Cloud Detection & Response on Azure

Overview

ARMO Cloud Detection & Response (CDR) for Microsoft Azure delivers continuous threat detection on your Azure environment. ARMO deploys a lightweight collector inside your Azure tenant that consumes the Azure Activity Log, evaluates every event against ARMO's CEL-based detection rules, and forwards only matched security alerts to the ARMO Platform, where they appear as Runtime Incidents.

Azure CDR uses the same detection rule engine as ARMO's AWS and GCP CDR, so detections, incident workflows, and custom rules behave consistently across your clouds.

📘

Cloud Detection and Response

To view all incidents related to your connected cloud environments, go to Runtime Incidents in the left navigation menu.

How It Works

1. In the ARMO onboarding wizard, you enter your subscription (or tenant) details and ARMO generates a ready-to-run az deployment command with every parameter pre-filled.
2. You run the command once in Azure Cloud Shell. It creates a Diagnostic Setting that streams the Activity Log to a dedicated Event Hub in your subscription.
3. An ARMO collector, running on Azure Container Apps in a dedicated resource group, consumes the Event Hub stream using a managed identity that the deployment creates and authorizes.
4. The collector evaluates every log event against ARMO's detection rules inside your subscription.
5. Only matched alerts, each carrying the single log record that triggered it, are sent to the ARMO Platform and surfaced as Runtime Incidents.

📘

Your logs stay in your tenant

Raw Activity Logs are processed by the collector in your own subscription and never leave your Azure tenant. Only detection alerts and the minimal context needed to investigate them are transmitted to ARMO.

📘

No credential is handed to ARMO

Unlike the Compliance (CSPM) connection, CDR needs no app registration, client secret, or custom role. The collector authenticates to Azure with its managed identity, and to ARMO with a per-connection access key that lives only inside your deployment. ARMO stores no Azure credential.

What ARMO Detects

ARMO ships a managed rule set covering suspicious and high-risk control-plane activity in your Azure Activity Log. Categories include, for example:

• Logging & defense evasion — diagnostic settings or Azure Policy assignments deleted, Microsoft Defender for Cloud plans or alert-suppression rules modified, Network Watcher or firewall/WAF policies deleted.
• Identity & privilege escalation — privileged RBAC role assignments, custom role definitions created or modified, Azure Arc-connected cluster credentials listed.
• Secrets & data access — Key Vault access-policy or configuration changes (and Key Vault deletion), storage account key listing or regeneration, blob public-access or ACL changes.
• Execution & persistence — VM run commands and execution-capable extensions, serial-console access, Automation runbooks or webhooks created or modified.
• Network exposure — Network Security Group or SQL server firewall rule changes, network packet capture.
• Destruction — deletion of resource groups, storage accounts, Key Vaults, VM snapshots, or restore-point collections.

Detection rules are written in CEL (Common Expression Language) and managed under Policies → Threat Detection in the ARMO Platform. You can also author your own rules. See Custom Rules.

Log Coverage & Cost

The CDR components run in your subscription, so their cost is billed to your Azure account:

• Event Hubs, charged by throughput units. Activity Log volume is typically modest.
• Container Apps, running the collector. The collector is lightweight.
• A small storage account, used by the collector to checkpoint its position in the stream.

Prerequisites

📘

Checking your access

Azure Portal → Subscriptions → your subscription → Access control (IAM) → View my access. If you lack Owner or User Access Administrator, ask a subscription Owner to grant it, or hand the generated command to an admin who has it.

Single Subscription Onboarding

Step 1: Start the Azure CDR connection in ARMO

1. In the ARMO Platform, go to Settings → Accounts → Azure and click Connect Azure.
2. Select the Cloud Detection & Response feature.
3. Under What will be the integration scope?, select Single Subscription and click Next.

Step 2: Enter the connection details

Step 3: Copy the deployment command

ARMO generates a ready-to-run az deployment sub create command with every parameter pre-filled. Click Copy.

🚧

The command contains a secret

The command includes the access key for this connection. Treat it as a secret and do not share it or store it in tickets or chat.

Step 4: Run the command in Azure Cloud Shell

1. Open Azure Cloud Shell (the >_ icon in the Azure Portal top bar), or any terminal signed in with az.

2. Make sure you are in the right subscription:

   Bash

   az account set --subscription <SUBSCRIPTION_ID>

3. Paste the command and run it. It usually takes a few minutes, and longer in some regions.

If the deployment fails because microsoft.insights is not registered, run the following, wait one to two minutes, and re-run the command:

az provider register -n microsoft.insights

Step 5: Return to ARMO

The connection appears in the accounts list as Pending and flips to Connected on the collector's first heartbeat, normally within a minute of the deployment finishing.

📘

The first detections can take a while

On a newly connected subscription, the first Activity Log events can take up to about 90 minutes to arrive, so a quiet first period with no incidents is expected. This is a documented Azure diagnostic-setting cold start, not a failure.

