Defender for Cloud continuous export

Hey Tim, you can stream Defender for Cloud alerts/recommendations to a Log Analytics workspace in another subscription. We walked through this a few times – here’s a tried-and-true method we used, plus an alternative CLI/ARM approach if you need more automation.

Method 1: Azure Policy (recommended for cross-sub/MG‐wide deployments)

1. In the Azure portal, go to Policy > Definitions and find the built-in definition “Deploy export to Log Analytics workspace for Microsoft Defender for Cloud alerts and recommendations” (providers/Microsoft.Authorization/policyDefinitions/ffb6f416-7bd2-4488-8828-56585fef2be9).
2. Assign it at the Management Group or source subscription scope.
3. In the assignment parameters, set logAnalyticsWorkspaceResourceId to your target workspace’s full ARM ID: /subscriptions/<targetSubID>/resourceGroups/<targetRG>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>
4. Save the assignment. The policy will automatically create the continuous export config in each scoped Defender for Cloud environment.
5. Grant the Defender for Cloud service principal (the “Continuous Export” identity) Log Analytics Contributor (or higher) on the target workspace so it can ingest data cross-sub.

Method 2: Azure CLI / ARM template

1. Make sure the target LAW is pre-created in the other subscription and you’ve assigned the export identity the right role on it.
2. Use the Azure CLI on the source subscription to create the export:

   
      az login
   
      az account set --subscription "<sourceSubID>"
   
      az security continuous-export create \
   
        --name ExportToRemoteLAW \
   
        --resource-group "<sourceRG>" \
   
        --location "<AzureRegion>" \
   
        --target-workspace-resource-id "/subscriptions/<targetSubID>/resourceGroups/<targetRG>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>" \
   
        --export-recommendations true \
   
        --export-alerts true
   
   

3. You should see the new export under Defender for Cloud > Environment settings > Continuous export.

Key things that catch folks:

• Make sure you’ve granted the “Continuous Export” service principal (in AAD) the Log Analytics Contributor role on the remote workspace.

• If you’re using Azure Policy, the policy will handle the export resource creation for you.

• Exports only pick up new or updated alerts/recommendations after the config is in place – past data isn’t backfilled.

Hope that helps you get cross-subscription exports up and running!

Reference list

• Export security alerts and recommendations (Continuous export) https://docs.microsoft.com/azure/security-center/continuous-export
• Deploy export to Log Analytics workspace policy https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Fffb6f416-7bd2-4488-8828-56585fef2be9
• Troubleshoot continuous and CSV exports https://docs.microsoft.com/azure/defender-for-cloud/continuous-export-troubleshoot
• Defender for Cloud REST API (Assessments & Alerts schemas) https://docs.microsoft.com/rest/api/securitycenter/alerts https://docs.microsoft.com/rest/api/securitycenter/assessments
• Role & permission requirements for exports https://docs.microsoft.com/azure/security-center/security-center-permissions

If the answer is helpful, kindly upvote it. If you have extra questions about this answer, please click "Comment".

Tim

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.

Seemed straightforward except step 5. I’m not sure about the Defender for Cloud service principal (the “Continuous Export” identity).

Could you provide more detail about adding Log Analytics Contributor (or higher) on the target workspace for the Defender for Cloud service principal. It seems you need this so it can ingest data cross-sub but I used a managed identity and not clear how to add Log Analytics Contributor for this service principal.

**Tim**Thank you for your reply.

The key point is:

There is not a standalone well-documented “Defender for Cloud Continuous Export service principal” that you manually search for in Microsoft Entra ID.

When you use the Azure Policy DeployIfNotExist method, the policy assignment managed identity is typically the identity that needs access to the remote Log Analytics workspace.

That managed identity must have RBAC permissions on the destination workspace in the other subscription so the export configuration can be deployed successfully.

According to the Microsoft documentation, continuous export requires write permissions on the target Log Analytics workspace.

Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export

Recommended Resolution

If you used Azure Policy with a managed identity, do the following:

Option: Grant the Policy Assignment Managed Identity Access

Step 1 — Locate the Managed Identity Used by the Policy Assignment

Go to Azure Portal

Open Policy

Select Assignments

Open your assignment for:

“Deploy export to Log Analytics workspace for Microsoft Defender for Cloud alerts and recommendations”

In the assignment, check the Managed identity section

You will usually see:

System-assigned managed identity, or

A user-assigned managed identity

That identity is what needs RBAC permissions on the destination workspace.

Step 2 — Grant RBAC on the Remote Log Analytics Workspace

Go to the target workspace in the destination subscription:

Open the target Log Analytics Workspace

Select Access control (IAM)

Click Add role assignment

Select role:

Log Analytics Contributor (recommended minimum)

Or Contributor if organizational policy requires broader access

Under Members, select:

the policy assignment managed identity

or the user-assigned managed identity used by the policy

Save

Step 3 — Verify Export Creation

After RBAC propagates:

Go to:

Defender for Cloud

Environment settings

Continuous export

Confirm the export was successfully created.

Validate data arrival in the destination workspace using:

SecurityAlert or SecurityRecommendation

Reference: https://docs.azure.cn/en-us/defender-for-cloud/continuous-export-view-data

Important Clarification

The Microsoft Learn documentation mainly states that the identity configuring export must have:

write permissions on the target workspace, and

appropriate workspace permissions.

https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export

In practice, when Azure Policy is used:

the policy assignment identity performs the deployment,

therefore, that identity needs access to the cross-subscription workspace.

So, if you used a managed identity in the policy assignment, that is the identity you grant RBAC to — not a hidden Defender for Cloud application.

Microsoft docs: -

1. Set up continuous export in Microsoft Defender for Cloud[]](https://learn.microsoft.com/en-us/azure/defender-for-cloud/continuous-export)
2. Set up continuous export with Azure Policy
3. Set up continuous export with REST API
4. View exported data in Azure Monitor

Tim

Following up to check if the resolution provided was helpful. Let us know if you need any further assistance.