Microsoft Defender for Cloud

Agentless Data Collection

4 September 2026Doc update+2 / −2 lines

In brief

The agentless data collection documentation now links AWS permission instructions to the AWS setup section and GCP permission instructions to the GCP setup section.

What Defender admins need to know

Administrators configuring agentless data collection can use the updated links to reach the relevant connector instructions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Defender for Cloud used specific roles and permissions to perform agentless scanning.

In Azure, these permissions are automatically added to your subscriptions when you enable agentless scanning.
In AWS, these permissions are ~~added to the CloudFormation stack in your AWS connector~~added to the CloudFormation stack in your AWS connector.
In GCP, these permissions are ~~added to the onboarding script in your GCP connector~~added to the onboarding script in your GCP connector.

Azure permissions

@@ -51,8 +51,8 @@ Here's how agentless scanning works: Defender for Cloud used specific roles and permissions to perform agentless scanning.  - In Azure, these permissions are automatically added to your subscriptions when you enable agentless scanning.-- In AWS, these permissions are [added to the CloudFormation stack in your AWS connector](enable-agentless-scanning-vms.md#enable-agentless-scanning-on-aws).-- In GCP, these permissions are [added to the onboarding script in your GCP connector](enable-agentless-scanning-vms.md#enable-agentless-scanning-on-gcp).+- In AWS, these permissions are [added to the CloudFormation stack in your AWS connector](enable-agentless-scanning-vms.md#aws).+- In GCP, these permissions are [added to the onboarding script in your GCP connector](enable-agentless-scanning-vms.md#gcp).  ### Azure permissions