---
title: "Integrate Microsoft Defender for Cloud with Red Canary"
slug: "integrate-microsoft-defender-for-cloud-with-red-canary"
updated: 2026-10-07T17:15:14Z
published: 2026-10-07T17:15:14Z
canonical: "docs.redcanary.com/integrate-microsoft-defender-for-cloud-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Microsoft Defender for Cloud with Zscaler MDR

> [!NOTE]
> Defender for Cloud integration update (effective Jan 25, 2026):
> 
> Zscaler MDR no longer supports creating the standalone Defender for Cloud integration described below. If you set up this integration before January 25, 2026, it remains active and appears as an alert data source on the Integrations page. New customers must instead [set up the Azure integration](/doc/docs/integrate-with-microsoft-azure), which includes configuring automated export of Defender for Cloud alerts and synchronization of alert states.

The Defender for Cloud integration enables Zscaler MDR to ingest and analyze Azure Cloud alerts, helping you identify and respond to a wide range of suspicious cloud activity.

This integration guide is intended to connect Zscaler MDR with a single Azure subscription that’s using Microsoft Defender for Cloud. If you have multiple Azure subscriptions associated with Defender for Cloud, you’ll need to set up a separate integration in Zscaler MDR for each subscription.

## Prerequisites

Before you start the Defender for Cloud integration, please make sure the following requirements are met:

- You’re an Azure Global Admin user
- You consent to granting Zscaler MDR the [required permissions](/doc/docs/permission-requirements-for-microsoft) to ingest Microsoft data
- You have an active Microsoft subscription that includes a Defender for Cloud workload. To check if your subscription plan includes Defender for Cloud, refer to [Microsoft's Subscription Matrix](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/bade/documents/products-and-services/en-us/education/Modern-Work-Plan-Comparison-Enterprise-15.pdf).

## 1 Zscaler MDR | Add the Integration

1. In the Zscaler MDR portal, go to the **Integrations** page, then click **Add Integration**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
2. On the **Add integration** dialog, search for “Defender for Cloud” and click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
3. On the **Zscaler MDR configuration** page, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-1_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)

## 2 Zscaler MDR | Choose How Zscaler MDR Will Receive This Data

1. On the **Zscaler MDR configuration page**, set **Ingest Format / Method** to **Microsoft Defender for Cloud via API Poll**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
2. Click **Next**.

## 3 Azure/Zscaler MDR | Configure Zscaler MDR to Retrieve Data from This Integration

1. Sign in to the [Azure portal](http://portal.azure.com/) using a Global Admin account for the tenant you plan to integrate with Zscaler MDR.
2. In the search bar, type and select **Subscriptions**.
3. Identify a subscription connected to Defender for Cloud and copy the **Subscription ID**.

> [!NOTE]
> Note
> 
> If you have multiple Azure subscriptions connected to Defender for Cloud, you’ll need to create an integration for each subscription, even if they all share the same Tenant ID.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
4. Return to Zscaler MDR and paste it into **Microsoft Defender for Cloud Subscription ID**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
5. In the Azure search bar, type and select **Tenant properties**.
6. Copy the **Tenant ID**.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
7. Return to Zscaler MDR and paste it into **Microsoft Defender for Cloud Tenant ID**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
8. Click **this consent link** to grant Zscaler MDR access to your Microsoft tenant.

> [!NOTE]
> Note
> 
> You must be a Global Admin Azure user to successfully grant permissions to Zscaler MDR.
> 
> To learn more about which permissions we require, see [Permission Requirements for Microsoft](/doc/docs/permission-requirements-for-microsoft).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
9. Check the **Confirm Microsoft Defender For Cloud API Access Granted** box. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
10. Copy the Zscaler MDR ARM template and save it in a local file. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_07.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
11. In Azure, search for and select **Service providers**.
12. Click **Service Provider Offers**, then **Add offer > Add via template**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_08.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
13. Upload the ARM template and click **Upload**.
14. On the Custom deployment page:
  - From the **Subscription** dropdown, select the subscription with which Defender for Cloud is associated.

> [!NOTE]
> Note
> 
> If you have multiple Azure subscriptions connected to Defender for Cloud, you’ll need to create an integration for each subscription, even if they all share the same Tenant ID.
  - From the **Region** dropdown, select the region in which your Defender for Cloud instance is deployed. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-3_09.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
15. Click **Review + create**.

> [!NOTE]
> Note
> 
> If you receive an error, it may be because you do not have Global Admin user permissions.

## 4 Zscaler MDR | Customize How Data From This Integration is Handled

1. [OPTIONAL] Check the **Enable process correlation for user-defined alerts** box to enable Process Correlation, which allows Zscaler MDR to correlate user-defined alerts from Defender for Cloud with our rule metadata when displaying them in the timeline. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-5_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
2. [OPTIONAL] In the Actions in the Source Platform section, you can disable or enable alert actions to control how Zscaler MDR engages with alerts. These settings manage how Zscaler MDR engages with alerts. The table below describes the outcome of each setting when enabled.

| Setting | Default State | Outcome |
| --- | --- | --- |
| **As Zscaler MDR validates the alert** | Enabled | When enabled, Zscaler MDR adds comments to the alert in notifying users of the current investigation status as the alert is investigated and resolved. |
| **When Zscaler MDR validates the alert as non-threatening** | Enabled | When enabled, Zscaler MDR resolves the alert as `Informational` if the state is Not a Threat. |
| **When Zscaler MDR validates the alert as suspicious** | Disabled | When enabled, Zscaler MDR resolves the alert as `True Positive` if the state is `Suspicious`, `Highly Suspicious`, or `Threat` but no threat has been published. |
| **When Zscaler MDR publishes a threat involving the alert** | Enabled | When enabled, Zscaler MDR resolves the alert as `True Positive` if the state is `Threat` and a threat has been published. |

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-5_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
3. Click **Next**.

## 5 Zscaler MDR | Customize How This Data Is Retained

[OPTIONAL] If you’re subscribed to the [Zscaler Security Data Lake](/doc/docs/getting-started-with-the-security-data-lake), you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval:

1. Check the **Store in the Security Data Lake** box.
2. Enter your desired data retention period in days. The maximum is 1095 days (three years). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-6_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)

## 6 Zscaler MDR | Activate the Integration

After you’ve completed the configuration, click **Save** to activate the integration.

> [!TIP]
> The Defender for Cloud integration is now live!
> 
> Data will appear in Zscaler MDR on the **Integrations** page.
> 
> ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-7_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)

## 7 Zscaler MDR | Modify the Integration

After the Defender for Cloud integration is active, you can make the following modifications to the configuration:

- Update the API configuration used by the integration
- Adjust the Security Data Lake retention period
- Decommission the integration

To modify the configuration:

1. In the Zscaler MDR portal, go to the **Integrations** page, then click on the name of the integration you want to modify.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integratedefenderforcloud-7_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D)
2. After you’ve finished editing the configuration, click **Save** to apply your changes.

#### Deleting the Integration

To delete the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button-2.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A02%3A51Z&se=2026-11-04T16%3A02%3A51Z&sr=c&sp=r&sig=GP0M6K9YK%2Bmq5fuQueb9TJNdQ%2B9BqoC8ks%2BV70anETc%3D) button, then click **OK** to confirm.

> [!WARNING]
> Important
> 
> Deleting the integration will prevent any new alerts from being sent to Zscaler MDR. While existing threat data will remain, all processed alerts will be permanently deleted, and this action cannot be undone.
> 
> For this reason, we recommend deactivating the integration instead, which will retain all previously processed alerts but stop further ingestion. You can reactivate the integration at any time.