Before you begin onboarding, confirm the following requirements are in place.

• Active subscriptions to WithSecure Elements Endpoint Protection and Elements Endpoint Detection and Response.
• You must hold the WithSecure Elements Endpoint Protection administrator role during onboarding.

• You must be able to sign in as a Global Administrator on the Azure account to run the onboarding script in Azure Cloud Shell.
• Your Tenant ID and Subscription ID are known and ready. Find them in the Azure portal — see Get subscription and tenant IDs ↗.
• The subscription is assigned to an Azure Management Group. See Create a management group ↗ if needed.

Register your Azure tenant and configure the Identity Security capability in Elements Security Center.

Add the tenant

1. In Elements Security Center, go to Environment > Cloud > Microsoft Tenants and select Add Azure tenant.
2. On the Tenant information page, enter a Display name, paste your Tenant ID, and select your Organization. Select Next.
3. Set the Importance and Business context for risk evaluations. Select Next.

Connect Identity Inventory (required first)

1. Under Security capabilities, select Identity Inventory and then Connect now.
2. Read the introduction, select the checkbox to confirm, and select Start.
3. Grant the required permissions: if you are the Azure tenant administrator, select Accept Permissions. Otherwise, select Copy URL and send it to your Azure administrator.

Add Identity Security

1. Under Security capabilities, select Identity Security and then Add.
2. On the Connection details page, enter your Deployment Subscription ID, select a Deployment location, and enter an Email address for notifications (press Enter after typing to save it).
3. Select Download to save the WithSecure Elements XDR Identity Security for Entra ID.zip onboarding file.

Run the onboarding script in Azure Cloud Shell to deploy the Event Hub and diagnostic settings that forward Entra ID logs to WithSecure.

Prepare the Azure environment

1. In the Azure portal, temporarily elevate your access: go to your Default Directory > Properties and switch Access management for Azure resources to Yes. Sign out and back in for this to take effect. See Elevate access for a Global Administrator ↗ for full instructions.
2. Open Azure Cloud Shell with PowerShell. If this is your first time, you will be prompted to create a storage account instance.
3. Upload the .zip file you downloaded in Step 3 using Manage files > Upload at the top of the Cloud Shell screen.

Run the deployment script

• Decompress the package and change into the extracted directory:

unzip './WithSecure Elements XDR Identity Security for Entra ID.zip'
cd withsecure

• Assign the Owner role to the principal running the script (replace [userId] with your User Principal Name from Azure):

New-AzRoleAssignment -SignInName "[userId]" -Scope "/" -RoleDefinitionName "Owner"

• Deploy the resources:

./deploy.ps1

Add the Event Hub connection string to Elements Security Center, run the detection test, and finish onboarding by revoking elevated access.

Connect Azure to Elements Cloud

1. In Elements Security Center, go to Environment > Cloud > Microsoft Tenants and select your tenant.
2. On the Security capabilities page, select Add connection string.
3. Copy and paste the full connection string (starting with Endpoint=sb://) from the Azure CLI output and select Add.
4. When the status changes to The tenant is protected with a green tick, the connection is live.

Test the detection capability

• In Azure Cloud Shell, run the testing tool:

./WithSecureIdentitySecurityTestingTool.ps1

• Wait for the script to complete and confirm that app registrations were created and then deleted.
• In Elements Security Center, go to Events > Broad Context Detections and confirm a detection named WithSecure test detection add application appears. Close it once confirmed.

Finish onboarding — revoke elevated access

• Remove the Owner role assignment:

Remove-AzRoleAssignment -SignInName "[userId]" -Scope "/" -RoleDefinitionName "Owner"

• In the Azure portal, return to Default Directory > Properties and switch Access management for Azure resources back to No.