Enable Azure Cloud Integration

Data Collection will be setup first. After Data Collection is activated, enable integration to allow security center to integrate with other Microsoft security services by allowing other services to access cloud data.

1. Log in to Azure portal with you Azure AD account: https://portal.azure.com/.
2. Search and click on Microsoft Defender for Cloud.
3. Go to Management > Environment settings, and click on your current Azure Subscription.



4. In Servers resource type, turn on the toggle switch button to activate it, and click Change plan >.



5. Select Microsoft Defender for Servers Plan 2 and click Confirm.



6. Go back to Settings menu and click Auto provisioning
7. Turn on the Extension: Log Analytics agent for Azure VMs and click Edit Configuration.



8. In Workspace configuration, select Connect Azure VMs to the default workspace(s) created by Defender for Cloud.



9. In Store additional raw data - Windows security events, select Common, and click Apply.
10. Turn on another Extension: Vulnerability assessment for machines and click Edit configuration.



11. Select Microsoft threat and vulnerability management and click Apply.

Note: other extensions are recommended to be turn on, but not required.

12. Go back to Settings > Integrations.
13. In Enable integrations, enable both integrations:
    1. Allow Microsoft Defender for Cloud Apps to access my data
    2. Allow Microsoft Defender for Endpoint to access my data.

Setup Azure Security Policy for Full Subscription Users (Optional)

If you have Azure Pay as you go subscription, enable Data Collection and Threat detection is sufficient for Azure Integration.

For Azure full subscription users, setup appropriate security policy for your organization.

1. Continue from the steps above in the same subscription setting, go to Security Policy.



2. Enable the security policies required by your organizations.

After Azure data collection and integration is enabled, FortiCNP is able extract cloud integration data from Azure and provide real time cloud security monitoring.