Safeguard Docs
Compliance ConnectorsSetup by categoryCloud Infrastructure

Microsoft Azure

Connect Microsoft Azure to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect Microsoft Azure to collect cloud infrastructure evidence automatically.

CategoryCloud Infrastructure
Connect withOAuth, API token
What a connection producesAutomated evidence collection

Connect with OAuth

Before you start, an administrator of Microsoft Azure must allow third-party apps:

  • If you connect with OAuth instead of app credentials, the person who approves Safeguard must be a tenant admin able to grant admin consent for Microsoft Graph permissions; non-admins cannot grant it.
  1. On Compliance › Connectors, open Microsoft Azure, click Connect and choose OAuth.
  2. Sign in to Microsoft Azure and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://graph.microsoft.com/.default, offline_access.
  3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

  1. In Microsoft Azure:

    1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least a Cloud Application Administrator.
    2. Browse to Entra ID › App registrations and select New registration.
    3. Give the app a name (for example Safeguard), under Supported account types select Accounts in this organizational directory only, and select Register.
    4. In the app, select Certificates & secrets, then Client secrets, then New client secret.
    5. Enter a description and a duration, then select Add.
    6. Copy the secret's value now; it is only displayed once.
    7. In the app registration, select API permissions › Add a permission › Microsoft Graph › Application permissions.
    8. Under Select permissions, select the permission or permissions Safeguard needs, then select Add permissions.
    9. Select Grant admin consent for {your tenant} and confirm (the button is disabled unless you are an admin).
    10. To read Azure resources, in the Azure portal search for and select Subscriptions, select the subscription, then Access control (IAM) › Add › Add role assignment.
    11. On the Role tab select the role you wish to assign to the application and select Next; on the Members tab, for Assign access to, select User, group, or service principal, use Select members to find the app by name, then Select and Review + assign.

    Where to find the other values:

    • Directory (tenant) ID: Entra ID › App registrations, select the app: the overview page shows the Directory (tenant) ID.
    • Application (client) ID: Same overview page: Application (client) ID.

    Microsoft Azure shows the secret only once, so copy it before you leave the page.

    Microsoft Azure's public documentation does not cover every step.

    Source: learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.

  2. On Compliance › Connectors, open Microsoft Azure, click Connect, choose API token and fill in:

    FieldWhat to enter
    Directory (tenant) IDRequired.
    Application (client) IDRequired.
    Client secretRequired. Stored encrypted and never shown again.
    Graph access token (optional)Alternative to app credentials: paste a Microsoft Graph token with Directory.Read.All. Stored encrypted and never shown again.

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read Microsoft Azure and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsA1.1, A1.2, C1.1, CC2.3, CC6.1, CC6.2, CC6.3, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC7.3139
ISO/IEC 27001Automated testsA.5.15, A.5.16, A.5.17, A.5.18, A.5.19, A.5.24, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.6, A.8.7, A.8.8, A.8.9, A.8.13, A.8.15, A.8.16, A.8.20, A.8.24139
HIPAA Security RuleAutomated tests164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(a)(6), 164.308(a)(7), 164.312(a)(1), 164.312(b), 164.312(c)(1), 164.312(d), 164.312(e)(1)134
PCI DSSAutomated tests1.3.1, 2.2.1, 3.5.1, 3.7.4, 4.2.1, 5.2.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.4.1, 8.4.2, 8.6.3, 10.2.1, 10.3.2, 10.4.1, 10.5.1, 11.3.1, 11.5.1, 11.5.2127
NIST CSF 2.0Automated testsDE.CM-01, DE.CM-03, DE.CM-09, ID.RA-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.DS-11, PR.IR-01, PR.PS-01, PR.PS-02, PR.PS-04, RS.CO-02139
CIS Microsoft Azure Foundations BenchmarkAutomated tests2.1.2, 2.1.9, 2.1.10, 2.1.12, 2.1.13, 2.1.17, 2.1.18, 2.1.19, 2.1.20, 2.1.21, 3.2, 3.3, 3.5, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.16, 4.1.1, 4.1.3, 4.1.4, 4.1.6, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.5.1, 4.5.2, 4.5.3, 5.1.3, 5.1.4, 5.1.5, 5.1.7, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.3.1, 5.5, 6.3, 6.5, 6.6, 7.1, 7.2, 7.3, 7.4, 7.9, 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 9.1, 9.2, 9.3, 9.4, 9.5, 9.6, 9.7, 9.8, 9.9, 9.1072

For a CIS benchmark, the numbers are its recommendations.

These tests are switched on per workspace by the Safeguard team.

Azure Government, Microsoft Entra ID connect to the same provider as Microsoft Azure, and these tests run for a connection made through any of them.

Linode

Connect Linode to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Netlify

Connect Netlify to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with OAuthConnect with an API tokenFrameworksRelated