WatchDog Security Help Center
    Admin Guide
    • Docs Home
    • Admin Guide
    • User Guide
    • MSP Guide
    • Back to home
    • Integrations
    • Connecting Cloudflare to WatchDog Security
    • Connecting Google Workspace to WatchDog Security
    • Connecting WatchDog & Docker Hub (Personal)
    • Connecting WatchDog & Tailscale
    • Connecting Twingate to WatchDog Security
    • Connecting WatchDog & Intercom
    • Connecting Microsoft 365 to WatchDog Security
    • Connecting Google Cloud to WatchDog Security
    • Connecting Microsoft Azure to WatchDog Security
    • Connecting WatchDog & Amazon Web Services (AWS)

    Connecting Microsoft Azure to WatchDog Security

    This guide explains how to connect Microsoft Azure to WatchDog Security using OAuth authentication.
    Once connected, WatchDog will begin monitoring your Azure environment for security posture risks, configuration issues, vulnerabilities, and asset inventory data across your Azure subscriptions and resources.

    What WatchDog Monitors#

    WatchDog operates in read-only mode and does not modify configuration settings within your Microsoft Azure environment.
    After the integration is connected, WatchDog may monitor the following services and configuration areas.
    Scopes
    Identity & Access Management
    Azure Active Directory users
    Service principals
    Managed identities
    Role assignments
    Privileged role assignments
    Compute & Infrastructure
    Virtual Machines
    Virtual Machine Scale Sets
    App Services
    Azure Kubernetes Service (AKS)
    Networking
    Virtual Networks
    Network Security Groups
    Public IP addresses
    Load Balancers
    Application Gateways
    Storage
    Storage Accounts
    Blob Containers
    File Shares
    Databases
    Azure SQL Databases
    SQL Servers
    Cosmos DB
    Security & Encryption
    Key Vault
    Disk encryption settings
    Managed keys
    Encryption configurations
    Monitoring & Logging
    Azure Monitor
    Activity Logs
    Diagnostic settings
    The exact information collected depends on the permissions granted during authorization.

    Requirements#

    Before connecting the integration, ensure the following:
    You have administrator access to the Azure tenant or subscription you want WatchDog to monitor
    You're an Account Owner or Security Admin in the WatchDog Security portal
    The Microsoft account used during authorization has access to the Azure subscriptions being monitored

    Step 1 — Create an App Registration in Azure#

    1.
    Sign in to the Azure Portal.
    2.
    Navigate to Microsoft Entra ID → App registrations → + New registration.
    image.png
    3.
    Enter a name, e.g. WatchDog CSPM Connector.
    4.
    Under Supported account types, select Accounts in this organizational directory only.
    5.
    Leave the Redirect URI field blank, then click Register.
    image.png

    Step 2 — Add API Permissions#

    1.
    Open the newly created app registration.
    2.
    Go to API permissions → + Add a permission → Microsoft Graph → Application permissions.
    3.
    Add the following permissions:
    User.Read.All
    Group.Read.All
    Application.Read.All
    4.
    Click Add permissions.
    5.
    Under Grant admin consent, click Grant admin consent for Your Organization.
    These permissions are required for WatchDog to inventory your Azure AD users, groups, and app registrations.
    image.png
    image.png
    image.png
    image.png

    Step 3 — Create a Client Secret#

    1.
    Under Certificates & secrets, select + New client secret.
    2.
    Provide a description (e.g. “WatchDog Integration”) and set an appropriate expiration period (recommendation: 180 days).
    3.
    Click Add, then copy the Secret Value — this is your Client Secret.
    ⚠️ You won’t be able to view it again after leaving this page.
    image.png
    image.png

    Step 4 — Collect Connection Details#

    You’ll need the following values to connect Azure to WatchDog:
    FieldDescriptionExample
    Tenant IDFound under Microsoft Entra ID → Overviewe4a3a23b-...
    Application (client) IDFrom your App Registration → Overviewb8df23f4-...
    Client SecretFrom the step aboveZxcv1234...
    image.png
    image.png
    image.png

    Step 5 — Assign Reader Role to the App#

    1.
    In the Azure portal, navigate to Subscriptions.
    2.
    Select the subscription(s) you want WatchDog to monitor.
    3.
    Go to Access Control (IAM) → Add role assignment.
    4.
    Choose the Reader role.
    5.
    Under Members, select User, group, or service principal.
    6.
    Search for your WatchDog app registration by name and assign it.
    This grants WatchDog read-only access to your Azure environment for security posture monitoring
    image.png
    image.png
    image.png
    image.png

    Step 6 — Connect Azure in WatchDog Security#

    1.
    Log in to the WatchDog Security Portal
    2.
    Navigate to Management → Integrations
    3.
    Locate the Microsoft Azure integration
    4.
    Click Connect.
    5.
    Enter the following fields:
    Tenant ID
    Client ID
    Client Secret
    6.
    Click Test Connection.

    Initial Sync#

    After the integration is connected
    WatchDog will begin collecting configuration and inventory data from Azure
    The initial synchronization time depends on the size of your Azure environment
    Large environments may take up to one hour
    Data will appear within the following modules
    Posture Management
    Inventory
    Vulnerabilities
    Compliance Center

    Revoking Access#

    To fully remove WatchDog Security's access to your Azure environment, revoke access both in WatchDog and in Microsoft Azure.

    Step 1 — Disconnect the Integration in WatchDog#

    1.
    Log into the WatchDog Security Portal
    2.
    Navigate to Management → Integrations
    3.
    Locate the Microsoft Azure integration
    4.
    Click Disconnect
    5.
    Confirm the action
    This removes the integration and deletes stored OAuth tokens.

    Step 2 — Remove OAuth Access in Microsoft Entra ID#

    1.
    Sign in to the Azure Portal.
    2.
    Navigate to Microsoft Entra ID → App registrations → + New registration.
    3.
    Locate the App Registration Created in Step 1 (e.g. WatchDog CSPM Connector.)
    4.
    Select the application
    5.
    Click Delete

    Troubleshooting#

    Integration Fails to Connect
    Verify the following:
    The Microsoft account used during setup has sufficient permissions
    The Azure tenant allows OAuth application authorization
    Authorization was completed successfully
    No Data Appears
    Modified at 2026-03-14 20:36:10
    Previous
    Connecting Google Cloud to WatchDog Security
    Next
    Connecting WatchDog & Amazon Web Services (AWS)
    Built with