All Products
Search

This Product

    Security Center:Onboard Azure assets

    Document Center

    Security Center:Onboard Azure assets

    Last Updated:Jun 18, 2026

    Managing security across multiple cloud environments often leads to fragmented visibility and inconsistent protection. By onboarding Azure assets to Security Center, you can centralize asset inventory, run configuration risk checks (CSPM), and apply automated threat response across clouds—all from a single console. This solution uses Azure application credentials with read-only access to securely sync asset information and build a unified multi-cloud security view.

    How it works

    1. Register an application in Azure and create a service principal as its access credential.

    2. Security Center uses this credential to access the specified subscription through Azure public APIs, enabling synchronization of assets and configuration information within the subscription scope.

    Prerequisites

    Before you begin, ensure that you have:

    • An active Azure subscription with Owner or User Access Administrator permissions.

    • Security Center (Enterprise edition or above) activated with sufficient quota.

    • Familiarity with the Azure features you plan to onboard, such as host assets, cloud configuration check (CSPM), or automated threat response.

    Procedure

    Step 1: Create an application credential in Azure

    This step creates an application and its service principal in the Azure portal and generates a client secret for API authentication. You will need to obtain the following credentials: Application (client) ID, Directory (tenant) ID, and the Value of the client secret.

    1. Create an application

      1. Log on to the Azure console.

      2. In the left-side navigation pane, select All services. In the Identity service category, click App registrations, or search for and go to App registrations in the top search bar.

      3. On the App registrations page, click New registration.

      4. On the application registration page, configure the following parameters and then click Register.

        • Name: Enter an easily recognizable name, such as aliyun-sasc-connector, for easier search and management later.

          Important

          This name will appear as the member name in the role assignment step later.

        • Supported account types: Configure the account scope that can access this application based on your permission requirements.

      5. After the application is created, the overview page displays the application information. Copy and save the Application (client) ID and Directory (tenant) ID. You will use them in subsequent steps.

    2. Create a client secret

      1. On the application details page created in Step 1, click Manage in the left-side navigation pane, and then click Certificates & secrets.

      2. On the Client secrets tab, click + New client secret and configure the following parameters.

        • Description: Enter a description for this client secret.

        • Expires: The validity period of the client secret. We recommend that you set it to 180 days.

          Important

          Create a credential rotation plan and update the secret before it expires to avoid service disruptions caused by credential expiration.

      3. After you click Add, the Value of the client secret is displayed.

        Warning

        The Value of the client secret is visible only once at creation. After you leave this page, you cannot view it again. Copy and save it immediately before proceeding.

    Step 2: Grant subscription access to the application credential

    To ensure that Security Center can read asset information, you must assign read-only permissions for the Azure subscription to the application created in the previous step.

    1. Go to the Role assignment page.

      1. Log on to the Azure console.

      2. In the left-side navigation pane, select All services. In the General service category, click Subscriptions, or search for and go to Subscriptions in the top search bar.

      3. Click the name of the target subscription to go to the subscription details page. On the details page, click Access control (IAM).

        Note

        If you have not activated a subscription, create one first and select the required services.

      4. On the Access control (IAM) page, click Add in the upper-left corner and select Add role assignment.

    2. Assign a role: On the role assignment page, select the corresponding role and click Next.

      Feature

      Role

      Notes

      Host

      Reader

      None

      CSPM (CSPM)

      Reader

      None

      Agentic SOC

      To enable automated threat response (for example, integrating with Azure Firewall through Response Rules), you must additionally grant Microsoft.Network permissions. For more information, see Third-party cloud components (OpenAPI).

      Important

      You must complete the assignment for each role separately. Azure allows only one role assignment at a time.

      Agentless Detection

      • Reader

      • Disk Snapshot Contributor

      None

      On the Access control (IAM) page in the Azure portal, click Add role assignment, select the roles listed in the preceding table, and complete the assignment.

    3. Add members: Go to the Members management page, click Select members, and select the application created in Step 1.

      Note

      You can quickly search and locate the target application by application name.

      For the selected role Reader, assign access to User, group, or service principal.

