Microsoft Sentinel
Cloud and workloads

Microsoft Sentinel CCF for Azure Government | Microsoft Learn

In brief

Microsoft added a guide covering prerequisites, Partner Center publishing, and Azure Government endpoint updates for Sentinel CCF data connector solutions.

What Defender admins need to know

Solution publishers targeting Azure Government should validate connector endpoints and provide the corresponding government-cloud values to help prevent connection failures.

Summaries are generated from the documentation change itself.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Microsoft Sentinel CCF for Azure Government | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/sentinel/isv/azure-government-publishing-guidelines breadcrumb_path: ../breadcrumb/toc.json feedback_help_link_url: https://learn.microsoft.com/answers/tags/423/microsoft-sentinel/ feedback_help_link_type: get-help-at-qna feedback_product_url: https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4 feedback_system: Standard learn_banner_products:


Microsoft Sentinel CCF for Azure Government | Microsoft Learn

Publish your Microsoft Sentinel codeless connector framework (CCF) solution to make it available to Azure Government customers in the content hub. As a solution publisher, review the connector endpoints and enable Azure Government availability in Microsoft Partner Center.

Before you begin, complete public-cloud publishing and confirm that you have the required Partner Center role.

Prerequisites

Prepare the CCF data connector for Azure Government

Most CCF polling, Google Cloud Platform (GCP), blob, and push data connectors don't need changes for Azure Government. However, check your connector instructions for references to public cloud endpoints. This check is especially important for CCF push connectors, whose instructions are more likely to reference those endpoints.

Update solution templates for Azure Government

If your CCF data connector references an Azure public cloud endpoint, add the corresponding Azure Government endpoint. Customers can then choose the appropriate endpoint for their environment.

Example: NordStellar (Push) connector

Screenshot of an example of a CCF Push data connector configuration with the public Azure Monitor OAuth scope highlighted.

The NordStellar CCF push connector instructions in the screenshot specify the OAuth bearer token scope https://monitor.azure.com//.default. This scope isn't valid in Azure Government and causes an authorization failure during connection setup. For Azure Government, customers must use https://monitor.azure.us//.default instead.

Include both endpoints in the connector instructions and identify the environment for each endpoint. This helps customers install and use the data connector and prevent connection failures.

The following table lists common Azure public cloud endpoints and their Azure Government equivalents:

ServiceAzure public cloud endpointAzure Government endpoint
Azure Resource Managerhttps://management.azure.comhttps://management.usgovcloudapi.net
Microsoft Entra IDhttps://login.microsoftonline.comhttps://login.microsoftonline.us
Log Analyticshttps://api.loganalytics.iohttps://api.loganalytics.us
Key Vaulthttps://<vault-name>.vault.azure.nethttps://<vault-name>.vault.usgovcloudapi.net
Storagehttps://<account>.blob.core.windows.nethttps://<account>.blob.core.usgovcloudapi.net
Azure Monitorhttps://monitor.azure.comhttps://monitor.azure.us
Azure portalhttps://portal.azure.comhttps://portal.azure.us

For a complete list of Azure services and their public and government endpoints, see Azure Government guidance for developers.

To update the CCF data connector's instructions, modify the connector content files and repackage the solution. For build and test guidance, see Develop a SIEM solution for Microsoft Sentinel. For packaging steps, see Package a SIEM solution for Microsoft Sentinel.

Before you enable Azure Government availability in Partner Center, make sure the updated package is merged into the Azure-Sentinel repository's master branch. Follow the packaging guide's merge requirements.

Enable Azure Government availability in Partner Center

After you confirm the solution template is ready for Azure Government, publish it from Partner Center. The Azure Government publishing procedure assumes you've already published the solution to the content hub in the public cloud. For first-time publishing instructions, see Build and publish Microsoft Sentinel SIEM solutions.

Azure Government availability can't be revoked after you publish the solution. Make sure you're ready to publish the offer to Azure Government before you enable availability.

Important

Partner Center recommends validating the solution in Azure Government whenever possible because service endpoints might differ. To stage and test the solution, request a trial account. Azure Government serves eligible US federal, state, local, and tribal customers and partners. As the publisher, you're responsible for applicable compliance controls, security measures, and best practices. For more information, see Azure Government.

To make the solution available in the Microsoft Sentinel content hub for Azure Government, follow these steps:

  1. In Partner Center, open your marketplace offer, go to Plan overview, and select the plan.

    Screenshot of the Partner Center Plan overview page showing the solution plan.

  2. On the Plan setup page, select Azure Government under Azure regions.

    Screenshot of the Partner Center Plan setup page with Azure Government selected under Azure regions.

  3. If you updated the solution templates for Azure Government, upload the latest package on the Technical configuration page. See Update solution templates for Azure Government.

    Screenshot of the Partner Center Technical configuration page with the uploaded solution package highlighted.

  4. Select Save draft, then Review and publish.

  5. On the Offer overview page, confirm that the offer shows Package provisioning (Azure Government) and Azure government links.

    Screenshot of the Partner Center Offer overview page showing successful Azure Government package provisioning and Azure Government links.

After publishing completes and the changes propagate, the solution appears in the Microsoft Sentinel content hub for Azure Government tenants.

Considerations

  • Some Azure services and features aren't available in Azure Government. Check Microsoft Sentinel feature availability for the latest support information.
  • If you need additional assistance publishing your Microsoft Sentinel SIEM solution to Azure Government, submit our intake form. \ No newline at end of file