Native Microsoft Sentinel Integration for Devolutions Cloud
6 votes
Hello,
Currently, forwarding Devolutions Cloud audit logs to Microsoft Sentinel requires deploying the Devolutions Cloud Service on an on-premises server.
We would like to request a native cloud-to-cloud integration allowing Hub Business to send audit and activity logs directly to Microsoft Sentinel without requiring any intermediary infrastructure.
Benefits:
- Fully cloud-native architecture
- Reduced infrastructure and maintenance overhead
- Simplified SIEM integration
- Improved auditing, monitoring, and incident detection
Requested capabilities:
- Direct integration with Microsoft Sentinel
- Real-time or near real-time log export
- Support for activity logs, audit logs, authentication events, administrative changes, and Devolutions Send events
- Integration through Azure-native mechanisms (API, Azure Monitor, Event Hub, webhook, etc.)
This feature would greatly benefit organizations that have adopted a cloud-first strategy and use Microsoft Sentinel as their central security monitoring platform.
Thank you for considering this enhancement.
All Comments (2)
Hi @tchitchirakresp,
Unfortunately, our current cryptographic design requires a customer deployment of the reporting service to continue to guarantee our zero-knowledge encryption schemes. The reason for this is certain log data is encrypted with the Cloud workspace key, preventing us from decrypting it on our servers.
There are Azure templates available for you to deploy the reporting service in your own Cloud envrionment, thus not requiring any physical machines on your end.
Cheers,
Luc Fauvel
Hello@Luc Fauvel,
Thank you for these clarifications. The constraint related to “zero-knowledge” encryption makes perfect sense.
Deploying the Reporting Service directly in our Azure environment could indeed be a good alternative to an on-premises deployment.
We’ll review this option internally. However, it would be beneficial—where technically possible—to have a more seamless cloud-native integration with Microsoft Sentinel, while maintaining the “zero-knowledge” architecture.
Thank you for these explanations!