Wiz for Microsoft Sentinel

STEP 1 - Get the Wiz service principal object ID

ARM cannot resolve a Microsoft Entra object, so you supply the Wiz service principal **object ID**. This app registration is unique to your Wiz tenant — find your **Application (client) ID** on the Microsoft Sentinel integration setup screen in Wiz (**Settings > Integrations > Add > Microsoft Sentinel**), then substitute it for `WIZ_APP_ID_HERE` below. In Azure Cloud Shell (no local install required; creating the service principal needs permission to register enterprise applications in Microsoft Entra ID) run the line below. It prints the **service principal object ID** — copy that value into the deployment parameter. It creates the service principal first if it does not yet exist in your tenant: ```bash WIZ_APP_ID="WIZ_APP_ID_HERE" # Application (client) ID from the Wiz Microsoft Sentinel integration setup screen az ad sp show --id "$WIZ_APP_ID" --query id -o tsv 2>/dev/null \ || az ad sp create --id "$WIZ_APP_ID" --query id -o tsv ``` If the command fails, rerun it without `2>/dev/null` to see the full error.

STEP 2 - Grant Wiz the RBAC

Deploy the custom role and assignment into the resource group that hosts this workspace. Paste the object ID from Step 1 (and, optionally, a Data Collection Endpoint resource ID). 1. Click **Deploy the Wiz RBAC role**: [](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FWiz%2FData%20Connectors%2Fazuredeploy_WizSentinelIntegration.json) 2. Select the **Subscription** and the **Resource group** that hosts this workspace. 3. Enter **wizPrincipalObjectId** (from Step 1); optionally **dataCollectionEndpointId**. 4. **Review + create**.

Workspace Resource ID

STEP 3 - Configure the integration in Wiz

In Wiz, go to **Settings > Integrations > Add > Microsoft Sentinel**. Paste your **Tenant ID**, **Workspace Resource ID**, and **Data Collection Endpoint Resource ID**, tick *Deployment completed*, and save. Wiz then creates the data collection rule and tables and begins pushing Issues, Detections, and Audit Logs into this workspace.