↳ GitHub sourceConnector
Subscription-based Microsoft Defender for Cloud (Legacy)
Description
Microsoft Defender for Cloud is a security management tool that allows you to detect and quickly respond to threats across Azure, hybrid, and multi-cloud workloads. This connector allows you to stream your security alerts from Microsoft Defender for Cloud into Microsoft Sentinel, so you can view Defender data in workbooks, query it to produce alerts, and investigate and respond to incidents.
[For more information>](https://aka.ms/ASC-Connector)
- Declared status
- 1
- Declared author / publisher
- Microsoft
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions.
Workspace
Workspace
License
The connector is available for all deployments of Microsoft Defender for Cloud.
Subscription
[read security data](https://docs.microsoft.com/azure/security-center/security-center-permissions).
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Connect Microsoft Defender for Cloud to Microsoft Sentinel
Mark the check box of each Azure subscription whose alerts you want to import into Microsoft Sentinel, then select **Connect** above the list.
> The connector can be enabled only on subscriptions that have at least one Microsoft Defender plan enabled in Microsoft Defender for Cloud, and only by users with Security Reader permissions on the subscription.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
AzureSecurityCenter
Additional source files 1
Solutions/Microsoft Defender for Cloud/Data Connectors/AzureSecurityCenter.JSONsource ↗GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC