> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/deployment/cdr-for-azure/deployment/introduction-architecture-and-requirements.md).

# Introduction, architecture, and requirements

## Introduction

CDR for Azure offers advanced threat detection and response coverage for your Microsoft Azure tenants. Vectra AI is providing this guide to help their customers deploy this solution to leverage this coverage. To do this, Vectra AI needs to ingest your Microsoft Azure tenant platform logs, and following this deployment you will have:

* **Azure Detections** - High fidelity detections of malicious behaviors in your Azure tenants based on our proprietary ML and security analytics capabilities.
* **Azure Threat Surface Dashboard** - Insights to help you identify security related threat patterns in your Azure tenants.
* **Azure Investigate** - Curated Azure metadata that allows you to perform in-depth investigations on potential threats in your Azure tenant. This data consists of enriched metadata fields and all the existing *Investigate* capabilities to help you efficiently conduct an investigation.

This guide will enable you to configure the Azure Data Source connector in your Vectra AI Platform. It also provides you with the details to ensure your Azure tenant platform logs are being forwarded to dedicated storage accounts accessible to the Vectra AI Platform for data ingestion.

## Architecture Overview

This Data Source leverages Activity logs and Diagnostic Resource logs to detect suspicious activity in your environment. This logging is managed by Azure Monitor but is not enabled by default in Azure environments.

This deployment guide will help you grant Vectra access to the data it requires to offer comprehensive detection coverage and, if required, to deploy broad logging in your Azure environment.

![](/files/d637206b1aba3bc03ba0fb49b66304d64c6611ee)

* Subscriptions and Resources in your environment log to Storage Accounts in your Azure tenant.
* Vectra leverages a role in your environment to periodically scan these storage accounts.
* When new logs are detected, Vectra copies these logs to the Vectra cloud.
* Vectra processes these log events through proprietary algorithms to generate detections.

## General Requirements

* Vectra Respond UX tenant.
* Azure permissions required only during deployment:
  * Granting Vectra access to your Azure tenant (Consent Workflow):
    * Global Administrator
  * Setup logging and grant Vectra access to the logs (Log Enablement Workflow):
    * Global Administrator
    * Resource Policy Contributor at management group level
    * User Access Administrator at management group level
      * This can be a temporary privilege elevation used only during log enablement.
  * Full list of ongoing Azure permissions required are in [Appendix 1 - Azure configuration notes](/deployment/cdr-for-azure/deployment/appendix-1-azure-configuration-notes.md).
* Choose one of the below methods for deployment:
  * Automated Deployment via ARM template – Step specific prerequisites (if required) are listed in each step of the [Automated deployment](/deployment/cdr-for-azure/deployment/automated-deployment.md) section.
  * Manual Deployment – Some customers prefer to deploy without using the automated deployment process that uses ARM templates or may already have a logging setup that can be used with Vectra CDR for Azure. Please see [Manual deployment](/deployment/cdr-for-azure/deployment/manual-deployment.md) for requirements and guidance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.vectra.ai/deployment/cdr-for-azure/deployment/introduction-architecture-and-requirements.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.