cloud_azure_tenant

This data source provides information about a single Azure Tenant registered in Falcon Cloud Security. Look the tenant up by its Azure tenant ID or by its Falcon Cloud Security registration ID, and reference its attributes in other resources.

The tenant’s Event Hub settings are returned in eventhub_settings. They are managed by the crowdstrike_cloud_azure_tenant_eventhub_settings resource.

API Scopes

The following API scopes are required:

• Cloud security Azure registration: READ

Example Usage

terraform {
  required_providers {
    crowdstrike = {
      source = "registry.terraform.io/crowdstrike/crowdstrike"
    }
  }
}

provider "crowdstrike" {
  cloud = "us-2"
}

# Look up a tenant by its Azure tenant ID (directory ID).
data "crowdstrike_cloud_azure_tenant" "by_tenant_id" {
  tenant_id = "00000000-0000-0000-0000-000000000000"
}

# Look up a tenant by its Falcon Cloud Security registration ID.
data "crowdstrike_cloud_azure_tenant" "by_registration_id" {
  registration_id = "abcd1234-0000-0000-0000-000000000000"
}

output "azure_tenant" {
  value = {
    registration_id = data.crowdstrike_cloud_azure_tenant.by_tenant_id.registration_id

    cs_infra_subscription_id = data.crowdstrike_cloud_azure_tenant.by_tenant_id.cs_infra_subscription_id
    cs_infra_location        = data.crowdstrike_cloud_azure_tenant.by_tenant_id.cs_infra_location

    realtime_visibility_enabled = data.crowdstrike_cloud_azure_tenant.by_tenant_id.realtime_visibility.enabled
  }
}

# Event Hub settings come back with the tenant, and are empty when none are
# attached.
output "activity_log_consumer_groups" {
  value = [
    for setting in data.crowdstrike_cloud_azure_tenant.by_tenant_id.eventhub_settings :
    setting.consumer_group if setting.type == "activity_logs"
  ]
}

Schema

Optional

• registration_id (String) The Falcon Cloud Security registration ID of the Azure Tenant. This is an internal identifier for the registration record. Exactly one of tenant_id or registration_id must be provided.
• tenant_id (String) The Azure tenant ID (directory ID) of the registered tenant, for example 00000000-0000-0000-0000-000000000000. Exactly one of tenant_id or registration_id must be provided.

Read-Only

• account_type (String) The Azure Tenant account type. Value is ‘commercial’ for Commercial cloud accounts. For GovCloud environments, value can be either ‘commercial’ or ‘gov’ depending on the account type
• agentless_scanning_subscription_ids (List of String) Azure subscription IDs where agentless scanning is enabled.
• cs_azure_client_id (String) Client ID of CrowdStrike’s multi-tenant application in Azure. This is used to establish the connection between Azure and Falcon Cloud Security.
• cs_infra_location (String) Azure location where CrowdStrike infrastructure resources (such as Event Hubs) were deployed.
• cs_infra_subscription_id (String) Azure subscription ID where CrowdStrike infrastructure resources (such as Event Hubs) were deployed.
• dspm (Attributes) Data security posture management (DSPM) configuration. (see below for nested schema)
• environment (String) The environment added to resources created during onboarding.
• eventhub_settings (Attributes List) The Azure Event Hub settings attached to the tenant registration, empty when none are attached. These are managed by the crowdstrike_cloud_azure_tenant_eventhub_settings resource. (see below for nested schema)
• management_group_ids (List of String) A list of Azure management group IDs monitored. All subscriptions under the management groups are monitored.
• microsoft_graph_permission_ids (List of String) A list of Microsoft Graph permission IDs assigned to the service principal.
• realtime_visibility (Attributes) Real-time visibility and detection configuration. (see below for nested schema)
• resource_name_prefix (String) The prefix added to resources created during onboarding.
• resource_name_suffix (String) The suffix added to resources created during onboarding.
• subscription_ids (List of String) A list of subscription IDs registered in addition to any subscriptions that are targeted by management_group_ids.
• tags (Map of String) Tags applied to managed resources.
• vulnerability_scanning (Attributes) Vulnerability Scanning configuration. (see below for nested schema)

Nested Schema for dspm

Read-Only:

• enabled (Boolean) Whether data security posture management (DSPM) is enabled

Nested Schema for eventhub_settings

Read-Only:

• consumer_group (String) The Azure Event Hub consumer group name used to read events from the Event Hub.
• id (String) The Azure Event Hub ID.
• type (String) The type of Event Hub, either activity_logs or entra_logs.

Nested Schema for realtime_visibility

Read-Only:

• enabled (Boolean) Whether real-time visibility and detection is enabled

Nested Schema for vulnerability_scanning

Read-Only:

• enabled (Boolean) Whether Vulnerability Scanning is enabled