Linking Azure Subscriptions

Use this guide to connect your Microsoft Azure subscriptions to DataDefender.

Connecting Azure allows DataDefender to safely inventory storage accounts, run continuous security posture checks, and deploy scanning agents to classify sensitive data in Azure Blob Storage.

Before You Begin (Prerequisites)

Connecting Azure requires administrative access to your Microsoft tenant.

Before starting setup inside DataDefender, ensure you have:

• Azure Permissions: A Microsoft Entra ID (formerly Azure AD) account with permissions to grant consent, alongside Owner or User Access Administrator roles on every subscription you intend to link.

• Terraform CLI: Terraform (v1.3.0 or higher) installed and configured on your local machine or deployment runner.

• Azure CLI: Azure CLI (az) installed and authenticated to your target tenant via az login.

Connection Instructions

Step 1: Navigate to Cloud Connectivity

• Log in to DataDefender.

• In the left navigation menu, go to Settings -> Cloud Connectivity.

• Click Add New Connection.

• Select Azure from the provider options to open the Azure onboarding wizard.

Step 2: Authenticate and Discover Subscriptions

• Click Sign in with Microsoft.

• Complete the OAuth prompt using your Azure administrator credentials.

• Once authenticated, DataDefender automatically retrieves the full list of subscriptions associated with your tenant.

Step 3: Select Target Subscriptions

From the discovered subscriptions list, select the checkbox next to each subscription you want DataDefender to monitor.

You do not need to link your entire cloud footprint at once. You can add more subscriptions later by repeating this workflow.

Step 4: Configure Capabilities and Resource Location

Configure the features DataDefender will run in each selected subscription:

Inventory & Security

• Blob Storage Inventory: Automatically catalogs all storage accounts, containers, and metadata across the subscription.

• Security Checks: Analyzes storage configurations against DataDefender security benchmarks to identify misconfigurations, public exposures, and compliance gaps.

File Scanning

• Blob Storage Classification: Provisions agent infrastructure within the Azure subscriptions to inspect and classify files residing inside Blob Storage.

• OneDrive / SharePoint Scanning: Hosts the agent workers required to scan your Microsoft 365 environments.

OneDrive and SharePoint connections require a separate tenant-level link. If you plan to scan M365 data, enable this toggle so DataDefender can run scanner agents inside your Azure perimeter. See our OneDrive & SharePoint Integration Guide to finish M365 configuration.

Resource Location

• Select your preferred Azure Region (e.g., East US) from the dropdown. DataDefender will deploy its dedicated scanning resource group into this region.

Step 5: Deploy the Terraform Module

After selecting your configuration, DataDefender generates a customized Terraform command containing your tenant details, selected flags, and resource group definitions.

1. Download the Module

Click Download Terraform Package and unpack the files into your local working directory.

2. Initialize Terraform

Open your terminal, navigate to the extracted directory, and run:

terraform init

3. Execute the Deployment

Copy the pre-populated apply command directly from the DataDefender UI and run it in your terminal.

4. Confirm Execution

Review the planned actions in the console output and type yes to confirm.

Step 6: Complete Verification

1. Copy the Client ID

When the run finishes, copy the application_client_id string printed in your terminal output:

Outputs:
application_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"

2. Submit and Verify

• Return to the DataDefender portal.

• Paste the value into the Application (Client) ID field.

• Click Link & Verify.

DataDefender will perform an automated handshake via Federated Identity Credentials (FIC) to confirm API access and validate the deployment.

Troubleshooting & Common Issues

Issue	Likely Cause	Resolution
Authentication Failed (FIC Error)	Mismatched Subject or Issuer URL	Verify that the fic_subject and fic_issuer flags in your terraform apply command match the exact strings provided in the UI without extra trailing slashes.
Insufficient Privileges	Missing RBAC permissions	Ensure your Azure user account holds the Owner or User Access Administrator role on all target subscriptions to assign service principal roles.
Subscription Not Listed	Multi-tenant session or scope mismatch	Confirm your CLI is pointing to the correct tenant by running az account show. Re-authenticate using az login --tenant <TENANT_ID> if necessary.
Region Deployment Error	Azure resource quota restriction	Ensure your selected Azure region has available quota for Container Instances and standard networking components.