What the deployment creates in your subscription

• A resource group (armo-cdr) to hold the collector stack.
• An Event Hubs namespace and event hub that receive the subscription's Activity Log.
• A storage account the collector uses for stream checkpoints.
• A user-assigned managed identity with role assignments limited to receiving from the event hub and accessing the checkpoint storage.
• A Container App running the ARMO collector.
• A subscription-level diagnostic setting routing the Activity Log to the event hub.

Whole Tenant Onboarding

Connects your entire tenant, every subscription including ones created later, through a single central collector instead of onboarding subscriptions one by one. Detection still runs inside your tenant; only matched alerts are sent to ARMO.

📘

Scope

This flow covers the whole tenant (the Tenant Root Group). Connecting a specific intermediate management group is planned for a later release.

Step 1: Start the connection in ARMO

Click Connect Azure, select Cloud Detection & Response, choose Whole Tenant, and click Next.

Step 2: Enter the connection details

Step 3: Make sure you have the required permission

Assigning the tenant-wide policy and granting its remediation identity its roles requires Owner or User Access Administrator at the Tenant Root Group (Azure Portal → Management Groups → Tenant Root Group → Access control (IAM)), plus permission to deploy into the security subscription.

📘

Tip: temporary elevation

If you lack access across subscriptions, a Global Administrator can temporarily elevate: Microsoft Entra ID → Properties → Access management for Azure resources → Yes. Toggle it back to No after onboarding.

Step 4: Copy and run the deployment command

ARMO generates one ready-to-run command. Run it once, signed in to the security subscription:

az account set --subscription <SECURITY_SUBSCRIPTION_ID>
# paste the command generated by ARMO

The single command does everything:

• Deploys the central collector stack (shared Event Hub, Container App, storage) into the security subscription.
• Assigns an Azure Policy (DeployIfNotExists) at your Tenant Root Group and grants its remediation identity Monitoring Contributor at the Tenant Root Group and Azure Event Hubs Data Owner on the central Event Hub namespace.
• Kicks off remediation so every subscription's Activity Log routes to the central Event Hub, including subscriptions created later, with no re-onboarding.

The command usually takes a few minutes, and longer for tenants with many subscriptions or in some regions. Keep Cloud Shell open until it finishes. The tenant-wide fan-in then completes asynchronously and does not need Cloud Shell.

Step 5: Return to ARMO

The connection appears as Pending. Unlike a single subscription, a whole-tenant connection does not turn Connected on the collector's heartbeat alone — it stays Pending until the collector confirms that at least one subscription's Activity Log is routed to the central Event Hub. The subscription hosting the collector does not count, unless it is the tenant's only subscription.

📘

Expect up to about 35 minutes

A whole-tenant connection usually turns Connected within about 35 minutes of the deployment finishing, and occasionally takes longer. Most of the wait is Azure Policy remediation creating the diagnostic setting on your subscriptions. Separately, a subscription's first Activity Log events can take up to about 90 minutes after its diagnostic setting is created, so the first incidents can appear later than Connected.

How a whole-tenant connection appears

A Whole Tenant connection is a single entry in the accounts list. It is not expandable and shows no list of its subscriptions: you connect, monitor, and remove the tenant as one unit. It reaches Connected once at least one subscription is routed to the central collector (see Step 5), not on the collector's heartbeat alone. Connected does not mean every subscription is covered yet.

Connection Status

Permissions Reference

No write or administrative access to your workloads or data is requested.

After Onboarding

• New Activity Log events are evaluated continuously; matched detections appear under Runtime Incidents.
• Incidents include the triggering event, the identity involved, and the affected resource, with links to the relevant detection rule.
• Detection rules can be tuned, disabled, or extended under Policies → Threat Detection.

Removing the Integration

CDR runs a collector inside your Azure (and, for a whole tenant, an Azure Policy). Removing the connection in ARMO does not delete those, because ARMO has no access to your Azure. Removal is a two-step flow: run the cleanup command ARMO gives you, then remove the connection in ARMO.

🚧

Run the cleanup first

The cleanup command is generated from your stored connection details, so it is only available while the connection still exists in ARMO.

Single Subscription

1. In ARMO, go to Settings → Accounts → Azure and choose Remove on the connection. ARMO shows a cleanup command that deletes the collector's resource group (armo-cdr) and the subscription's Activity Log diagnostic setting.
2. Run it in Cloud Shell with the same access you used to onboard.
3. Confirm removal in ARMO.

Whole Tenant

The cleanup also removes the tenant-wide policy. Until it is removed, the policy keeps onboarding new subscriptions to the collector.

1. In ARMO, choose Remove. ARMO shows a cleanup command that cancels and removes the remediation, removes the policy, deletes the diagnostic settings it created across every subscription, removes the collector's role assignments, and optionally deletes the central collector stack.
2. Run it at the tenant scope with the same access you used to onboard.
3. Confirm removal in ARMO.

Troubleshooting