Set Up Integrations for Microsoft Products with Multiple Azure Subscriptions

Customers who have Defender for Cloud but multiple different Azure Subscriptions associated will need to create separate integrations in Red Canary for each Subscription.

In this example below there are seven Azure subscriptions. The customer needs to create seven different integrations for each of the subscriptions. This also applies to Microsoft Sentinel.

The arm template gives Red Canary read permissions to each subscription. Without appropriate access, the CSO will not be able to access certain resources that are associated with the individual subscriptions. Step 7 in the integration guide has to be repeated to ensure that the each subscription is granted the proper access (re-upload arm template to ensure that the correct subscription is selected from the dropdown).

Note: This applies even if the subscriptions are all under the same Tenant ID. 

Please see: Integrate Microsoft Defender for Cloud with Red Canary