Microsoft Defender for Cloud (CNAPP)

The Microsoft Defender for Cloud API Connector bridges your cloud security platform with Qualys ETM to automatically synchronize asset inventory and security findings through scheduled API calls.

By centralizing misconfiguration data from Microsoft's cloud security service, the connector deduplicates redundant entries, normalizes data formats, enriches findings with additional context, and calculates risk scores using TruRisk, eliminating manual data aggregation and enabling faster remediation decisions.

Security teams gain unified visibility into cloud infrastructure vulnerabilities alongside other organizational findings, transforming disconnected security alerts into actionable intelligence for risk-driven prioritization across hybrid environments.

Connector Details

Here is a comprehensive overview of what the Microsoft Defender Connector supports.

Vendor	Microsoft
Product Name	Defender for Cloud
Category	Cloud Security
Findings Supported	Yes
Assets Supported	Cloud Resources (check the Asset Data Scope below for full details)
Version	1.0.0
Supported Version & Type	SaaS (Latest)
Integration Type	API Integration (REST)
Direction	Unidirectional
Delta Support	Not Supported
Import of Installed Software	Not Supported
Import of Source Tags	Not Supported
Filters/Filter Query	Not Supported

Asset Data Scope

Complete list of cloud resources fetched with the Defender for Cloud connector.

Cloud Provider and Findings	Resources
Azure Vulnerabilities	Compute and its vulnerability findings Serverless Function (Asset only)  Container Image and its vulnerability findings Container Instance (Asset only)
Azure Misconfigurations	Misconfiguration from MS Defender for following assets: Azure Container Instance Azure Compute VM Azure Serverless (Functions)

Cloud Platform for Findings SupportCloud Platform for Findings Support

Prerequisites

These are the required configurations you need to successfully create a MDC connection for Qualys ETM.

User Roles and Permissions

You need the following MDC API Access information to configure the connection:

• Subscription
• Tenant ID
• Client ID 
• Client Secret

For quick reference on how to obtain the required values, follow the steps below.

Authentication URL

Just provide the value - https://login.microsoftonline.com/

Client ID and Tenant ID

1. Log on to your Microsoft Azure console and click Azure Active Directory in the left navigation pane. 
2. Navigate to  App registrations > New Registration section from your Azure portal. Let's register an application.
3. Provide a name for the application and select the required supported account types.
4. You can also provide a Redirect URI. This step is optional; you can leave it blank and proceed if it does not apply.
5. Click Register once you have provided these inputs. The newly created application is displayed with its properties. 
   
6. Go to Overview > Essentials to view your Client (Application) ID and Tenant (Directory) ID. Store these values securely for later use.
   
7. Click Add a certificate or secret to create the Client Secret.

Client Secrets

1. Click New client secret to create a new client secret for this connection.
2. Provide a value of your choice in the Description field.  You can set the Expires field to its recommended setting. Click Add.
   
3. Once the secret is created, copy the Value of your Client Secret and store it securely for later use.
   

Required Permissions 

Steps to add the required permissions.

1. API Permissions: After application registration, navigate to the API Permissions section of your app.
2. Add a permission:
   • Click on Add a permission.
   • Select Microsoft Graph.
3. Select permissions:
   • Delegated permissions: Choose permissions if the app needs to access the API as the signed-in user.
   • Application permissions: Choose permissions if the app needs to access the API as a background service or daemon without a signed-in user.
4. Grant admin consent: If necessary, click on Grant admin consent for [Your Organization] to grant the permissions to all users in the organization.

Minimum permission required is "Reader Role (or higher)"

Assign Reader and Security Reader Roles

Navigate to Subscriptions

1. Log in to the Azure portal at portal.azure.com.
2. In the Azure Portal search bar at the top, type Subscriptions and click on it.
3. Select your target subscription from the list.

Open Access Control (IAM)

1. In the left sidebar, click Access control (IAM).
2. Click + Add and select Add role assignment from the dropdown.

Select the Reader Role

1. Under the Role tab, search for Reader in the search box.
2. Select Reader from the results
3. Click Next

Assign to your App Registration

1. Under Assign access to, select User, group, or service principal
2. Click + Select members
3. Search for the name of the App Registration you created earlier (this is the same application name used in the connector configuration)
4. Select it from the results and click Select
5. Click Next, review the assignment, and click Review + assign to confirm

6. Repeat Steps 2 through 4 to assign the Security Reader role to the same App Registration, selecting Security Reader in Step 3 instead of Reader.

