Overview
Tierity connects to an Azure subscription with a service principal. Each scan lists the subscription’s resources through Azure Resource Graph and imports alerts from Microsoft Defender for Cloud, so cloud findings sit alongside the rest of your queue.Prerequisites
- Permission to create an app registration and assign roles on the subscription
- Microsoft Defender for Cloud enabled if you want its findings
- Manage access (or higher) in Tierity
Credentials required
The client secret is encrypted before it’s stored.
Setup
1
Register an app
In the Microsoft Entra admin center, go to App registrations → New registration, name it
Tierity, and register it. Copy the Application (client) ID and Directory (tenant) ID.2
Create a client secret
Under Certificates & secrets → New client secret, add a secret and copy its Value.
3
Grant read-only access to the subscription
In the Azure portal, open the subscription, go to Access control (IAM) → Add role assignment, and assign the app both Reader and Security Reader.
4
Connect in Tierity
Go to Config → Integrations → Azure, enter the four values, and click Test connection. Add one connection per subscription.
What gets synced
- Resources: everything Resource Graph reports for the subscription, with type, location, resource group and tags
- Findings: Defender for Cloud alerts with severity and the affected resource
Defender for Cloud’s scale tops out at High, so Azure findings never appear as Critical in Tierity.