MS Defender for Cloud (VM Assets) Connector

Before configuring the connector, complete the following steps in the Microsoft Azure portal to register an application and gather the credentials required by Qualys ETM.

Register an Application in Microsoft Entra ID

1. Register an application in Microsoft Entra ID.
   1. Sign in to the Azure portal and navigate to Azure Active Directory in the left navigation pane.
   2. Select App registrations and click New Registration.
   3. Provide an application name and select the appropriate supported account type. A redirect URI is optional.
   4. Click Register to complete the process.
      
2. Retrieve the Client ID and Tenant ID.
   1. After registration, go to the application Overview page and locate the Essentials section.
   2. Copy the Application (client) ID and the Directory (tenant) ID. These values are entered as the Client ID and Tenant ID fields in the Qualys ETM connector configuration.
      
3. Create a Client Secret.
   1. On the application page, select Certificates & secrets and click New client secret.
   2. Provide a description and set an expiration period, then click Add.
      
   3. Copy the Value of the generated secret immediately.
      

   The Client Secret value is shown only once. It cannot be retrieved after you navigate away from the page. Store it securely before closing this view.

Permissions Required

The connector ingests Host Asset records for virtual machines. The data flow is unidirectional, from Microsoft Defender for Cloud to Qualys ETM. Import of installed software and source tags is not supported.

Scope and Data Access

The registered application requires the following permissions to allow the connector to read Defender for Cloud data.

Assign Reader and Security Reader Roles

Navigate to Subscriptions:

1. Log in to the Azure portal at portal.azure.com.
2. Type Subscriptions in the Azure Portal search bar and click it.
3. Select your target subscription from the list.

Open Access Control (IAM):

1. In the left sidebar, click Access control (IAM).
2. Click + Add and select Add role assignment from the dropdown.

Assign the Reader role:

1. Under the Role tab, search for Reader and select it from the results.
2. Click Next.
3. Under Assign access to, select User, group, or service principal.
4. Click + Select members and search for the name of the App Registration you created.
5. Select it and click Select.
6. Click Next, review the assignment, and click Review + assign to confirm.
7. Repeat these steps to also assign the Security Reader role to the same App Registration.

The minimum required permission is the Reader role (or higher) on each Azure subscription whose Defender for Cloud data you want to ingest.

The registered application must be assigned the Reader role (or higher) on each Azure subscription from which you want to ingest Defender for Cloud VM asset data. Microsoft Graph API permissions must also be granted with admin consent.

Key Rotation

When the Client Secret approaches its expiration date, generate a new secret under Certificates & secrets in the application registration. Update the Qualys ETM connector configuration with the new secret value. Verify the connector reaches the Processed state after the next scheduled execution to confirm the new secret is working correctly.

Configure the connector's identity and authenticate with the source system.

Connector Details

Authentication Details

The Client Secret is visible only at the time of creation in the Azure portal. Copy and store it securely before saving the application registration page, as it cannot be retrieved later.

After entering all authentication details, click Test Connection to validate the credentials before proceeding. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

All checks must pass before the Next button becomes active. If a check fails, refer to the Troubleshooting section for resolution steps.

This step defines the data to synchronize and sets the connector's execution schedule. 

This connector retrieves the following data types on each execution:

• Assets & Misconfigurations

Limit sync to top 1,000 assets and findings - You can select this checkbox to limit the fetch 1000 assets using risk-based filter criteria. The assets, along with their associated findings, are discovered and shared with ETM. The connector applies risk-based filters during asset fetch to ensure the ingested subset represents the most relevant assets in your environment rather than a random or arbitrary sample.

Sampling Mode can restrict data ingestion to a targeted subset of up to 1,000 assets and their associated findings. You can quickly validate integration and review meaningful security data without a full environment sync.

Assets are fetched based on the last-seen timestamp, configured in the connector's advanced settings in the UI. The fetch is scoped to specific endpoint categories such as servers, workstations, and domain controllers, ensuring coverage across your most critical managed device types.

Schedule - Set Occurs to Custom and select the occurrence type:

• Single Occurrence — Runs the connector once at a specified date and time. Select the timezone, Start Date, and Start Time.
• Recurring — Runs the connector on a repeating schedule. Provide start and end date/time along with recurrence interval.

Schedule times are interpreted in the selected timezone. Verify your timezone selection before saving; scheduling in an incorrect timezone may delay the first sync.

Advanced Settings: Select Advanced settings to optionally configure Filters, Transformation Maps, and Risk Severity Mapping. 

Advanced Settings

Enabling the Advanced Settings toggle on the Scope & Schedule page or clicking the Advanced Settings link opens a panel with three tabs: Filters, Transform Map, and Risk Severity Mapping.

Filters

Use the Filters tab to restrict which asset types and findings are ingested.

Delta synchronization is not supported. Each scheduled execution performs a full sync of all VM assets within the subscription scope.

Transform Map

The Transform Map tab lists the active transformation maps applied to data ingested by this connector. The following map is active for the Microsoft Defender for Cloud (VM Assets) Connector: Microsoft Azure Defender for Cloud Host Asset Map.

Transformation maps define how source fields are translated into Qualys ETM target fields. For field-level mapping details, see Transformation Maps under Additional Information.

Risk Severity Mapping

The Risk Severity Mapping tab defines how CrowdStrike severity values are translated into Qualys severity levels and QDS scores for findings that are not scored automatically by the Qualys Cloud Threat Database.

 Qualys automatically updates scores for CVE-based vulnerabilities available in the Qualys Cloud Threat Database. The severity mapping below applies only to findings that are not CVE-based or are not present in the Qualys Cloud Threat Database.

The default Severity is 2. This value is applied when the severity value from CrowdStrike is unavailable for a given finding.

Review all configuration settings before saving. Once confirmed, save the connector to complete setup.

Review the connection, then click the Create button. 

After saving, the connector appears in the Connections list in the Registered state and transitions automatically through its processing states.