--- title: "Integrate with Microsoft Azure" slug: "integrate-with-microsoft-azure" updated: 2026-09-09T16:09:35Z published: 2026-09-09T16:09:35Z canonical: "docs.redcanary.com/integrate-with-microsoft-azure" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Microsoft Azure with Zscaler MDR > [!NOTE] > Notes > > - **Account Limits**: Zscaler MDR restricts all cloud integrations to 2,000 accounts or external services in a single subdomain. Please contact your Customer Success Manager if you anticipate hitting this limit. > - **Azure Costs:** You may experience a potential increase in Azure costs depending on the volume of new logs exported to your Log Analytics workspace as part of the MDR for Azure integration. The affected logs are Log Analytics Workspace, Log Analytics Data Export, and Platform Logs (Storage Diagnostic Settings). For more information, see [Microsoft's Azure Monitor Pricing](https://azure.microsoft.com/en-us/pricing/details/monitor/). Integrating Microsoft Azure with Zscaler MDR enhances cloud security by providing advanced threat detection and response capabilities. This integration allows organizations to gain deeper visibility into cloud environments, identify and prioritize critical threats, and accelerate incident response times, ultimately reducing the risk of data breaches and downtime. To integrate Microsoft Azure with Zscaler MDR, follow the procedure below from beginning to end. Once all steps are completed successfully, the data should be flowing successfully into Zscaler MDR within four hours or less. ## Prerequisites Before you start the Azure integration, please make sure the following requirements are met: - You have an Owner role in Azure. To grant the Owner role, use the following Azure CLI command **at least 24 hours before your integration call**, as role assignments can take several minutes to propagate on the Microsoft side (the permissions can be revoked once the integration setup is complete): ```bash az role assignment create --assignee --scope "/" --role "Owner" ``` - You’re subscribed to Zscaler MDR’s Cloud Control Planes license - You have an active Azure subscription with [Lighthouse](https://azure.microsoft.com/en-us/products/azure-lighthouse) enabled (Microsoft’s recommended way to provide cross-tenant access). Please note that **Lighthouse is a requirement** and the integration will not work without it. To learn more about how Zscaler MDR utilizes Lighthouse, see [How Microsoft Azure Works with Zscaler MDR](/doc/docs/how-microsoft-azure-works-with-red-canary#azure-lighthouse-requirement). - You’re an Azure Global Administrator with “Access management for Azure resources” enabled for your user account - You have the appropriate Azure region enabled in your Azure environment for Zscaler MDR Automation and exporting Defender for Cloud alerts. The required region depends on your Zscaler MDR environment: | Zscaler MDR Environment | Domain | Required Azure Region | | --- | --- | --- | | US | `my.redcanary.co` | East US (`eastus`) | | EU | `my.eu01.redcanary.co` | Germany West Central (`germanywestcentral`) | | India | `my.ind01.redcanary.co` | Central India (`centralindia`) | - Your local region (configured in Step 2) supports Azure Event Hubs Premium, which is used to process telemetry or alerts from infrastructure in your region > [!NOTE] > Note > > To validate if your region supports Azure Event Hubs Premium: > > 1. In the Azure portal, create a namespace. > > 2. On the Create Namespace page, click the Location dropdown and see if your region is one of the available options. - You have Management Groups enabled for your Azure directory. To enable Management Groups, see [How do I enable Management groups in my Azure directory?](https://docs.redcanary.com/docs/how-microsoft-azure-works-with-red-canary?highlight=How%20do%20I%20enable%20Management%20groups%20in%20my%20Azure%20directory?) ## Step 1: Set up the Azure infrastructure Download the Zscaler MDR Bicep file and upload it to your Azure Cloud Shell. 1. In the Zscaler MDR portal, click **Microsoft Azure**. 2. Enter a name for your new Microsoft Azure integration. 3. Click **Zscaler MDR Bicep File** to download the required file. You’ll use this in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(119).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 4. Copy and save the command below. You’ll use this in a later step. For the value, enter your Azure Tenant ID. ```plaintext az deployment mg create --name 'RCLogIngestPolicy' \  --location \  --template-file RedCanary.bicep \  --management-group-id with the Azure region for your Zscaler MDR environment: - US ( `my.redcanary.co`): `eastus` - EU ( `my.eu01.redcanary.co`): `germanywestcentral` - India ( `my.ind01.redcanary.co`): `centralindia` **Microsoft Azure** 5. From your Microsoft Azure homepage, click **Cloud Shell**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(122).