Microsoft Defender for Cloud

Record your Microsoft Defender for Cloud connection as cspm evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Microsoft Defender for Cloud:

   1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
   2. Browse to Entra ID › App registrations and select New registration; give the app a name, under Supported account types select Accounts in this organizational directory only, and select Register.
   3. In the app, select Certificates & secrets › Client secrets › New client secret, provide a description and a duration, and select Add.
   4. Copy the secret value now; it is displayed only once. Paste it into Safeguard's API token / Personal access token field.
   5. In the Azure portal, search for and select Subscriptions, then select the subscription Safeguard should read.
   6. In the left pane select Access control (IAM), then Add › Add role assignment.
   7. On the Role tab select Security Reader (read-only access to Defender for Cloud: recommendations, alerts, security policies and security states) and select Next.
   8. On the Members tab, for Assign access to select User, group, or service principal, choose Select members, search for the app by name, choose Select, then Review + assign.

   Where to find the other values:

   • Account / Org / Workspace (optional): Entra ID › App registrations › your app's overview page shows the Directory (tenant) ID and Application (client) ID.
   • Base URL (optional): Not needed for Azure; not shown in a documented UI location.

   Microsoft Defender for Cloud shows the secret only once, so copy it before you leave the page.

   Source: learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.

2. On Compliance › Connectors, open Microsoft Defender for Cloud, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Microsoft Defender for Cloud yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• CSPM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks