> For the complete documentation index, see [llms.txt](https://help.datadefender.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.datadefender.io/getting-started/linking-azure-subscriptions.md).

# Linking Azure Subscriptions

Use this guide to connect your Microsoft Azure subscriptions to DataDefender.

Connecting Azure allows DataDefender to safely inventory storage accounts, run continuous security posture checks, and deploy scanning agents to classify sensitive data in Azure Blob Storage.

#### Before You Begin (Prerequisites)

Connecting Azure requires administrative access to your Microsoft tenant.

Before starting setup inside DataDefender, ensure you have:

* **Azure Permissions:** A Microsoft Entra ID (formerly Azure AD) account with permissions to grant consent, alongside `Owner` or `User Access Administrator` roles on every subscription you intend to link.
* **Terraform CLI:** Terraform (`v1.3.0` or higher) installed and configured on your local machine or deployment runner.
* **Azure CLI:** Azure CLI (`az`) installed and authenticated to your target tenant via `az login`.

#### Connection Instructions

<figure><img src="https://3802454275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FobDf5vJfItiNrkno1uJc%2Fuploads%2FJy4QRLsc8YUF1zmfCjRZ%2FScreenshot%202026-09-11%20at%2012.55.05%E2%80%AFPM.png?alt=media&amp;token=94efc871-80fa-4921-be6a-a41cfe912f53" alt=""><figcaption></figcaption></figure>

**Step 1: Navigate to Cloud Connectivity**

* Log in to DataDefender.
* In the left navigation menu, go to **Settings -> Cloud Connectivity**.
* Click **Add New Connection**.
* Select **Azure** from the provider options to open the Azure onboarding wizard.

**Step 2: Authenticate and Discover Subscriptions**

<figure><img src="https://3802454275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FobDf5vJfItiNrkno1uJc%2Fuploads%2FHicEkxtjrhZtidBv1oi2%2FScreenshot%202026-09-11%20at%2012.55.38%E2%80%AFPM.png?alt=media&amp;token=b5f17709-b522-446a-995d-9ae52048cad0" alt=""><figcaption></figcaption></figure>

* Click **Sign in with Microsoft**.
* Complete the OAuth prompt using your Azure administrator credentials.
* Once authenticated, DataDefender automatically retrieves the full list of subscriptions associated with your tenant.

**Step 3: Select Target Subscriptions**

From the discovered subscriptions list, select the checkbox next to each subscription you want DataDefender to monitor.

{% hint style="info" %}
You do not need to link your entire cloud footprint at once. You can add more subscriptions later by repeating this workflow.
{% endhint %}

**Step 4: Configure Capabilities and Resource Location**

Configure the features DataDefender will run in each selected subscription:

**Inventory & Security**

* **Blob Storage Inventory:** Automatically catalogs all storage accounts, containers, and metadata across the subscription.
* **Security Checks:** Analyzes storage configurations against DataDefender security benchmarks to identify misconfigurations, public exposures, and compliance gaps.

**File Scanning**

* **Blob Storage Classification:** Provisions agent infrastructure within the Azure subscriptions to inspect and classify files residing inside Blob Storage.
* **OneDrive / SharePoint Scanning:** Hosts the agent workers required to scan your Microsoft 365 environments.

{% hint style="warning" %}
OneDrive and SharePoint connections require a separate tenant-level link. If you plan to scan M365 data, enable this toggle so DataDefender can run scanner agents inside your Azure perimeter. See our OneDrive & SharePoint Integration Guide to finish M365 configuration.
{% endhint %}

**Resource Location**

* Select your preferred **Azure Region** (e.g., `East US`) from the dropdown. DataDefender will deploy its dedicated scanning resource group into this region.

**Step 5: Deploy the Terraform Module**

<figure><img src="https://3802454275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FobDf5vJfItiNrkno1uJc%2Fuploads%2FIUXtyfTGYrBVhCuZWl9j%2FScreenshot%202026-09-11%20at%2012.56.04%E2%80%AFPM.png?alt=media&amp;token=fd939775-8dcd-46c1-b23b-324239e7a2a7" alt=""><figcaption></figcaption></figure>

After selecting your configuration, DataDefender generates a customized Terraform command containing your tenant details, selected flags, and resource group definitions.

**1. Download the Module**

Click **Download Terraform Package** and unpack the files into your local working directory.

**2. Initialize Terraform**

Open your terminal, navigate to the extracted directory, and run:

```bash
terraform init
```

**3. Execute the Deployment**

Copy the pre-populated apply command directly from the DataDefender UI and run it in your terminal.

**4. Confirm Execution**

Review the planned actions in the console output and type `yes` to confirm.

**Step 6: Complete Verification**

**1. Copy the Client ID**

When the run finishes, copy the `application_client_id` string printed in your terminal output:

```
Outputs:
application_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
```

**2. Submit and Verify**

* Return to the DataDefender portal.
* Paste the value into the **Application (Client) ID** field.
* Click **Link & Verify**.

DataDefender will perform an automated handshake via Federated Identity Credentials (FIC) to confirm API access and validate the deployment.

#### Troubleshooting & Common Issues

| Issue                             | Likely Cause                           | Resolution                                                                                                                                                    |
| --------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication Failed (FIC Error) | Mismatched Subject or Issuer URL       | Verify that the fic\_subject and fic\_issuer flags in your terraform apply command match the exact strings provided in the UI without extra trailing slashes. |
| Insufficient Privileges           | Missing RBAC permissions               | Ensure your Azure user account holds the Owner or User Access Administrator role on all target subscriptions to assign service principal roles.               |
| Subscription Not Listed           | Multi-tenant session or scope mismatch | Confirm your CLI is pointing to the correct tenant by running az account show. Re-authenticate using az login --tenant \<TENANT\_ID> if necessary.            |
| Region Deployment Error           | Azure resource quota restriction       | Ensure your selected Azure region has available quota for Container Instances and standard networking components.                                             |