Connector Configuration

Let's create our first MDC connection. Follow the steps below to get started.

Create a New API Connector

Basic DetailsBasic Details

Data ModelData Model

Transform MapsTransform Maps

ProfileProfile

ScoringScoring

Select Identification RulesSelect Identification Rules

How Does a Connection Work?

The MDC connector operates through configured profiles that determine which data is synchronized and when.

A Connection usually involves creating a profile that defines which misconfigurations to import based on detection data types and asset types. The connector then automatically executes according to the schedule (or on-demand), pulling vulnerability data from Microsoft Defender for Endpoint into Qualys ETM where it can be viewed alongside other security findings.

With the MDC API Connector successfully configured, you are almost ready to view all the assets and findings from MDC.

In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.

Connector States

A successfully configured connector goes through 4 states.

1. Registered - The connector is successfully created and registered to fetch data from the vendor.
2. Scheduled - The connector is scheduled to execute a connection with the vendor.
3. Processing - A connection is executed and the connector is fetching the asset and findings data.
4. Processed - The connector has successfully fetched the assets, it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.

The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.

This entire process may take up to 2 hours for completion. Once it is done, you can find the imported data in Enterprise TruRisk Management (ETM).

View Assets and Findings in ETM

Navigate to Enterprise TruRisk Management to get started with analyzing your Connector's vulnerability findings.

You can view the assets imported from the MDC connection by navigating to Inventory tab of ETM.

Go to Assets > Host to find all of your imported assets.

Use the token, inventory: (source: `Defender for Cloud`) to view all the imported MDC assets.

Here, you can learn about the criticality of your assets and their Risk Scores. Click any of the asset to find more details about them.

Next, you can navigate to the Risk Management tab to view your vulnerability findings.

Go to Findings > Misconfigurations to view all the discovered vulnerabilities.

Use the token, finding.vendorProductName: `Defender for Cloud` to view all the discovered Defender vulnerabilities.

To know more about how the MDC API Connector leverages the findings, refer to the Qualys ETM Documentation.

Additional Resources

Additional Information related to MDC Connector.

API Reference

Here are the APIs executed for the MDC connection.

Name	Filters/Key	Description
Auth API	https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token	Required Values- Subscription Uuid Tenant ID Client Id Client Secret grant_type = client_credentials Scope = https://management.azure.com/.default
Fetch Asset	https://management.azure.com/providers/ Microsoft.ResourceGraph/resources?api-version=2021-03-01	Sample Asset fetch query Compute API Query: resource_type:${computeFilter})+(updated_at:>'${updated_at}' Container API Query: Resources | where type =~ 'Microsoft.ContainerInstance/containerGroups'
Fetch Container Images	https://${registryUri}/oauth2/token https://${registryUri}/v2/${repository}/manifests/${digest} https://${registryUri}/v2/${repository}/blobs/${configDigest}	Registry Pull Auth parameters client_id client_secret filter query used= repository:${repository}:pull
Fetch Vulnerabilites	https://management.azure.com/providers/ Microsoft.ResourceGraph/resources?api-version=2021-03-01	Filter query for compute findings securityresources | where type =~ 'microsoft.security/assessments/subassessments' and ( properties.additionalData.assessedResourceType == 'ServerVulnerabilityTvm') Filter query for container images findings securityresources | where type =~ 'microsoft.security/assessments/subassessments' and properties.additionalData.assessedResourceType == 'AzureContainerRegistryVulnerability'| extend assessmentKey = extract(@'providers/Microsoft.Security/assessments/([^/]*)', 1, id) | where assessmentKey == '<assesmentKey>'

Data Model Map

This section explains the attribute mappings of the values from Microsoft Defender for Cloud and Qualys ETM.

Asset Transformation Map

AZURE.VIRTUAL_MACHINEAZURE.VIRTUAL_MACHINE

AZURE.CONTAINER_IMAGEAZURE.CONTAINER_IMAGE

AZURE.CONTAINER_INSTANCEAZURE.CONTAINER_INSTANCE

AZURE.SERVERLESSAZURE.SERVERLESS

Vulnerability Transformation Map

AZURE.CONTAINER_IMAGEAZURE.CONTAINER_IMAGE

COMPUTECOMPUTE

ALL MISCONFIDURATION FINDINGSALL MISCONFIDURATION FINDINGS