Skip to main content

Onboarding flow

This article walks through the SaaS onboarding flow for connecting Azure environments to Upwind. With SaaS, Upwind hosts and manages all Cloud Scanner infrastructure in its own Azure tenant; you only provision the identities and role assignments that allow Upwind to access your subscriptions.

For a higher-level explanation of the SaaS model and how scans run end-to-end, see Overview and Architecture.

Before you start​

Review the Prerequisites and confirm your Azure environment meets them.

Integration steps​

  1. Log in to the Upwind Management Console .
  2. Select the + (plus) symbol at the top of the screen and select Connect cloud account.
  3. Choose Azure.
  4. Follow the detailed steps below.

The SaaS onboarding flow is organized into four steps, all completed from the Onboarding center in the Upwind Management Console .

Step 1: Connect your environment​

Step 1.1: Connection setup​

Define your connection scope. First, choose how much of your Azure environment to connect:

  • Tenant: connect the entire Azure tenant, covering every subscription under it.
  • Management Group: connect only the subscriptions within the management groups you select.
  • Subscription: connect only the specific subscriptions you select.

Enter the identifier that allows Upwind to locate your Azure environment and map its structure during onboarding:

  • Tenant ID: the unique identifier of your Microsoft Entra tenant, containing all subscriptions and users in your organization. Found in the Azure portal under Microsoft Entra ID > Overview.
Cloud Scanners Setup​

Choose your deployment model: with SaaS, Upwind manages the infrastructure on your behalf, while Outpost deploys scanners directly within your own environment. In both models, Upwind manages the scanner lifecycle and operation. Select SaaS.

To learn more about the SaaS and Outpost models, see Azure deployment models.

  • Designate an Orchestrator Subscription: choose the Azure subscription where Upwind will store scan snapshots, and enter its Azure Subscription ID. A designated resource group is created in this subscription, where Upwind has permissions to create and delete snapshots - scoped exclusively to that resource group.

    warning

    For SaaS deployments, the Orchestrator Subscription must not be deleted. Removing it will disconnect Upwind from the environment.

Deployment method​

Defines how Upwind is deployed into your environment. Select the deployment method that matches your setup - Terraform or Azure Resource Manager templates - then click Next to continue. Step 3 below differs depending on the method you choose.

Step 2: Readiness check​

Before starting onboarding, run the script below in your terminal to validate required Azure permissions and configuration. It will highlight missing access so you can resolve issues before proceeding.

The Upwind Management Console generates a snippet pre-populated for your environment. Copy it and run it in your terminal:

important

Log in to your Azure tenant via your terminal (az login) with the identity you will use for onboarding before running this script.

curl -fsSL https://get.upwind.io/upwindctl.sh | bash
source "$HOME/.upwindctl/env"
az login
upwindctl azure onboarding preflight --is-saas --tenant-id <tenant-id>

If everything passes, click Next to continue. If the script reports missing access or configuration, resolve the issues and re-run it before proceeding.

tip

For full details on the prerequisites the script verifies, see Prerequisites.

Step 3: Grant permissions​

In this step you configure the scanner capabilities you want enabled and provision the Azure roles that allow Upwind to access and scan your subscriptions.

Step 3.1: Set required permissions​

Expand your security coverage by enabling additional scanning capabilities:

  • Data security: scan buckets, databases, and file systems to detect sensitive data across your cloud environment.

Step 3.2: Assign the required Azure roles​

Provision the necessary Azure roles to enable Upwind to access and scan your subscriptions. By assigning these roles, you allow Upwind to automatically provision a Service Principal - or use an existing one in your Entra tenant - and assign the permissions required for scanning your environment.

Choose how the Upwind Service Principal is provisioned:

  • Create a new Service Principal: the default. The deployment creates the required identities in your Entra tenant and assigns their roles. The option is labeled Create a new Service Principal (via Terraform) or Create a new Service Principal (via ARM) to match the deployment method you selected in Step 1.
  • Use an existing Service Principal: bring your own identities instead. Enter the Onboarding Service Principal Object ID and the Scanner Service Principal Object ID of the existing service principals you want Upwind to use.

Then select the deployment method you chose in Step 1 and follow the steps in that tab.

Copy or download the Terraform template provided in the console and paste it into a file named main.tf.

note

All required parameters have already been injected into the Terraform module for you - no manual input is needed.

main.tf
provider "azurerm" {
  # For detailed instructions on configuring the Azure provider, see:
  # https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
  features {}
}

module "upwind_azure_onboarding" {
  source = "https://get.upwind.io/terraform/modules/azure-onboarding/azure-onboarding-latest.tar.gz"

  # Upwind Credentials
  upwind_client_id     = "" # Upwind client credentials ID
  upwind_client_secret = "" # Upwind client credentials secret

  # Cloud Scanner Credentials
  scanner_client_id     = "" # Cloud Scanner credentials ID
  scanner_client_secret = "" # Cloud Scanner credentials secret

  # Upwind Organization Info
  upwind_organization_id = "" # Upwind Organization ID

  # Azure Organization Info
  azure_management_group_ids = [""] # Azure tenant ID

  # Subscription to act as the orchestrator
  azure_orchestrator_subscription = "" # Azure subscription ID for orchestrator
}

  • To establish the connection, run the following command:

    terraform init && terraform apply

Once the apply completes, click Validate & continue. Upwind verifies the deployment and the granted permissions. If validation fails, follow the error shown on screen to resolve the issue, then click Validate & continue again.

Step 4: Define scope​

The final step lets you define which Azure subscriptions are connected to Upwind and scanned by Cloud Scanners. For full protection, scanning all subscriptions is recommended, or limit scanning to specific subscriptions for targeted coverage. Scopes can be modified later in the organizations and accounts settings.

  • Choose the default behavior for subscriptions that are discovered in your environment after onboarding: discover and scan them automatically, or discover them without scanning until you bring them into scope.
  • Review the table of discovered subscriptions and select the ones you want to bring into scope. With SaaS, the Cloud Scanner runs in the Upwind environment; enabling scanning for a subscription authorizes Upwind to scan it.
  • Complete the onboarding, then continue to explore the Upwind Management Console or navigate to the Onboarding Center.

You're now fully connected to Upwind through the SaaS deployment model and protected across the selected Azure subscriptions.

Next steps​

  • See Architecture for the end-to-end scan flow once your environment is connected.
  • Learn more about how Upwind scans your subscriptions in the Cloud Scanner documentation, in the Components section of the Upwind Documentation Center.
  • Visit the Organizations and accounts settings in the Upwind Management Console to review connectivity state per subscription.
  • If you experience any issues during onboarding, see Troubleshooting.