Daily Defender News
Aboutmerill.net
Microsoft Defender EASM
Vulnerabilities and exposure

Configure Defender EASM data connections for Log Analytics and Azure Data Explorer

4 September 2026Doc update+42 / −26 lines

In brief

The page now better explains asset data and attack surface insights, refreshes configuration guidance and screenshots, and explicitly calls out assigning required roles to the EASM API service principal for Log Analytics.

What Defender admins need to know

Administrators configuring connections should follow the clarified permission and data-content guidance to avoid setup issues.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Use data connections in Defender EASM

This article discusses the data connections feature in Microsoft Defender External Attack Surface Management (Defender EASM).

The data connector sends Defender EASM asset data to two different platforms: Log Analytics and Azure Data Explorer. You need to export Defender EASM data to either tool. Data connections are subject to the pricing model for each respective platform.

Log Analytics provides security information and event management and security orchestration, automation, and response capabilities. Defender EASM asset or insights information can be used in Log Analytics to enrich existing workflows with other security data. This informationDefender EASM asset and insights data can supplement firewall and configuration information, threat intelligence, and compliance data to provide visibility into your external-facing infrastructure on the open internet.

You can:

Whether you're building custom reports with Power BI or hunting for assets that match precise KQL queries, exporting Defender EASM data to Azure Data Explorer enables you to use your attack surface data with endless customization potential.

DataChoose data content options for data connections

Defender EASM data connections offer you the ability to integrate two different kinds of attack surface data into the tool of your choice. You can elect to migrate asset data, attack surface insights, or both data types. Asset data provides granular details about your entire inventory. Attack surface insights provide immediately actionable insights based on Defender EASM dashboards.

Asset data: The Asset Data option sends data about all your inventory assets to the tool of your choice. This option is best for use cases where the granular underlying metadata is key to your Defender EASM integration. Examples include Microsoft Sentinel or customized reporting in Azure Data Explorer. You can export high-level context on every asset in inventory and granular details specific to the particular asset type.

ThisThe Asset Data option doesn't provide any predetermined insights about the assets. Instead, it offers an expansive amount of data so that you can find the customized insights you care about most.

Attack surface insights: Attack surface insights provide an actionable set of results based on the key insights delivered through dashboards in Defender EASM. ThisThe Attack surface insights option provides less granular metadata on each asset. It categorizes assets based on the corresponding insights and provides the high-level context required to investigate further. ThisThe Attack surface insights option is ideal if you want to integrate theseDefender EASM's predetermined insights into custom reporting workflows with data from other tools.

Configuration overviewsReview data connection configuration requirements

This section presentsThe following information describes general information on configuration.configuration requirements for Defender EASM data connections.

Access data connections

On the leftmost pane in your Defender EASM resource pane, under Manage, select Data Connections. ThisThe Data Connections page displays the data connectors for both Log Analytics and Azure Data Explorer. It lists any current connections and provides the option to add, edit, or remove connections.

Screenshot that shows the Data connections page with Log Analytics and Azure Data Explorer connectors and options to add, edit, or remove connections.

Connection prerequisites

To successfully create a data connection, you must first ensure that you've completed the required steps to grant Defender EASM permission to the tool of your choice. This processGranting Defender EASM permission to the destination tool enables the application to ingest your exported data. It also provides the authentication credentials needed to configure the connection.

Configure Log Analytics permissions

Perform the following steps to configure Log Analytics permissions for Defender EASM data connections.

  1. Open the Log Analytics workspace that will ingest your Defender EASM data or create a Log Analytics workspace.

  2. On the leftmost pane, under Settings, select Agents.

    Screenshot that shows the Log Analytics Agents settings pane with the workspace ID and primary key.

  3. Expand the Log Analytics agent instructions section to view your workspace ID and primary key. These values are used to set up your data connection.

Configure resource group role assignments

Assign the required roles to the EASM API service principal in the resource group that contains the Log Analytics workspace.

  1. On the leftmost pane, select Overview and navigate to the Resource group under Essentials on the main pane.
  2. Open the resource group that contains the Log Analytics workspace.
  3. On the leftmost pane, select Access control (IAM).
  4. Search and select the Reader role.
  5. Search and select the EASM API as the member for the role assignment. Screenshot that shows the Add role assignment page with the EASM API selected as the member for the Reader role.
  6. Be sure the Assignment type is Permanent and then click Review + assign.
  7. Repeat this andthe role assignment process to add the Monitoring Contributor, Log Analytics Contributor, and the Monitoring Metrics Publisher roles for the EASM API app.

Configure subscription resource providers

Register the required subscription resource provider before creating the Log Analytics data connection.

  1. Open the subscription that contains the Resource Group and Log Analytics workspace.
  2. On the leftmost pane, under Settings select Resource Providers.
  3. Search for microsoft.insights and register the provider. Screenshot that shows the Resource providers list with the microsoft.insights provider selected for registration.

Configure Azure Data Explorer permissions

Ensure that the Defender EASM API service principal has access to the correct roles in the database where you want to export your attack surface data. First, ensure that your Defender EASM resource was created in the appropriate tenant because creating the Defender EASM resource provisions the EASM API principal.

  1. Open the Azure Data Explorer cluster that will ingest your Defender EASM data or create an Azure Data Explorer cluster and database.

  2. On the leftmost pane, under Data, select Databases.

  3. Select Add Database to create a database to house your Defender EASM data.

    Screenshot that shows the Databases pane in Azure Data Explorer with the Add Database option to create a new database.

  4. Name your database, configure retention and cache periods, and select Create.

    Screenshot that shows the new database creation form with fields for name, retention period, and cache period.

  5. After your Defender EASM database is created, select the database name to open the details page. On the leftmost pane, under Overview, select Permissions. To successfully export Defender EASM data to Azure Data Explorer, you must create two new permissions for the EASM API: user and ingestor.

    Screenshot that shows the Permissions page for the Azure Data Explorer database with options to add user and ingestor roles.

  6. Select Add and create a user. Search for EASM API, select the value, and choose Select.

A configuration pane opens on the right side of the Data Connections page. The following fields are required for each respective tool.

Add a Log Analytics data connection

For a Log Analytics connection, provide the following fields:

  • Name: Enter a name for this data connection.
  • Workspace ID: Enter the workspace ID for the Log Analytics instance where you want to export Defender EASM data.

Add an Azure Data Explorer data connection

For an Azure Data Explorer connection, provide the following fields:

  • Name: Enter a name for this data connection.
  • Cluster name: Enter the name of the Azure Data Explorer cluster where you want to export Defender EASM data.

    • Created: The date and time that the data connection was created.

    • Updated: The date and time that the data connection was last updated.

      Screenshot that shows the test connections details page.

  1. From this page, you can reconnect, edit, or delete your data connection.