Setting up the Azure connector: subscriptions, RBAC and Defender for Cloud

Beyond identity, your Azure resources carry real risk: over-permissive RBAC, exposed network resources, disabled Defender plans. The Azure connector extends EntraGUARD's audit to your cloud subscriptions, using the same read-only, certificate-based approach as Entra ID.

What the Azure connector covers

The Azure connector evaluates the security posture of your subscriptions: RBAC role assignments (especially Owner and Contributor at broad scopes), network exposure, storage account access, key vault configuration, and Microsoft Defender for Cloud coverage. It reads resource configuration only — it never modifies a resource.

Authentication

The Azure connector reuses the app-only, certificate-based model. If you already provisioned the Entra ID connector, you are most of the way there — the same application identity can be granted a read role over your Azure subscriptions.

Step by step

1. Ensure the audit application (from Entra ID provisioning) exists in your tenant.
2. In the Azure portal, go to the subscription (or management group) → Access control (IAM).
3. Add a role assignment: role Reader, assigned to the audit application.
4. In EntraGUARD, open the Azure connector card and enter the subscription ID(s) to audit.
5. Save and run Test to confirm the connector can enumerate resources.

Management group vs subscription scope

If you assign Reader at a management group, the audit application inherits read access to every subscription beneath it — convenient when you have many subscriptions. If you prefer tight scoping, assign Reader per subscription instead. Both work; choose based on how centralised your governance is.

What good Azure findings look like

• Broad Owner/Contributor assignments — standing privileged access at subscription scope;
• Publicly exposed resources — storage accounts or databases reachable from the internet;
• Defender for Cloud gaps — plans disabled on subscriptions that hold sensitive workloads;
• Key vault access — over-permissive access policies or missing purge protection.

Validating and troubleshooting

• No subscriptions returned — the Reader assignment has not propagated yet (allow a few minutes) or was made at the wrong scope.
• Authorization failed — confirm the role is assigned to the correct application identity.
• Partial results — check the assignment scope covers the resource groups you care about.

Bringing it together

With Entra ID, Active Directory and Azure connectors configured, EntraGUARD produces a single prioritised view across identity and cloud — the three pillars where most Microsoft-centric risk actually lives.