What the Microsoft Azure and Entra ID integration is for
Supports response for identities, resources, workloads and Microsoft Sentinel in Azure and Entra ID. Nova DRX applies your response policies and approval requirements before sending an action to Microsoft Azure and Entra ID.
The provider connection supplies a supported destination for DRX. It does not decide that an action is appropriate, expand the customer scope, or bypass the approval policy selected for the environment.
Supported customer outcomes
Nova DRX supports 5 actions for Microsoft Azure and Entra ID.
- Disable a Microsoft Entra user
- Restricts the selected user account after the required review and approval.
- Lock an Azure resource
- Applies an approved protection lock to the selected Azure resource.
- Remove an Azure role assignment
- Removes the selected access assignment from the approved resource scope.
- Stop an Azure virtual machine
- Stops the selected virtual machine after the required decision and approval.
- Send a case to Microsoft Sentinel
- Forwards an approved security summary to the selected Sentinel destination.
What remains under customer control
- The exact target and customer scope are confirmed before action.
- The action must be present in the supported DRX catalog and available in the connected provider environment.
- Configured approval and separation-of-duties requirements remain in force.
- A simulation or proposal is not treated as an executed provider outcome.
- The reported result and review history remain available after the action.
Questions to confirm before evaluation
- Which listed outcomes are required and which should remain disabled?
- Which provider plan, region, target types, and customer-owned access are available?
- Which outcomes require one approver, two-person review, or a manual-only decision?
- How will success, partial completion, failure, reversal, and follow-up be reviewed?