Connect a Microsoft Sentinel connected AWS account to Defender for Cloud

Microsoft Defender for Cloud generates a CloudFormation template that includes all of the resources necessary to onboard your Amazon Web Services (AWS) account to Defender for Cloud. However, Defender for Cloud and Microsoft Sentinel use the same authentication mechanism to connect to AWS accounts. When an AWS account is first connected to Microsoft Sentinel, Defender for Cloud can't connect to it as well.

This article guides you through the steps to connect your AWS account to Defender for Cloud and ensure it operates correctly.

Prerequisites

To complete the procedures in this article, you need:

• A Microsoft Azure subscription. If you don't have an Azure subscription, you can sign up for a free one.

• Microsoft Defender for Cloud set up on your Azure subscription.

• Access to an AWS account.

• Contributor level permission for the relevant Azure subscription.

Connect your AWS account to Defender for Cloud

The CloudFormation template provided by Defender for Cloud is needed to grant permission to Defender for Cloud to access you AWS account and resolve the conflict between the Defender for Cloud and Microsoft Sentinel.

1. Follow the steps in the Connect AWS accounts to Microsoft Defender for Cloud until step 5b in the Connect Defender Plans section.

2. Select Copy.

   

3. Paste the template into a local text editing tool.

4. Search for the ASCDefendersOIDCIdentityProvider": { section of the template, and make a separate copy of the entire ClientIdList.

5. Search for the ASCDefendersOIDCIdentityProvider section in the template and delete it.

6. Save the file locally.

7. In a separate browser window, sign in to your AWS account.

8. Navigate to Identity and Access Management (IAM) > Identity Providers.

9. Search for and select 33e01921-4d64-4f8c-a055-5bdaffd5e33d.

10. Select Actions > Add audience.

11. Paste the ClientIdList section you copied in step 3.

12. Navigate to the Configure access page in Defender for Cloud.

13. Follow the Create a Stack in AWS instructions, and use the template you saved locally.

    

14. Select Next.

15. Select Create.

Next steps

• Assign access to workload owners.
• Protect all of your resources with Defender for Cloud.
• Set up your on-premises machines and Google Cloud Platforms (GCP).
• Get answers to common questions about onboarding your AWS account.
• Troubleshoot your multicloud connectors.