least one Defender for Cloud assessment.

Q: Why are there no vulnerabilities?
A: CVE findings need the paid Defender CSPM plan with agentless scanning enabled. With the free foundational CSPM plan, Defender for Cloud returns only assets and misconfigurations.

Q: Do I need AWS or GCP credentials in SAFE?
A: No. Connect the AWS account or GCP project to Defender for Cloud (Environment settings > Add environment). SAFE reads it through the Azure subscription that hosts the connection.

Q: I see AWS or GCP data but did not select that subscription. A: AWS and GCP data comes through the Azure subscription that hosts their Defender for Cloud connection. It appears when that subscription is in scope (listed in Subscription IDs, or Subscription IDs is empty).

Q: How do I exclude a subscription, an AWS account or a GCP project?
A: For an Azure subscription, leave it out of Subscription IDs, or do not assign the Reader role on it. For an AWS account or a GCP project there is no separate setting.

Q: Why does the same recommendation have different severities on different assets?
A: The severity from Defender for Cloud is the source severity. SAFE calculates the final severity for each asset from its context, so it can differ between assets and from the Defender for Cloud portal.

Q: Why do I see findings named after a control or a standard, such as “Implement security best practices” or “CIS Azure Foundations v1.1.0”?
A: SAFE shows the secure score control and each compliance standard behind an asset’s misconfigurations as findings on that asset. They are not extra problems on the resource: they group the misconfigurations that fall under them.

Q: Why is the severity of a control or compliance finding different from a misconfiguration’s severity?
A: SAFE starts from the highest severity among the asset’s misconfigurations in that control or standard, then calculates the final severity from the asset’s context, so it can differ from the Defender for Cloud portal.

Q: Why does every CVE of an assessment show the same description?
A: Microsoft returns the title, description and remediation per recommendation, not per CVE.

Q: Can I use the same App Registration for more than one SAFE integration? A: Yes. The Resource Graph limit is per user, so integrations running at the same time under one App Registration can be throttled. SAFE waits for the time Azure asks for and retries, so the syncs complete.

Q: How do I use Azure Government?
A: Select Government (US Gov) as the Cloud Environment and use an App Registration created in the Azure Government portal. This switches the Login URL, the Resource Graph host and the Scope. Note that Azure Government has not been tested against a live tenant yet, and whether Defender for Cloud multicloud (AWS and GCP) is available there has not been confirmed. If it is not, selecting AWS or GCP under Cloud Types has no effect.

Q: The client secret expired. How do I rotate it?
A: Create a new secret in the App Registration, update it in the SAFE integration, run Test Connection, then delete the old secret. There is no downtime if you do this before the old secret expires.

Q: How are duplicate assets handled?
A: SAFE matches assets across integrations on the cloud resource identifier by default, so a resource that other tools also report appears once with both sources.

Q: How to reduce sync time?
A: Deselect the clouds you do not need under Cloud Types, and list only the subscriptions you need in Subscription IDs.