assure

Connectors: read-only access to your identity, code, cloud and device tools

ENTERPRISEbetaEstimated read: 15 min· Updated 2026-10-16

Connectors: read-only access to your identity, code, cloud and device tools

Enterprise

A connector lets Axis Assure read one of your tools — your identity provider, your code host, a cloud account, your device management, your change tickets or your vulnerability scanner — so that monitored checks can grade what it reports. Every connector is read-only by design: Axis Assure asks for the narrowest read permissions the vendor offers, and a connection that grants a write permission is refused. Nothing is ever changed in your tools.

TL;DR — If the tool signs in with AxisSynapse's own app (Microsoft Entra and the Microsoft tools that share it), first bind your directory under Assure → Connectors → External tenants. Then open Connect a tool, pick the tool, and follow the three steps. Before anything is stored, the wizard lists exactly what each dataset reads and the permissions it needs. Connecting, rotating credentials and disconnecting each ask you to confirm it's you. Each connector below lists the permissions to grant — no more.

What happens after you connect

  • A daily read. Each connection is read on its own schedule, on your workspace's clock, and again soon after a verified notification from the vendor where the vendor sends one. A notification only schedules a read; nothing in it is ever taken as a fact.
  • Only what a check needs. Each dataset keeps a short, fixed list of fields (an account's address, whether it has multi-factor authentication, whether it is an administrator, when it last signed in, and so on). Everything else the vendor returns is dropped before it is stored, and raw responses are never kept.
  • Health you can see. A connection is healthy, degraded, failing, stale (no successful read for twice its cadence) or revoked (the vendor withdrew consent). Checks over a stale or revoked connection say so — they never pass.
  • Assets go to your CMDB through its identification rules. Cloud resources and managed devices are matched by the rule for their kind, so a resource seen again updates its configuration item instead of creating a new one. The rule is proposed when you connect; if an administrator turns it off, those assets are not sent at all.
  • People can be erased. When a member's personal data is erased, the addresses and device names your tools reported for them are erased too.

Before you start

  • You need the Compliance Admin role in Axis Assure, and the Enterprise plan.
  • A connector stays unavailable until AxisSynapse has turned on its sign-in method; until then the wizard marks it "Not yet available in this deployment" and connecting is refused.
  • Vendor permission names change. Confirm each one in your vendor's console as you grant it, and grant nothing beyond the list.

Binding your directory to this workspace

A connector that signs in with AxisSynapse's own app can reach only a directory or installation that an administrator of it has bound to your workspace. Binding is proved by the vendor, not typed: typing a tenant id is never enough.

  1. Start the binding

    On Assure → Connectors, under External tenants, choose Bind for the kind you need (for example, Bind Entra directory) and confirm it's you.

  2. Approve with the vendor

    You are sent to the vendor. For Microsoft Entra, an administrator who may grant consent for the whole directory (a Global, Privileged Role, Cloud Application or Application Administrator) approves AxisSynapse's app and signs in once more; Microsoft's own answer says which directory it is. The approval must be completed within 10 minutes, by the same person who started it.

  3. Use it

    The directory appears under External tenants, bound to this workspace only. Connections that use AxisSynapse's app in that directory now work. Revoke stops them at their next read.

Connectors that use your own app, key or token (your own Entra app with a certificate, your own GitHub App, Okta service app or Google service account, a GitLab, Jira or ServiceNow token, a Jamf API client) need no binding: they reach only what you granted them. AWS and Google Cloud are tied to your workspace by the role's ExternalId and by the service account made for your workspace.

Identity providers

Microsoft Entra ID

  1. Bind your directory

    Bind your directory under External tenants (above): the administrator's approval grants AxisSynapse's app its permissions in your directory. AxisSynapse signs in with a federated credential, so there is no client secret to create or rotate. (Prefer your own app registration? Choose Your own app with a certificate in step 3, grant your app the same permissions, and skip the binding.)

  2. Application permissions (read-only)

    User.Read.All (accounts, status, last sign-in) and AuditLog.Read.All (the authentication-methods registration report and sign-in activity). Without an Entra ID P1 or P2 licence the registration report is not available: the checks that need it say so instead of failing every account.

  3. Enter your tenant

    Give your directory (tenant) id — the GUID of the directory you bound. A multi-tenant alias such as common is refused.

