Azure appears in Safeguard as a connector, as a scan target and as a place to send events. The docs list these options without detailed Azure screens, so this guide is deliberately brief.
What it is
- Connector: the catalog lists Microsoft Azure with OAuth and API token connection and automated evidence collection. Azure Government uses an API token with automated evidence collection. Azure Blob Storage is a connection record, which stores the connection as evidence but does not collect automatically yet.
- Cloud Scan: a CLI scan of cloud configuration posture for AWS, Azure and GCP, run on infrastructure you own, with results uploaded to the console as projects.
- Events: webhook events can be delivered directly to Azure Event Hubs.
- Pipelines: Azure DevOps is a supported CI/CD system. See the separate Azure DevOps guide.
How to use it
Each connector has its own setup page according to the catalog, and the connection method is OAuth consent or an API token. The docs name no Azure roles or scopes, so pick the least access that lets the connector read, and record who approved it.
For events, add a subscription on the Webhooks page: endpoint, event types, signing secret and an optional filter. The filter language supports expressions such as severity in critical and high plus a production environment check. Verify the X-Safeguard-Signature header, and reject events older than 300 seconds.
Two things to keep in mind. Automated compliance tests are switched on per workspace by the Safeguard team, so a connected connector does not mean tests are running. And connection record providers do not collect evidence automatically.
Quick check
What is a connection record?
It stores the connection as evidence for its category. Automated collection is not available for those providers yet.