    4. After confirming the members, click Review + assign in the lower-left corner to complete the authorization.

      Note

      The authorization may take a moment. Please wait.

    Step 3: Complete the onboarding configuration in Security Center

    1. Go to the authorization page

      1. Recommended path:

        1. Log on to the Security Center console.

        2. In the navigation pane on the left, select System Settings > Feature Settings. In the upper-left corner of the console, select the region where the assets to be protected are located: Chinese Mainland or Outside Chinese Mainland.

        3. On the Multi-cloud Configuration Management > Multi-cloud Assets tab, click Grant Permission, and then select Azure.

      2. Alternative entry points:

        On the following pages, in the Multi-cloud Service Access or Add Multi-cloud Asset section, find and click the Onboard or Authorize button below the image icon:

        • Assets > Host

        • Risk Governance > CSPM > Cloud Service Configuration Risk

        • Protection Configuration > Host Protection > Agentless Detection

    2. Configure access credentials

      1. In the Add Assets Outside Cloud panel, select the features to onboard and click Next.

        • Host: Allows Security Center to automatically discover and synchronize Azure host assets.

        • CSPM: Use Cloud Security Posture Management to scan the configurations of Azure cloud products to discover and manage configuration risks.

        • Agentic SOC: Works with the Response Rules Script orchestration feature to automate the handling of security event threats. For more information, see Third-party cloud components (OpenAPI).

        • Host Protection Agentless Detection: Detects security risks on Azure virtual machines, including vulnerabilities, baseline risks, and malicious files, without installing a client by using snapshot scanning.

      2. On the Submit AccessKey Pair page, enter the credential information that you created earlier.

        • Enter an AppID: Enter the Application (client) ID obtained from Azure app registration.

        • Enter a password: Enter the client secret obtained from Azure app registration.

        • tenant: Enter the Directory (tenant) ID obtained from Azure app registration.

        • Domain (Select Chinese Edition for China and International Edition for others): For 21Vianet users, select Chinese Edition.

    3. Configure the synchronization policy

      On the Policy Configuration page, configure the settings based on your management requirements:

      • Select region: Select the regions where the Azure assets to be onboarded are located.

        Note

        Asset data is automatically stored in the data center corresponding to the region selected in the upper-left corner of the Security Center console.

        • Chinese Mainland: Data center in Chinese Mainland.

        • Outside Chinese Mainland: Data center in Singapore (Singapore).

      • Region Management: We recommend that you select this option. After you select this option, assets in new regions added to this Azure account in the future will be automatically synchronized without manual configuration.

      • Host Asset Synchronization Frequency: Set the interval for automatically synchronizing Azure host assets. If you do not need synchronization, you can set it to Off.

        Note

        This parameter is required only when the onboarded features include Host.

      • Cloud Service Synchronization Frequency: Set the interval for automatically synchronizing Azure cloud product configurations. If you do not need synchronization, you can set it to Off.

        Note

        This parameter is required only when the onboarded features include Cloud Security Posture Management.

      • AK Service Status Check: Set the interval for Security Center to automatically check the validity of the Azure account credentials. You can select Off to disable the check.

    4. After the configuration is complete, click Synchronize Assets. The system automatically synchronizes data from the Azure account to Security Center.

    Step 4: Verify that Azure assets are onboarded

    After completing the onboarding configuration, verify that Azure assets appear in Security Center:

    1. Wait for the initial data synchronization to complete. This may take a few minutes.

    2. Go to Assets > Host and filter by Azure to confirm that Azure host assets appear.

    3. If you onboarded CSPM, go to Risk Governance > CSPM > Cloud Service Configuration Risk and filter by Azure to confirm that Azure cloud resources appear.

    Azure advanced configuration (Agentic SOC)

    Note

    For more information, see the official Azure documentation: Azure permissions for networking and Create custom roles in Azure.

    1. Go to the custom role creation page

      1. Log on to the Azure console.

      2. In the left-side navigation pane, select All services. In the General service category, click Subscriptions.

        Note

        Alternatively, search for Subscriptions in the top search bar and click to go directly.

      3. Click the name of the target subscription to go to the subscription details page. On the details page, click Access control (IAM).

      4. On the Access control (IAM) page, click Add and select Add custom role.

    2. Enter basic information

      1. Custom role name: Enter an easily recognizable name, such as aliyun-agentic-soc-role, for easier search and management later.

      2. Baseline: Select Start from scratch.

    3. Assign permissions

      1. On the Permissions tab, click Add permissions.

      2. Search for the Microsoft.Network permission at the top and click the permission name.

      3. On the permissions page, select all permissions under Actions and click Add.

    4. After configuring the permissions, click Review + create. Confirm the information and click Create.

    Manage onboarded assets

    Host

    Go to the Assets > Host page. In the Add Multi-cloud Asset section, click the image icon to view the onboarded Azure hosts. You can follow the steps below to apply in-depth protection and management to the onboarded hosts.

    Note

    For more information, see Manage servers.

    1. Install the agent: Install the Security Center agent on the Azure hosts. When you run the installation command, select Azure for Service Provider. For detailed steps, see Install the agent.

    2. Upgrade to obtain full protection: The default Free edition provides only basic security detection. To obtain full security protection capabilities (such as anti-virus, vulnerability fixing, and intrusion prevention), bind a paid edition (Anti-virus or higher) to the Azure hosts. For detailed steps, see Manage host and container security quotas.

    CSPM

    Go to the Assets > Overview > Cloud Product page. In the All Alibaba Cloud Services navigation pane on the left, click Azure to view the onboarded Azure assets. For onboarded Azure assets, you can use the following CSPM features:

    Note

    For more information, see View cloud service information.

    1. Run configuration risk checks: Check for configuration risks in Azure products. For detailed steps, see Set up and run cloud platform configuration risk check policies.

    2. Handle risk items: View and fix failed risk check items based on the check results to improve the compliance and security of cloud assets. For detailed steps, see View and handle failed cloud platform configuration risk checks.

    Agentic SOC

    Go to Agentic SOC > Response Rules. When you create a custom playbook, you can select the Azure component from Third-party cloud components (OpenAPI) to automate the handling of detected Azure asset security events.

    Host Protection Agentless Detection

    Go to Protection Configuration > Host Protection > Agentless Detection. On the Server Check, Server Check, or Custom Image Check tab, in the Add Multi-cloud Asset section, click the image icon to view the scanned risk items. The following operations are available:

    1. Run detection tasks: Perform multi-dimensional security detection on Azure servers for vulnerabilities, malicious software, configuration baselines, sensitive files, and other security dimensions to discover potential security risks.

    2. Analyze and handle risks:

      1. Vulnerability risks: Supports Add to Whitelist.

        Warning

        Agentless detection does not support fixing vulnerabilities.

      2. Baseline check risks: Supports Add to Whitelist.

      3. Malicious sample risks and sensitive file risks: Supports Add to Whitelist, Manually Handled, Mark as False Positive, and Ignore.

    Costs and risks

    • Costs: The default Free edition of Security Center provides only basic security detection. To obtain full security protection capabilities, such as anti-virus, vulnerability fixing, and intrusion prevention, you must bind a paid edition (Anti-virus or higher) license to the onboarded Azure hosts.

    • Risks:

      • The client secret is a critical credential for connecting Azure and Security Center. If leaked, it may lead to unauthorized access to asset data.

      • If the client secret expires, asset synchronization and security detection will be interrupted. Safeguard the credential and create a regular rotation plan.

    FAQ

    • Why can't I see some onboarded Azure resources in Security Center?

      • Region not selected: In the onboarding configuration of Security Center, check whether you have selected the Azure region where the resource is located.

      • Synchronization delay: After initial onboarding or configuration changes, asset synchronization may be delayed. Wait for the synchronization to complete.

    • What should I do if automatic credential and permission validation fails after entering the credentials?

      • Permission issue: The client secret of the Azure application has expired. Refer to Create a client secret to create and save a new client secret, then update it in Security Center.

      • Region issue: The currently selected region is unavailable. Switch to another available region or the corresponding domain, and then submit again.