Okta

  1. Create an API service integration

    In the Okta admin console, create an API service app that authenticates with public key / private key (private_key_jwt).

  2. Grant the scopes

    okta.users.read, okta.factors.read and okta.roles.read. Without okta.roles.read the connection still works, but the administrator checks say they cannot tell who is an administrator.

  3. Give Axis Assure the key and your org URL

    Upload the app's private key in the wizard (it is sealed and never shown again) and enter your Okta org address.

Google Workspace

  1. Create a service account

    In one of your Google Cloud projects, create a service account with a key.

  2. Authorise domain-wide delegation

    In the Admin console, authorise the service account's client id for exactly one scope: https://www.googleapis.com/auth/admin.directory.user.readonly.

  3. Give Axis Assure the account, its key and an administrator

    Enter the service account, upload its private key (sealed, never shown again) and name the administrator the connector acts as. It reads users only, never mail or files.

Code hosts

GitHub

Register a GitHub App in your organization with read-only permissions: repository Metadata: read and Administration: read (branch protection and rulesets), and organization Administration: read (the two-factor requirement). Install it on the organization, then give the wizard the app id, the installation id and the app's private key (sealed, never shown again). If you set a webhook secret, deliveries from the app are verified by their signature before they schedule a read. Secret scanning is reported only when GitHub shows it to the app; otherwise the check says it cannot tell, never "off".

GitLab (gitlab.com)

Create a group access token with the read_api scope and the Reporter role, and an expiry date. Enter that date in the wizard: once it passes, the connection shows as revoked until you rotate the token. Approval rules need GitLab Premium; on Free they are reported as unknown, never as zero.

Azure DevOps

Add the same Entra app to your Azure DevOps organization with read access (its directory bound as above, unless you use your own app). Sign-in multi-factor authentication for Azure DevOps is your Entra conditional access, so it is graded by the identity checks.

Cloud accounts

Amazon Web Services

  1. Create the role

    Step 2 of the wizard shows your ExternalId — generated for this workspace — and the role's trust policy: AxisSynapse's own role may assume yours only when the request carries that ExternalId. Create the role in your account with that trust policy.

  2. Permissions (read-only)

    iam:GetAccountSummary, iam:ListUsers, iam:ListAccessKeys, s3:GetAccountPublicAccessBlock, s3:ListAllMyBuckets, s3:GetBucketPublicAccessBlock, s3:GetEncryptionConfiguration, cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, ec2:DescribeInstances, rds:DescribeDBInstances — all within AWS's SecurityAudit policy.

  3. Connect

    Enter the role's ARN. Axis Assure first tries the role without the External ID: if that works, the connection is refused, because a role anyone can assume is not safe to trust.

Microsoft Azure

Assign the AxisSynapse app's service principal Reader and Security Reader on each subscription (or on a management group), in the directory you bound. Assign nothing that writes.

Google Cloud

Grant the service account the wizard shows Security Center Findings Viewer and Cloud Asset Viewer on your organization. AxisSynapse reaches it through workload identity federation; there is no key file.

Devices

Microsoft Intune

Grant the AxisSynapse app the application permission DeviceManagementManagedDevices.Read.All.

Jamf Pro

Create an API role with only Read Computers, an API client with that role, and give the client id and secret to the wizard. Jamf Cloud instances only. When you rotate the client's secret in Jamf, rotate it here too.

Change tickets

Jira Service Management

A service user with Browse projects on the change project and agent access to read approvals, and an API token with an expiry. Enter the expiry in the wizard: once it passes, the connection shows as revoked until you rotate the token. Only the change's key, summary, type, status, approvals and dates are read — never its reporter, assignee, comments or description.

ServiceNow

An OAuth client-credentials entry in the Application Registry, or a service user (with snc_basic_auth_api_access where your instance restricts basic sign-in). Either way, give it read access to change requests only.

Vulnerability scanner

Microsoft Defender Vulnerability Management

Grant the AxisSynapse app Vulnerability.Read.All (WindowsDefenderATP). Never grant a machine action permission (isolate, scan, live response): the connection would be refused.

Rotating and disconnecting

Rotate verifies the new credential first and replaces the stored one after you confirm it's you; the old one stays until the new one passes. A connection with no stored secret re-verifies its sign-in instead. Disconnect deletes the connection's credentials and stops its reads. What it already collected stays as the record of what was seen, and its checks go stale.