Glossary

Overview

This article lists the terms, parameters, and resources you encounter while onboarding an Azure environment to the SaaS deployment model. The terms follow the onboarding flow as it appears in the Upwind Management Console.

Step 1: Connect your environment

Term	Definition
Connection Scope	Determines how broadly to apply the connection: Tenant (every subscription), Management Group (one or more management groups), or Subscription (specific subscriptions only).
Tenant ID	The unique identifier of your Microsoft Entra tenant, containing all subscriptions and users in your organization. Found in the Azure portal under Microsoft Entra ID > Overview.
Orchestrator Subscription	The Azure subscription where Upwind stores scan snapshots. A designated resource group is created in this subscription, where Upwind has permissions to create and delete snapshots - scoped exclusively to that resource group. It must belong to the environment being connected. For SaaS deployments, the Orchestrator Subscription must not be deleted - removing it disconnects Upwind from the environment.
SaaS	The deployment model in which Upwind manages the Cloud Scanner infrastructure on your behalf, in Upwind-managed Azure subscriptions. See Architecture.
Outpost	The deployment model in which Cloud Scanners are deployed directly within your own Azure environment. See the Azure onboarding instructions.
Deployment method	Defines how Upwind is deployed into your environment: Terraform or Azure Resource Manager templates.

Step 2: Readiness check

Term	Definition
upwindctl	The Upwind command-line tool used to run the readiness check (and other Upwind operations) from your local machine. The preflight check is invoked through it.
Preflight script	The upwindctl azure onboarding preflight command run during the readiness check. For SaaS it is run with the --is-saas flag. Validates required permissions and configuration before onboarding proceeds.

Step 3: Grant permissions

Term	Definition
Onboarding Service Principal	The read-only Upwind identity in your Microsoft Entra tenant, used to fetch subscription and resource information for discovery and inventory.
Scanner Service Principal	The Upwind identity in your Microsoft Entra tenant used for the customer-side scan actions: creating snapshots, authorizing the cross-tenant snapshot copy, and cleaning up after the scan.
Create a new Service Principal	The default option. The Terraform module or ARM deployment creates the required identities in your Entra tenant and assigns their roles automatically.
Use an existing Service Principal	Bring-your-own option for organizations that manage identities centrally. You supply the object IDs of existing service principals for Upwind to use instead of creating new ones.

Terraform module variables

The Terraform snippet generated in Step 3 pre-populates these variables from the values you entered earlier. You do not normally need to edit them.

Variable	Definition
source	The location of the Upwind Azure onboarding Terraform module, for example https://get.upwind.io/terraform/modules/azure-onboarding/azure-onboarding-latest.tar.gz.
upwind_client_id	The client ID used to authenticate the connection request with the Upwind Authorization Service. Injected by Upwind during onboarding.
upwind_client_secret	The client secret paired with upwind_client_id. Injected by Upwind during onboarding.
scanner_client_id	The Cloud Scanner credentials ID, used by the scanning workflow to report results back to Upwind. Injected by Upwind during onboarding.
scanner_client_secret	The client secret paired with scanner_client_id. Injected by Upwind during onboarding.
upwind_organization_id	The identifier of your Upwind organization, used to associate the connected Azure environment with your Upwind tenant. Typically begins with org_.
azure_management_group_ids	The management group ID(s) that define the connection scope - for the tenant scope, the tenant root management group ID entered in Step 1.
azure_orchestrator_subscription	The Azure subscription ID of the subscription you designated as the orchestrator in Step 1.