Skip to main content

​
Required Permissions

The user authorizing the Microsoft Defender for Cloud connection must have appropriate Azure permissions.

​
Azure Role-Based Access Control (RBAC)

This integration uses the Azure Management API (https://management.azure.com) to access Microsoft Defender for Cloud resources. The authorizing user needs Azure RBAC roles with permissions to view security assessments and recommendations.
Important: This integration uses delegated permissions with OAuth 2.0, meaning the user authorizes Leen to access resources on their behalf. Access is limited to what the authorizing user can view.

​
Required Azure Roles

Security Reader (Recommended for read-only access)
  • Can view security assessments, recommendations, and alerts
  • Can view security policies and security states
  • Read-only access to Microsoft Defender for Cloud data
  • Does not have permission to modify security settings
Security Admin
  • Has all Security Reader permissions
  • Can also update security policies and dismiss alerts
  • Can manage security recommendations
  • Use this role if Leen needs to perform write operations
Reader (Subscription level)
  • Can view all resources in the subscription
  • Includes read access to Microsoft Defender for Cloud data
  • Broader read access than Security Reader
Owner or Contributor (Subscription level)
  • Full access to manage all resources including security settings
  • Use only if the integration requires extensive access

​
Assigning Azure Roles

To assign Azure roles:
  1. Go to https://portal.azure.com
  2. Navigate to Subscriptions
  3. Select the subscription you want to grant access to
  4. Click Access control (IAM)
  5. Click Add > Add role assignment
  6. Select the appropriate role (e.g., Security Reader)
  7. Select the user and click Save
Recommendation: Use a Security Reader role for the authorization in step 2 to ensure Leen can access all Microsoft Defender for Cloud security assessments and recommendations without granting write permissions.

​
Key Points

  • This integration uses delegated permissions (user context), not application permissions
  • The authorizing user must have appropriate Azure RBAC roles assigned at the subscription level
  • Access is scoped to the subscriptions the user has permissions for
  • Uses OAuth 2.0 with refresh tokens for long-lived access

​
Microsoft Defender for Cloud App

To integrate with Microsoft Defender for Cloud, users will have to authorize Leen’s Microsoft Defender for Cloud app, which is an OAuth2 app. This will allow Leen to access the appropriate Microsoft Defender resources in the organization’s account. Leen takes care of the OAuth2 code-flow and access token management, so you don’t have to worry about it.

​
Onboarding

Follow the steps below to onboard your environment to our Microsoft Defender for Cloud app.
1

Create Microsoft Defender for Cloud Connection

With your Leen API Key and your Customer’s Org ID, make a API request to create a new Microsoft Defender for Connection. More information can be found on the API Reference page.
The response will look like this:
2

Granting permission to Leen app for Microsoft Defender for Cloud

Open the oauth2_authorize_url from the previous step in a new tab. This will prompt the admin user to authorize Leen’s Microsoft Defender for Cloud app to access their Microsoft Defender resources.Microsoft Defender-authOnce the user has authorized the app, they will be redirected to Leen on a successful authorization.Microsoft Defender-auth-success
3

Pull Data

Now that the user has authorized the app, you can pull data from Microsoft Defender for Cloud using the connection_id from the first step. More information can be found on the API Reference page.