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 6. From the Cloud Shell dropdown, select **Bash**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(123).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 7. Click **Upload File**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(124).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 8. Click **Upload**. 9. Select the Zscaler MDR Bicep File you downloaded in [Step 1.3](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Click%20Red%20Canary%20Bicep%20File%20to%20download%20the%20required%20file.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.). 10. From the Cloud Shell command, paste and then run the command from [Step 1.4](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Copy%20and%20then%20save%20the%20command%20below.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.). **Zscaler MDR** 11. Select **I’ve deployed the Bicep file**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(125).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 12. Copy the entire command below and save it. You’ll use this in a later step. For the value, enter your Azure Tenant ID. ```Custom az account management-group subscription show-sub-under-mg --query "[].name" --name \  --out tsv | xargs -I {} -P 10 az policy remediation \  create --name RCLogConfigurationAccessDeploy --policy-assignment RCLogConfigurationAccess \  --resource-discovery-mode ReEvaluateCompliance --subscription "{}" az account management-group subscription show-sub-under-mg --query "[].name" --name \  --out tsv | xargs -I {} -P 10 az policy remediation \  create --name RCAutomationRgDeploy --policy-assignment RCAutomationRg \  --resource-discovery-mode ReEvaluateCompliance --subscription "{}" ``` ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(126).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Microsoft Azure** 13. From the Cloud Shell command, paste and then run the entire command from the step above. > [!NOTE] > **Note**: This command runs a remediation to apply the diagnostic setting policies to all existing subscriptions. **Zscaler MDR** 14. Select **I’ve Connected my existing subscriptions**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(127).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 15. Click **Next**. ## Step 2: Configure an Azure Log Analytics workspace to collect Entra ID logs For Zscaler MDR to start receiving your telemetry, you must send your data from your environment to an Azure log analytics workspace. > **Note**: If you already have an Azure log analytics workspace ingesting logs, including ADFSSignInLogs, AuditLogs, ManagedIdentitySignInLogs, ServicePrincipalRiskEvents, ServicePrincipalSignInLogs, SignInLogs, and UserRiskEvents, select **I already have a Log Analytics workspace** **set up** and continue on to [Step 2.20](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Select%20I%E2%80%99ve%20completed%20creating%20the%20Log%20Analytics%20workspace.). 1. Select **I need to set up a Log Analytics workspace**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(131).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Microsoft Azure** 2. Login to Microsoft Azure using a Global Admin account for the tenant that you want to integrate with Zscaler MDR. 3. In the search bar, type and then select **Resource groups**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(130).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 4. Click **+Create**. 5. From the Subscription dropdown, select the subscription which you would like to house your Azure Log Analytics Workspace. 6. Enter a Resource Group name. (Example: Red_Canary_Resources) 7. From the Region dropdown, select your local region. 8. Click **Next: Tags >**. 9. Click **Next: Review + create >**. 10. Click **Create** 11. In the search bar, type and then select **Log Analytics workspaces**. 12. Click **+Create**. 13. From the Subscription dropdown, select the subscription you want associated with this workspace. 14. From the Resource group dropdown, select the Resource group created in [Step 2.6](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Enter%20a%20Resource%20Group%20name.). 15. Enter a name for the Instance details. (Example: Red_Canary_Log_Analytic_workspace) 16. From the Region dropdown, select your local region. 17. Click **Next: Tags >**. 18. Click **Next: Review + create >**. 19. Click **Create**. **Zscaler MDR** 20. Select **I’ve completed creating the Log Analytics workspace**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(132).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) > **Note**: If you already have a Log Analytics workspace to collect Entra ID logs, select **I already have a Log Analytics workspace** **setup to collect Entra ID logs**, and then click **Next** to continue on with [Step 3](https://redcanary.document360.io/doc/docs/integrate-with-microsoft-azure#step-3-configure-red-canary-to-integrate-with-your-azure-tenant:~:text=Enter%20the%20Azure%20Tenant%20ID.). 21. Select **I need to configure my Log Analytics workspace to collect Entra ID logs**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(133).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Microsoft Entra** 22. Login to [Microsoft Entra](http://entra.microsoft.com) using a Security Admin account. 23. In the search bar, type and then select **Microsoft Entra ID**. 24. From the Monitoring section, click **Diagnostic settings**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(134).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 25. Click **+ Add diagnostic setting**. 26. Enter a name for your diagnostic setting. 27. From the Categories section, select the following: 1. **ADFSSignInLogs** 2. **AuditLogs** 3. **ManagedIdentitySignInLogs** 4. **ServicePrincipalRiskEvents** 5. **ServicePrincipalSignInLogs** 6. **SignInLogs** 7. **UserRiskEvents** 28. From the Destination details section, select **Send to Log Analytics workspace**. 29. From the Subscription dropdown, select the subscription you want associated with this Diagnostic setting. 30. From the Log Analytics workspace dropdown, select the workspace from [Step 2.15](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Enter%20a%20name%20for%20the%20Instance%20details.). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/diagnostic.png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 31. Click **Save.** **Zscaler MDR** 32. Select **I’ve completed configuring my Log Analytics workspace to collect Entra ID logs**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(136).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 33. Click **Next**. ## Step 3: Configure Zscaler MDR to integrate with your Azure Tenant 1. Enter the Azure Tenant ID. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(137).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Microsoft Azure** 2. To find the Tenant ID, log into Microsoft Azure. 3. In the search bar, type and then select **Tenant Properties**. 4. Copy and then paste the **Tenant ID** into Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(138).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Zscaler MDR** 5. Enter the Log analytics Workspace ID. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(139).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Microsoft Azure** 6. To find the Log analytics Workspace ID, log into Microsoft Azure. 7. In the search bar, type and then select **Log Analytics workspace**. 8. Click the workspace that was created in [Step 2.15](https://redcanary.document360.io/docs/integrate-with-microsoft-azure#:~:text=Enter%20a%20name%20for%20the%20Instance%20details.). 9. Click **Properties**. 10. Copy and then paste the **Resource ID** into Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(140).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) **Zscaler MDR** 11. Click **Save**. > [!NOTE] > **Note**: Zscaler MDR will now begin provisioning your resources. This could take up to 20 minutes. The integration status will show **Provisioning** during this time. It will update to **Active** once completed. ## Step 4: Integrate Entra ID with Zscaler MDR While the Azure integration enables ingestion of Azure Activity Logs and Defender for Cloud Alerts, it does not support filtering by identities. To utilize identity filtering, you’ll need to set up the Entra ID integration in addition to the Azure integration. Follow the steps on [Integrate Microsoft Entra ID with Zscaler MDR](/doc/docs/integrate-microsoft-entra-id-with-red-canary) ## Step 5: Utilize Entra ID Response Actions Follow the steps in [Response Actions for Entra ID](/doc/docs/response-actions-for-entra-id) to enable automated playbooks, configured in Zscaler MDR, to take action in Entra ID. ## Remove Microsoft Azure from Zscaler MDR Should you need to remove the Microsoft Azure integration with Zscaler MDR, follow these steps: ****1: Zscaler MDR-Contact Support to remove Diagnostic Settings**** For the Microsoft Azure Integration, Zscaler MDR creates Diagnostic Settings on Subscription, Storage Account, and Key Vault resources in your onboarded Azure environment. These Diagnostic Settings are needed to export audit and activity logs to Zscaler MDR and use the naming convention “RC-Logs.” When you remove the Azure integration, these Diagnostic Settings will remain in place unless manually deleted. For help deleting these Diagnostic Settings, please [submit a support ticket](https://support.redcanary.com/hc/en-us/requests/new) and we’ll create a script you can run to automate the removal process. Note that the script does not automatically delete any Log Analytics workspaces used by Zscaler MDR, so you’ll need to manually review and delete these workspaces and/or group resources as appropriate. ****2: Zscaler MDR–Remove Microsoft Azure from the Zscaler MDR Integration page**** 1. In the Zscaler MDR portal, click **Integrations**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(141).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 2. Locate and then click the **Microsoft Azure** integration you want to remove. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(142).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 3. Click the icon. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(143).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 4. Click **OK**. ****3: Microsoft Azure–Run the Zscaler MDR provided script**** 1. From your Microsoft Azure homepage, click **Cloud Shell**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(144).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 2. From the Cloud Shell dropdown, select **Bash**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(146).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 3. Click **Upload File**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(147).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) 4. Click **Upload**. 5. Select and upload the Zscaler MDR provided script located [here](https://rc-customer-tools.s3.us-east-2.amazonaws.com/azure/remove-azure-integration.sh). > [!NOTE] > **Note**: This automated script will remove the Azure resources created during onboarding. These resources include two Azure Policies: Zscaler MDR’s role assignments to access the Subscriptions in your Management Group and a Resource Group created for exporting Microsoft Defender for Cloud alert data. 6. From the Cloud Shell command, enter the **ls** command to confirm the script file appears in the output. 7. Use the following command to grant execution permissions to the script file: ```Custom chmod +x remove-azure-integration.sh ``` 8. Execute the script file: ```Custom ./remove-azure-integration.sh AZURE_TENANT_ID ``` ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(148).png?sv=2026-02-06&spr=https&st=2026-10-26T23%3A20%3A41Z&se=2026-10-27T00%3A20%3A41Z&sr=c&sp=r&sig=%2Fw8FLedxoeb%2F0bo1WxReiBrEWwx6wVQJjENwL7lupxw%3D) ****4: Microsoft Azure–Remove the Log Analytics Data Export rule for Microsoft Entra ID**** From the Cloud Shell command, enter the code below: 1. > [!NOTE] > **Note**: For the log-analytics-workspace-name, subscription-id, and resource-group-name below, enter your Azure related info. ```Custom az monitor log-analytics workspace data-export delete --name RC-Entra-Data-Export \  --workspace-name log-analytics-workspace-name --subscription subscription-id \  --resource-group resource-group-name --yes ``` 1. **log-analytics-workspace-name**: The name of the Log Analytics Workspace used for the integration. 2. **subscription-id**: The ID of the Subscription containing the Log Analytics Workspace. 3. **resource-group-name**: The name of the Resource Group containing the Log Analytics Workspace. ## Ingest Details Zscaler MDR ingests Azure Activity Logs and Defender for Cloud Alerts from Azure environments. Additionally, Zscaler MDR integrates with Azure to scan the environment regularly to discover new subscriptions and resources. Zscaler MDR collects three different types of logs from Azure: - **Azure Entra ID Logs** are collected for the entire tenant and your subscriptions. These logs include: - ADFSSignInLogs - AuditLogs - ManagedIdentitySignInLogs - ServicePrincipalRiskEvents - ServicePrincipalSignInLogs - SignInLogs - UserRiskEvents - **Azure Activity Logs** are management and control plane data collected at the subscription level. These logs include: - AzureActivity - **Azure Resource Logs** are logs generated by activity on a specific resource collected at the subscription level. These logs include: - StorageLogs - KeyVaultActivityLogs In addition, Zscaler MDR collects Azure Defender for Cloud Alerts. When Defender for Cloud is enabled on a subscription, each Azure subscription produces its own Defender for Cloud Alerts. Zscaler MDR then collects the Defender for Cloud alerts across an Azure environment and associates those alerts with the source subscription. For more information on how data is transferred from an Azure environment to Zscaler MDR, see [How Microsoft Azure Works with Zscaler MDR](/doc/docs/how-microsoft-azure-works-with-red-canary). Finally, Zscaler MDR integrates with Azure to scan your environment regularly to discover new subscriptions and resources. This integration is established via an access policy and enables Zscaler MDR to read your Azure environment. While the delegated role assignments used for this integration include limited write permissions required to maintain detection and ingestion coverage (for example, configuring diagnostic settings and Defender for Cloud exports), Zscaler MDR security teams do not have write access to make general changes to your environment. The policies used can be found in this [publicly hosted Bicep file](https://rc-customer-tools.s3.us-east-2.amazonaws.com/RedCanary.bicep) used during integration onboarding.