← All integrations
Cloud · integration
Azure
Storage, network, Key Vault, Defender for Cloud, log retention and India residency for an Azure subscription.
ISO 27001SOC 2PCI DSSCERT-InDPDPARBISEBI CSCRFIRDAI
What ProofLayer proves
Read-only evidence, evaluated against versioned rules.
- Storage enforces HTTPS/TLS 1.2, no public blobs, network default-deny, disabled shared keys and customer-managed keys
- No management ports open to the Internet; Key Vaults have soft-delete/purge protection and are off the public Internet
- Defender for Cloud (servers, storage, SQL) is on standard and a security contact is configured
- Log Analytics retains logs 180+ days and resources stay in Indian regions
Configure in ProofLayer
Live in minutes.
- Connections → New connection → pick this provider and name the account.
- Enter the directory (tenant) ID and application (client) ID, and paste the client secret (stored write-only).
- Click Test connection — ProofLayer verifies read access from the control plane and reports a clear reason if anything is off.
- Set the scan schedule; every run appends to the evidence chain for this account.
- Choose the framework mapping(s) and, optionally, a push target (CISO Assistant, a Jira/ServiceNow ticket on failure, or a scheduled auditor pack).
Grant access from your side
Read-only, least-privilege, revocable.
You create the access in your own console and paste a credential ProofLayer stores sealed — it never writes to your systems.
- Register an app in Entra ID and create a client secret (pasted write-only).
- Assign the app Reader and Security Reader on the subscription (Access control → role assignments).
- ProofLayer exchanges the secret for a one-hour ARM token per run.
In-account agent option. Run the agent with the app registration in AZURE_* environment variables; the secret stays on your host. The collector posts evidence outbound-only, so ProofLayer holds no credential into your environment.