Microsoft Defender for Cloud Integration via API

Purpose

This guide explains how to register an application in Microsoft Entra ID and use its credentials in Logsign USO to pull Microsoft Defender for Cloud data (security alerts, security assessments, and secure score) via the Azure Resource Manager (ARM) API, for security analytics and forensic purposes.

The integration polls three independent, optionally-enabled streams from the Microsoft.Security resource provider:

• Alerts: security alerts raised by Defender for Cloud (Microsoft.Security/alerts)
• Assessments: secure posture findings, taken as a full snapshot on every collection cycle rather than incrementally (Microsoft.Security/assessments)
• Secure Scores: the subscription's or management group's secure score, also collected as a full snapshot (Microsoft.Security/secureScores)

At least one stream must be enabled for the source to poll anything.

Prerequisites

• Access to the Azure portal (https://portal.azure.com) with permission to register an application in Microsoft Entra ID.
• Permission to assign an Azure RBAC role that grants read access to Microsoft Defender for Cloud data (typically the built-in Security Reader role) at the subscription or management group scope you want to monitor. Confirm the exact role your organization requires with your Azure administrator; this has not been independently verified against Microsoft's current RBAC documentation.
• Either a single Subscription ID or a Management Group name to scope collection to. Exactly one of the two must be provided; providing both or neither is treated as a configuration error and the source will not poll.

Step 1: Create an App Registration in Microsoft Entra ID

1. Log into the Azure portal: https://portal.azure.com
2. In the left sidebar, navigate to Microsoft Entra ID.
3. Click on App registrations, then New registration.
4. Enter a name for the application (e.g. Logsign_DefenderForCloud) and click Register.
5. From the Overview page, note the Application (client) ID and Directory (tenant) ID. You will need both later.

Step 2: Generate a Client Secret

1. In the App Registration, click Certificates & secrets in the left sidebar.
2. Click New client secret, give it a description, choose an expiration period, and click Add.
3. Copy the generated Value immediately and store it securely. It cannot be retrieved again once you leave the page.

Step 3: Grant the Application Read Access to Defender for Cloud Data

1. Navigate to the Subscription (or Management Group) you want Logsign to monitor.
2. Open Access control (IAM) > Add role assignment.
3. Assign the Security Reader role to the application you registered in Step 1.

Note: this grants read-only visibility into the security posture and alerts of the whole scope (subscription or management group). Confirm this matches your organization's least-privilege requirements before proceeding.

Step 4: Collect Required Information

You will need the following values when adding this source in Logsign USO:

• Tenant ID: App Registration > Overview > Directory (tenant) ID
• Client ID: App Registration > Overview > Application (client) ID
• Client Secret: the value generated in Step 2
• Subscription ID or Management Group Name: whichever scope you granted access to in Step 3 (provide exactly one, not both)

Add Device in Logsign USO

1. Log in to your Logsign USO platform.
2. Go to Settings > Data Collection and open the source addition screen (Add Device).
3. Select the API source type and choose Microsoft Defender for Cloud from the provider list.
4. Fill in Tenant ID, Client ID, Client Secret, and either Subscription ID or Management Group Name.
5. Enable at least one of the three data streams: Collect Alerts, Collect Assessments, Collect Secure Scores. Leaving all three disabled means the source will not collect any data.
6. Fill in the remaining default source fields (description, etc.) and click Save.

How Data Is Collected

Severity values from Defender for Cloud (Informational / Low / Medium / High; there is no Critical tier at the source) are mapped onto Logsign's severity scale, with High mapped to Logsign's top tier.

Troubleshooting