Description
The Wiz integration pushes Wiz **Issues**, **Detections**, and **Audit Logs** into Microsoft Sentinel in real time. Wiz sends data to a Data Collection Endpoint using the Wiz service principal, so there is no Azure Function to host and no shared keys to manage. This connector grants that service principal the least-privilege RBAC it needs; Wiz then creates the data collection rule and tables and begins pushing once you configure the integration in the Wiz portal.
- Declared status
- 1
- Declared author / publisher
- Wiz
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Subscription permissions
**Owner** or **User Access Administrator** at the subscription is required to create the custom role definition (Microsoft.Authorization/roleDefinitions/write).
Microsoft Entra permissions
Permission to read (and, if the Wiz enterprise application is not yet consented, create) the Wiz service principal in Microsoft Entra ID.
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
STEP 1 - Get the Wiz service principal object ID
ARM cannot resolve a Microsoft Entra object, so you supply the Wiz service principal **object ID**. This app registration is unique to your Wiz tenant — find your **Application (client) ID** on the Microsoft Sentinel integration setup screen in Wiz (**Settings > Integrations > Add > Microsoft Sentinel**), then substitute it for `WIZ_APP_ID_HERE` below. In Azure Cloud Shell (no local install required; creating the service principal needs permission to register enterprise applications in Microsoft Entra ID) run the line below. It prints the **service principal object ID** — copy that value into the deployment parameter. It creates the service principal first if it does not yet exist in your tenant:
```bash
WIZ_APP_ID="WIZ_APP_ID_HERE" # Application (client) ID from the Wiz Microsoft Sentinel integration setup screen
az ad sp show --id "$WIZ_APP_ID" --query id -o tsv 2>/dev/null \
|| az ad sp create --id "$WIZ_APP_ID" --query id -o tsv
```
If the command fails, rerun it without `2>/dev/null` to see the full error.
STEP 2 - Grant Wiz the RBAC
Deploy the custom role and assignment into the resource group that hosts this workspace. Paste the object ID from Step 1 (and, optionally, a Data Collection Endpoint resource ID).
1. Click **Deploy the Wiz RBAC role**:
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FWiz%2FData%20Connectors%2Fazuredeploy_WizSentinelIntegration.json)
2. Select the **Subscription** and the **Resource group** that hosts this workspace.
3. Enter **wizPrincipalObjectId** (from Step 1); optionally **dataCollectionEndpointId**.
4. **Review + create**.
Workspace Resource ID
STEP 3 - Configure the integration in Wiz
In Wiz, go to **Settings > Integrations > Add > Microsoft Sentinel**. Paste your **Tenant ID**, **Workspace Resource ID**, and **Data Collection Endpoint Resource ID**, tick *Deployment completed*, and save. Wiz then creates the data collection rule and tables and begins pushing Issues, Detections, and Audit Logs into this workspace.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
WizSentinel
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC