Azure Government
Connect Azure Government to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Azure Government to collect cloud infrastructure evidence automatically.
| Category | Cloud Infrastructure |
| Connect with | API token |
| What a connection produces | Automated evidence collection |
Connect with an API token
-
In Azure Government:
- Sign in to the Azure Government portal at portal.azure.us with your Azure Government credentials (the top-left bar shows Microsoft Azure Government).
- Register an app for Safeguard: Entra ID › App registrations › New registration, name it, choose Accounts in this organizational directory only, and select Register.
- In the app, select Certificates & secrets › Client secrets › New client secret, enter a description and duration, select Add, and copy the value (shown only once).
- On the subscription, open Access control (IAM) › Add › Add role assignment. On the Role tab select a read-only role (for example Reader) and select Next; then on Members choose User, group, or service principal, Select members, find the app, Select and Review + assign.
Where to find the other values:
- Account / Org / Workspace (optional): The app's overview page in App registrations shows the Directory (tenant) ID and Application (client) ID.
Azure Government shows the secret only once, so copy it before you leave the page.
Azure Government's public documentation does not cover every step.
Source: learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.
-
On Compliance › Connectors, open Azure Government, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Azure Government and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | A1.1, A1.2, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3 | 139 |
| ISO/IEC 27001 | Automated tests | A.5.15, A.5.16, A.5.17, A.5.18, A.5.19, A.5.24, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.6, A.8.7, A.8.8, A.8.9, A.8.13, A.8.15, A.8.16, A.8.20, A.8.24 | 139 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1) | 134 |
| PCI DSS | Automated tests | 1.3.1, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 5.2.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.1, 11.5.2 | 127 |
| NIST CSF 2.0 | Automated tests | DE.CM-01, DE.CM-03, DE.CM-09, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02 | 139 |
| CIS Microsoft Azure Foundations Benchmark | Automated tests | 2.1.2, 2.1.9, 2.1.10, 2.1.12, 2.1.13, 2.1.17, 2.1.18, 2.1.19, 2.1.20, 2.1.21, 3.2, 3.3, 3.5, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.16, 4.1.1, 4.1.3, 4.1.4, 4.1.6, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.5.1, 4.5.2, 4.5.3, 5.1.3, 5.1.4, 5.1.5, 5.1.7, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.3.1, 5.5, 6.3, 6.5, 6.6, 7.1, 7.2, 7.3, 7.4, 7.9, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.10 | 72 |
For a CIS benchmark, the numbers are its recommendations.
These tests are switched on per workspace by the Safeguard team.
Microsoft Azure, Microsoft Entra ID connect to the same provider as Azure Government, and these tests run for a connection made through any of them.
Related
- Cloud Infrastructure connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks