Modify the connector for Azure

The following document describe how to modify the Azure connector configuration after it has been configured for the first time. If you encounter errors, see the Troubleshooting section.

Before you begin

Make sure you have the permissions described in Connect to Azure for configuration and resource data collection.

Edit the Azure connector

You can change the location and subscriptions collected by the connector and the user-assigned managed identity. The following fields cannot be modified:

• Azure tenant ID
• Service agent ID

To change the values of these fields, you must delete the Azure connector and set up a new connection.

1. Open the Connectors tab on the Settings page.

   Go to Connectors

2. Select the organization where you activated Security Command Center Enterprise.

3. In the Connectors table > Azure row, click more_vert **More options > Edit.

4. On the Configure connector page, you can change the following configuration:

   • Azure subscriptions
   • Azure locations
   • Grant permissions for Sensitive Data Protection discovery

5. Click Continue

6. On the Connect to Azure page, you can change the following configuration:

   • Managed identity client ID
   • Managed identity object ID

7. Click Continue, .

8. In the Test connector page, click Test Connector to verify that Security Command Center can connect to the Microsoft Azure environment.

   If the connection is successful, the Google Cloud service agent assumes the Microsoft Azure user-assigned managed identity and has the required Microsoft Azure and Microsoft Entra permissions. If the connection isn't successful, see Troubleshooting errors when testing the connection.

9. Click Save. The Connectors page appears.

Delete the Azure connector

1. Open the Connectors tab on the Settings page.

   Go to Connectors

2. Select the organization where you activated Security Command Center Enterprise.

3. In the Connectors table > Azure row, click more_vert More options > Delete.