# Microsoft Azure
---
title: Connecting Microsoft Azure to WatchDog Security
category: Integrations
integration_type: oauth
products_supported:
- Posture Management
- Inventory
- Vulnerabilities
- Compliance Center
---
This guide explains how to connect **Microsoft Azure** to WatchDog Security using OAuth authentication.
Once connected, WatchDog will begin monitoring your Azure environment for **security posture risks, configuration issues, vulnerabilities, and asset inventory data** across your Azure subscriptions and resources.
---
## What WatchDog Monitors
:::tip[]
WatchDog operates in **read-only mode** and does **not modify configuration settings** within your Microsoft Azure environment.
:::
After the integration is connected, WatchDog may monitor the following services and configuration areas.
**Identity & Access Management**
- Azure Active Directory users
- Service principals
- Managed identities
- Role assignments
- Privileged role assignments
**Compute & Infrastructure**
- Virtual Machines
- Virtual Machine Scale Sets
- App Services
- Azure Kubernetes Service (AKS)
**Networking**
- Virtual Networks
- Network Security Groups
- Public IP addresses
- Load Balancers
- Application Gateways
**Storage**
- Storage Accounts
- Blob Containers
- File Shares
**Databases**
- Azure SQL Databases
- SQL Servers
- Cosmos DB
**Security & Encryption**
- Key Vault
- Disk encryption settings
- Managed keys
- Encryption configurations
**Monitoring & Logging**
- Azure Monitor
- Activity Logs
- Diagnostic settings
The exact information collected depends on the permissions granted during authorization.
---
## Requirements
Before connecting the integration, ensure the following:
- You have **administrator access** to the Azure tenant or subscription you want WatchDog to monitor
- You're an **Account Owner** or **Security Admin** in the WatchDog Security portal
- The Microsoft account used during authorization has access to the Azure subscriptions being monitored
---
## Step 1 — Create an App Registration in Azure
1. Sign in to the [Azure Portal](https://portal.azure.com/).
2. Navigate to **Microsoft Entra ID** → **App registrations** → **+ New registration**.
3. Enter a name, e.g. WatchDog CSPM Connector.
4. Under Supported account types, select Accounts in this organizational directory only.
5. Leave the Redirect URI field blank, then click Register.
---
## Step 2 — Add API Permissions
1. Open the newly created app registration.
2. Go to **API permissions** → **+ Add a permission** → **Microsoft Graph** → **Application** permissions.
3. Add the following permissions:
- `User.Read.All`
- `Group.Read.All`
- `Application.Read.All`
4. Click **Add permissions**.
5. Under **Grant admin consent**, click Grant admin consent for Your Organization.
These permissions are required for WatchDog to inventory your Azure AD users, groups, and app registrations.
---
## Step 3 — Create a Client Secret
1. Under **Certificates & secrets**, select **+ New client secret**.
2. Provide a description (e.g. “WatchDog Integration”) and set an appropriate expiration period (recommendation: **180 days**).
3. Click Add, then copy the Secret Value — this is your Client Secret.
- ⚠️ You won’t be able to view it again after leaving this page.
---
## Step 4 — Collect Connection Details
You’ll need the following values to connect Azure to WatchDog:
| Field | Description | Example |
| --- | --- | --- |
| Tenant ID | Found under Microsoft Entra ID → Overview | `e4a3a23b-...` |
| Application (client) ID | From your App Registration → Overview | `b8df23f4-...` |
| Client Secret | From the step above | `Zxcv1234...` |
---
## Step 5 — Assign Reader Role to the App
1. In the Azure portal, navigate to **Subscriptions**.
2. Select the subscription(s) you want WatchDog to monitor.
3. Go to **Access Control (IAM)** → **Add role assignment**.
4. Choose the **Reader** role.
5. Under **Members**, select **User**, **group**, or **service principal**.
6. Search for your WatchDog app registration by name and assign it.
This grants WatchDog read-only access to your Azure environment for security posture monitoring
---
## Step 6 — Connect Azure in WatchDog Security
1. Log in to the [WatchDog Security Portal](app.watchdogsecurity.io)
2. Navigate to **Management → Integrations**
3. Locate the **Microsoft Azure** integration
4. Click **Connect**.
5. Enter the following fields:
- **Tenant ID**
- **Client ID**
- **Client Secret**
6. Click **Test Connection**.
---
## Initial Sync
- WatchDog will begin collecting configuration and inventory data from Azure
- The initial synchronization time depends on the size of your Azure environment
- Large environments may take **up to one hour**
- **Posture Management**
- **Inventory**
- **Vulnerabilities**
- **Compliance Center**
---
## Revoking Access
To fully remove WatchDog Security's access to your Azure environment, revoke access both in WatchDog and in Microsoft Azure.
### Step 1 — Disconnect the Integration in WatchDog
1. Log into the **WatchDog Security Portal**
2. Navigate to **Management → Integrations**
3. Locate the **Microsoft Azure** integration
4. Click **Disconnect**
5. Confirm the action
This removes the integration and deletes stored OAuth tokens.
---
### Step 2 — Remove OAuth Access in Microsoft Entra ID
1. Sign in to the [Azure Portal](https://portal.azure.com/).
2. Navigate to **Microsoft Entra ID** → **App registrations** → **+ New registration**.
3. Locate the App Registration Created in Step 1 (e.g. WatchDog CSPM Connector.)
4. Select the application
5. Click **Delete**
---
## Troubleshooting
Verify the following:
- The Microsoft account used during setup has sufficient permissions
- The Azure tenant allows OAuth application authorization
- Authorization was completed successfully
If data does not appear after connecting:
- Wait for the initial synchronization to complete
- Confirm the authorized account has access to the required Azure subscriptions
- Reconnect the integration if necessary