Press CTRL+K to open search

Integrate Microsoft Azure with Zscaler MDR

  • Updated on Sep 9, 2026
  • Published on Feb 9, 2024
  • 9 minute(s) read
Prev Next

Notes

  • Account Limits: Zscaler MDR restricts all cloud integrations to 2,000 accounts or external services in a single subdomain. Please contact your Customer Success Manager if you anticipate hitting this limit.

  • Azure Costs: You may experience a potential increase in Azure costs depending on the volume of new logs exported to your Log Analytics workspace as part of the MDR for Azure integration. The affected logs are Log Analytics Workspace, Log Analytics Data Export, and Platform Logs (Storage Diagnostic Settings). For more information, see Microsoft's Azure Monitor Pricing.

Integrating Microsoft Azure with Zscaler MDR enhances cloud security by providing advanced threat detection and response capabilities. This integration allows organizations to gain deeper visibility into cloud environments, identify and prioritize critical threats, and accelerate incident response times, ultimately reducing the risk of data breaches and downtime. To integrate Microsoft Azure with Zscaler MDR, follow the procedure below from beginning to end. Once all steps are completed successfully, the data should be flowing successfully into Zscaler MDR within four hours or less.

Prerequisites

Before you start the Azure integration, please make sure the following requirements are met:

  • You have an Owner role in Azure. To grant the Owner role, use the following Azure CLI command at least 24 hours before your integration call, as role assignments can take several minutes to propagate on the Microsoft side (the permissions can be revoked once the integration setup is complete):

    az role assignment create --assignee <User ID> --scope "/" --role "Owner"

  • You’re subscribed to Zscaler MDR’s Cloud Control Planes license

  • You have an active Azure subscription with Lighthouse enabled (Microsoft’s recommended way to provide cross-tenant access). Please note that Lighthouse is a requirement and the integration will not work without it. To learn more about how Zscaler MDR utilizes Lighthouse, see How Microsoft Azure Works with Zscaler MDR.

  • You’re an Azure Global Administrator with “Access management for Azure resources” enabled for your user account

  • You have the appropriate Azure region enabled in your Azure environment for Zscaler MDR Automation and exporting Defender for Cloud alerts. The required region depends on your Zscaler MDR environment:

    Zscaler MDR Environment

    Domain

    Required Azure Region

    US

    my.redcanary.co

    East US (eastus)

    EU

    my.eu01.redcanary.co

    Germany West Central
    (germanywestcentral)

    India

    my.ind01.redcanary.co

    Central India

    (centralindia)

  • Your local region (configured in Step 2) supports Azure Event Hubs Premium, which is used to process telemetry or alerts from infrastructure in your region

    Note

    To validate if your region supports Azure Event Hubs Premium:

    1. In the Azure portal, create a namespace.

    2. On the Create Namespace page, click the Location dropdown and see if your region is one of the available options.

  • You have Management Groups enabled for your Azure directory. To enable Management Groups, see How do I enable Management groups in my Azure directory?

Step 1: Set up the Azure infrastructure

Download the Zscaler MDR Bicep file and upload it to your Azure Cloud Shell.

  1. In the Zscaler MDR portal, click Microsoft Azure.

  2. Enter a name for your new Microsoft Azure integration.

  3. Click Zscaler MDR Bicep File to download the required file. You’ll use this in a later step.

  4. Copy and save the command below. You’ll use this in a later step. For the <TenantId> value, enter your Azure Tenant ID.

    az deployment mg create --name 'RCLogIngestPolicy' \
  --location <region> \
  --template-file RedCanary.bicep \
  --management-group-id <TenantId

    Replace <region> with the Azure region for your Zscaler MDR environment:

    • US ( my.redcanary.co): eastus

    • EU ( my.eu01.redcanary.co): germanywestcentral

    • India ( my.ind01.redcanary.co): centralindia

      Microsoft Azure

  5. From your Microsoft Azure homepage, click Cloud Shell.

  6. From the Cloud Shell dropdown, select Bash.

  7. Click Upload File.

  8. Click Upload.

  9. Select the Zscaler MDR Bicep File you downloaded in Step 1.3.

  10. From the Cloud Shell command, paste and then run the command from Step 1.4.

    Zscaler MDR

  11. Select I’ve deployed the Bicep file.

  12. Copy the entire command below and save it. You’ll use this in a later step. For the <TenantId> value, enter your Azure Tenant ID.

    az account management-group subscription show-sub-under-mg --query "[].name" --name <TenantId> \
  --out tsv | xargs -I {} -P 10 az policy remediation \
  create --name RCLogConfigurationAccessDeploy --policy-assignment RCLogConfigurationAccess \
  --resource-discovery-mode ReEvaluateCompliance --subscription "{}"

az account management-group subscription show-sub-under-mg --query "[].name" --name <TenantId> \
  --out tsv | xargs -I {} -P 10 az policy remediation \
  create --name RCAutomationRgDeploy --policy-assignment RCAutomationRg \
  --resource-discovery-mode ReEvaluateCompliance --subscription "{}"


    Microsoft Azure

  13. From the Cloud Shell command, paste and then run the entire command from the step above.

    Note: This command runs a remediation to apply the diagnostic setting policies to all existing subscriptions.


