MS Defender for Cloud (VM Assets) Connector

Before configuring the connector, complete the following steps in the Microsoft Azure portal to register an application and gather the credentials required by Qualys ETM.

Register an Application in Microsoft Entra ID

1. Register an application in Microsoft Entra ID.
   1. Sign in to the Azure portal and navigate to Azure Active Directory in the left navigation pane.
   2. Select App registrations and click New Registration.
   3. Provide an application name and select the appropriate supported account type. A redirect URI is optional.
   4. Click Register to complete the process.
      
2. Retrieve the Client ID and Tenant ID.
   1. After registration, go to the application Overview page and locate the Essentials section.
   2. Copy the Application (client) ID and the Directory (tenant) ID. These values are entered as the Client ID and Tenant ID fields in the Qualys ETM connector configuration.
      
3. Create a Client Secret.
   1. On the application page, select Certificates & secrets and click New client secret.
   2. Provide a description and set an expiration period, then click Add.
      
   3. Copy the Value of the generated secret immediately.
      

   Important: The Client Secret value is shown only once. It cannot be retrieved after you navigate away from the page. Store it securely before closing this view.

4. Configure API permissions.
   1. Navigate to API Permissions on the application page.
   2. Click Add a permission, select Microsoft Graph, and choose either Delegated or Application permissions depending on your deployment model.
   3. After adding the required permissions, click Grant admin consent for [Your Organization] to activate them.

   Important: Admin consent must be granted for the permissions to take effect. Without it, the connector will return a 403 Forbidden error.

5. Assign the Reader role to the application.
   1. In the Azure portal, navigate to the subscription whose Defender for Cloud VM data you want to ingest.
   2. Select Access Control (IAM), click Add, then Add role assignment.
   3. On the Role tab, search for and select Reader, then click Next.
   4. On the Members tab, click Select members, search for the registered application, and confirm. Save the role assignment.
   5. Repeat for each Azure subscription from which you want to ingest Defender for Cloud VM asset data.

Permissions Required

The registered application must be assigned the Reader role (or higher) on each Azure subscription from which you want to ingest Defender for Cloud VM asset data. Microsoft Graph API permissions must also be granted with admin consent.

Scope and Data Access

The connector ingests Host Asset records for virtual machines. Filters are not supported for this connector; all VM assets within the subscription scope are retrieved. The data flow is unidirectional, from Microsoft Defender for Cloud to Qualys ETM. Import of installed software and source tags is not supported.

Key Rotation

When the Client Secret approaches its expiration date, generate a new secret under Certificates & secrets in the application registration. Update the Qualys ETM connector configuration with the new secret value. Verify the connector reaches the Processed state after the next scheduled execution to confirm the new secret is working correctly.

Configure the connector's identity and authenticate with the source system.

Connector Details

Authentication Details

After entering all authentication details, click Test Connection to validate the credentials before proceeding. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

All checks must pass before the Next button becomes active. If a check fails, refer to the Troubleshooting section for resolution steps.

Define the data to synchronize and set the execution schedule for the connector.

This connector retrieves the following data types on each execution:

• Assets (Host Asset Records)
• Misconfiguration Findings

Review all configuration settings before saving. Verify that the connector name, subscription, Tenant ID, Client ID, and authentication type are correct. Once confirmed, save the connector to complete setup.

After saving, the connector appears in the Connections list in the Registered state and transitions automatically through its processing states.