Azure
Azure organizational onboarding enables the tenant to seamlessly connect its Azure subscriptions to Upwind, providing centralized visibility, control, and protection across all resources.
Deployment models
SaaS
Upwind hosts and manages the Cloud Scanner infrastructure in its own Azure tenant. You only provision the identities and role assignments needed to grant Upwind cross-tenant access to your subscriptions. Snapshots are still created and deleted within your tenant at runtime, but the scanner compute runs on Upwind's side.
What you deploy in your environment is limited to Microsoft Entra identities and Azure role assignments - there are no scanner virtual machine scale sets, Key Vaults, or scanner-related managed identities. Because the scanner workloads run on the Upwind side, scanner compute quotas in your subscriptions do not apply to the install, the scanner compute cost sits with Upwind, and Upwind operates and scales the scanner fleet.
Outpost
Cloud Scanners are deployed and run inside your own Azure environment. Upwind provisions the scanner stack (worker virtual machine scale sets, scaling components, a Key Vault, managed identities, and supporting custom roles) into the orchestrator subscription you designate, and the platform interacts with those scanners through the role assignments created during onboarding. All scanner workloads run inside your tenant, so no customer data is read into Upwind-managed subscriptions at scan time.
SaaS vs Outpost
| Consideration | SaaS | Outpost |
|---|---|---|
| Data leaves customer environment | Yes (ephemeral snapshot copy) | No |
| Scanner compute billed by | Upwind subscription | Your Azure subscription |
| Deployment in customer environment | Identities and role assignments only | Scale sets, Key Vault, managed identities, supporting resources |