    Zscaler MDR

  14. Select I’ve Connected my existing subscriptions.

  15. Click Next.

Step 2: Configure an Azure Log Analytics workspace to collect Entra ID logs

For Zscaler MDR to start receiving your telemetry, you must send your data from your environment to an Azure log analytics workspace.

Note: If you already have an Azure log analytics workspace ingesting logs, including ADFSSignInLogs, AuditLogs, ManagedIdentitySignInLogs, ServicePrincipalRiskEvents, ServicePrincipalSignInLogs, SignInLogs, and UserRiskEvents, select I already have a Log Analytics workspace set up and continue on to Step 2.20.

  1. Select I need to set up a Log Analytics workspace.


    Microsoft Azure

  2. Login to Microsoft Azure using a Global Admin account for the tenant that you want to integrate with Zscaler MDR.

  3. In the search bar, type and then select Resource groups.

  4. Click +Create.

  5. From the Subscription dropdown, select the subscription which you would like to house your Azure Log Analytics Workspace.

  6. Enter a Resource Group name.

    (Example: Red_Canary_Resources)

  7. From the Region dropdown, select your local region.

  8. Click Next: Tags >.

  9. Click Next: Review + create >.

  10. Click Create

  11. In the search bar, type and then select Log Analytics workspaces.

  12. Click +Create.

  13. From the Subscription dropdown, select the subscription you want associated with this workspace.

  14. From the Resource group dropdown, select the Resource group created in Step 2.6.

  15. Enter a name for the Instance details.

    (Example: Red_Canary_Log_Analytic_workspace)

  16. From the Region dropdown, select your local region.

  17. Click Next: Tags >.

  18. Click Next: Review + create >.

  19. Click Create.

    Zscaler MDR

  20. Select I’ve completed creating the Log Analytics workspace.

    Note: If you already have a Log Analytics workspace to collect Entra ID logs, select I already have a Log Analytics workspace setup to collect Entra ID logs, and then click Next to continue on with Step 3.

  21. Select I need to configure my Log Analytics workspace to collect Entra ID logs.


    Microsoft Entra

  22. Login to Microsoft Entra using a Security Admin account.

  23. In the search bar, type and then select Microsoft Entra ID.

  24. From the Monitoring section, click Diagnostic settings.

  25. Click + Add diagnostic setting.

  26. Enter a name for your diagnostic setting.

  27. From the Categories section, select the following:

    1. ADFSSignInLogs

    2. AuditLogs

    3. ManagedIdentitySignInLogs

    4. ServicePrincipalRiskEvents

    5. ServicePrincipalSignInLogs

    6. SignInLogs

    7. UserRiskEvents

  28. From the Destination details section, select Send to Log Analytics workspace.

  29. From the Subscription dropdown, select the subscription you want associated with this Diagnostic setting.

  30. From the Log Analytics workspace dropdown, select the workspace from Step 2.15.

  31. Click Save.

    Zscaler MDR

  32. Select I’ve completed configuring my Log Analytics workspace to collect Entra ID logs.

  33. Click Next.

Step 3: Configure Zscaler MDR to integrate with your Azure Tenant

  1. Enter the Azure Tenant ID.


    Microsoft Azure

  2. To find the Tenant ID, log into Microsoft Azure.

  3. In the search bar, type and then select Tenant Properties.

  4. Copy and then paste the Tenant ID into Zscaler MDR.


    Zscaler MDR

  5. Enter the Log analytics Workspace ID.


    Microsoft Azure

  6. To find the Log analytics Workspace ID, log into Microsoft Azure.

  7. In the search bar, type and then select Log Analytics workspace.

  8. Click the workspace that was created in Step 2.15.

  9. Click Properties.

  10. Copy and then paste the Resource ID into Zscaler MDR.


    Zscaler MDR

  11. Click Save.

    Note: Zscaler MDR will now begin provisioning your resources. This could take up to 20 minutes. The integration status will show Provisioning during this time. It will update to Active once completed.

