Microsoft Defender for Cloud (CNAPP)

“–” entries indicate the asset class/finding type combination is not yet available for this connector. NA indicates that the CNAPP vendor does not currently support this asset class/finding type combination.

Complete the following steps in your Microsoft Azure environment before configuring the connector in Qualys ETM. Have the following four values ready before you proceed:

• Subscription UUID
• Tenant ID
• Client ID
• Client Secret

Register an Application and Obtain Credentials

Authentication URL

The Authentication URL is a fixed value. Use: https://login.microsoftonline.com/

Obtain Client ID and Tenant ID

1. Log on to your Microsoft Azure console and click Azure Active Directory in the left navigation pane.
2. Navigate to App registrations > New Registration.
3. Provide a name for the application and select the required supported account types.
4. Optionally provide a Redirect URI, or leave it blank and proceed.
5. Click Register. The newly created application is displayed with its properties.
   
6. Go to Overview > Essentials to view your Client (Application) ID and Tenant (Directory) ID. Store these values securely for later use.
   
7. Click Add a certificate or secret to proceed to Client Secret creation.

Create a Client Secret

1. Click New client secret.
2. Enter a description of your choice and set the expiration period. Click Add.
   
3. Copy the Value of your Client Secret and store it securely before navigating away.
   

Permissions Required

Scope and Data Access

The registered application requires the following permissions to allow the connector to read Defender for Cloud data.

Assign Reader and Security Reader Roles

Navigate to Subscriptions:

1. Log in to the Azure portal at portal.azure.com.
2. Type Subscriptions in the Azure Portal search bar and click it.
3. Select your target subscription from the list.

Open Access Control (IAM):

1. In the left sidebar, click Access control (IAM).
2. Click + Add and select Add role assignment from the dropdown.

Assign the Reader role:

1. Under the Role tab, search for Reader and select it from the results.
2. Click Next.
3. Under Assign access to, select User, group, or service principal.
4. Click + Select members and search for the name of the App Registration you created.
5. Select it and click Select.
6. Click Next, review the assignment, and click Review + assign to confirm.
7. Repeat these steps to also assign the Security Reader role to the same App Registration.

Grant Microsoft Graph API Permissions

1. After application registration, navigate to the API Permissions section of your app.
2. Click Add a permission and select Microsoft Graph.
3. Choose the appropriate permission type:
   1. Delegated permissions — if the app needs to access the API on behalf of a signed-in user.
   2. Application permissions — if the app needs to access the API as a background service or daemon.
4. Click Grant admin consent for [Your Organization] to apply the permissions to all users.

Key Rotation

Client Secrets have a fixed expiration period set at creation time. When a Client Secret expires, the connector will fail authentication. To rotate the key:

1. In the Azure portal, navigate to your App Registration > Certificates & secrets.
2. Create a new Client Secret and copy the value immediately.
3. In Qualys ETM, edit the connector and replace the Client Secret field with the new value.
4. Run Test Connection to verify authentication succeeds.
5. Delete the expired secret from Azure after confirming the connector works.

Configure the connector's identity and authenticate with the source system.

Connector Details

Authentication Details

After entering all authentication details, click Test Connection. A valid connection test is required before you can proceed to the next step. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

Click Next to proceed to Scope & Schedule once all checks pass.

Select the data to ingest from Microsoft Defender for Cloud and configure when the connector should run.

Data to Sync

Choose one of the two options:

• Assets & Findings — Synchronizes asset inventory together with vulnerability and misconfiguration findings. (Default selection.)
• Assets — Synchronizes asset inventory only, without findings.

Click the Advanced toggle to open Advanced Settings and configure asset type and findings filters before proceeding.

Schedule

Set Occurs to Custom and select the occurrence type:

• Single Occurrence — Runs the connector once at a specified date and time. Select the timezone, Start Date, and Start Time.
• Recurring — Runs the connector on a repeating schedule. Provide start and end date/time along with recurrence interval.

Click Next to proceed to Review & Confirm.