Step 4: Integrate Entra ID with Zscaler MDR

While the Azure integration enables ingestion of Azure Activity Logs and Defender for Cloud Alerts, it does not support filtering by identities. To utilize identity filtering, you’ll need to set up the Entra ID integration in addition to the Azure integration. Follow the steps on Integrate Microsoft Entra ID with Zscaler MDR

Step 5: Utilize Entra ID Response Actions

Follow the steps in Response Actions for Entra ID to enable automated playbooks, configured in Zscaler MDR, to take action in Entra ID.

Remove Microsoft Azure from Zscaler MDR

Should you need to remove the Microsoft Azure integration with Zscaler MDR, follow these steps:

1: Zscaler MDR-Contact Support to remove Diagnostic Settings

For the Microsoft Azure Integration, Zscaler MDR creates Diagnostic Settings on Subscription, Storage Account, and Key Vault resources in your onboarded Azure environment. These Diagnostic Settings are needed to export audit and activity logs to Zscaler MDR and use the naming convention “RC-Logs.” When you remove the Azure integration, these Diagnostic Settings will remain in place unless manually deleted.

For help deleting these Diagnostic Settings, please submit a support ticket and we’ll create a script you can run to automate the removal process.

Note that the script does not automatically delete any Log Analytics workspaces used by Zscaler MDR, so you’ll need to manually review and delete these workspaces and/or group resources as appropriate.

2: Zscaler MDR–Remove Microsoft Azure from the Zscaler MDR Integration page

  1. In the Zscaler MDR portal, click Integrations.

  2. Locate and then click the Microsoft Azure integration you want to remove.

  3. Click the icon.

  4. Click OK.

3: Microsoft Azure–Run the Zscaler MDR provided script

  1. From your Microsoft Azure homepage, click Cloud Shell.

  2. From the Cloud Shell dropdown, select Bash.

  3. Click Upload File.

  4. Click Upload.

  5. Select and upload the Zscaler MDR provided script located here.

    Note: This automated script will remove the Azure resources created during onboarding. These resources include two Azure Policies: Zscaler MDR’s role assignments to access the Subscriptions in your Management Group and a Resource Group created for exporting Microsoft Defender for Cloud alert data.

  6. From the Cloud Shell command, enter the ls command to confirm the script file appears in the output.

  7. Use the following command to grant execution permissions to the script file:

    chmod +x remove-azure-integration.sh

  8. Execute the script file:

    ./remove-azure-integration.sh AZURE_TENANT_ID

4: Microsoft Azure–Remove the Log Analytics Data Export rule for Microsoft Entra ID

From the Cloud Shell command, enter the code below:

  1. Note: For the log-analytics-workspace-name, subscription-id, and resource-group-name below, enter your Azure related info.

    az monitor log-analytics workspace data-export delete --name RC-Entra-Data-Export \
  --workspace-name log-analytics-workspace-name --subscription subscription-id \
  --resource-group resource-group-name --yes

    1. log-analytics-workspace-name: The name of the Log Analytics Workspace used for the integration.

    2. subscription-id: The ID of the Subscription containing the Log Analytics Workspace.

    3. resource-group-name: The name of the Resource Group containing the Log Analytics Workspace.

Ingest Details

Zscaler MDR ingests Azure Activity Logs and Defender for Cloud Alerts from Azure environments. Additionally, Zscaler MDR integrates with Azure to scan the environment regularly to discover new subscriptions and resources.

Zscaler MDR collects three different types of logs from Azure:

  • Azure Entra ID Logs are collected for the entire tenant and your subscriptions. These logs include:

    • ADFSSignInLogs

    • AuditLogs

    • ManagedIdentitySignInLogs

    • ServicePrincipalRiskEvents

    • ServicePrincipalSignInLogs

    • SignInLogs

    • UserRiskEvents

  • Azure Activity Logs are management and control plane data collected at the subscription level. These logs include:

    • AzureActivity

  • Azure Resource Logs are logs generated by activity on a specific resource collected at the subscription level. These logs include:

    • StorageLogs

    • KeyVaultActivityLogs

In addition, Zscaler MDR collects Azure Defender for Cloud Alerts. When Defender for Cloud is enabled on a subscription, each Azure subscription produces its own Defender for Cloud Alerts. Zscaler MDR then collects the Defender for Cloud alerts across an Azure environment and associates those alerts with the source subscription.

For more information on how data is transferred from an Azure environment to Zscaler MDR, see How Microsoft Azure Works with Zscaler MDR.

Finally, Zscaler MDR integrates with Azure to scan your environment regularly to discover new subscriptions and resources. This integration is established via an access policy and enables Zscaler MDR to read your Azure environment. While the delegated role assignments used for this integration include limited write permissions required to maintain detection and ingestion coverage (for example, configuring diagnostic settings and Defender for Cloud exports), Zscaler MDR security teams do not have write access to make general changes to your environment. The policies used can be found in this publicly hosted Bicep file used during integration onboarding.