CSPM - Azure Auto Connect Region Selection for Volume Scanning
Overview
When onboarding an Azure subscription through Aqua Hub Auto Connect, discovery settings include options such as Volume Scanning. Azure subscriptions using a Global (non-regional) portal location still require selecting a specific Azure region for deployment of integration resources—not a “Global” region in the onboarding wizard.
This article explains how region selection works during Auto Connect and what to choose for volume scanning and related CSPM features.
Auto Connect Deployment Model
Auto Connect deploys Azure resources into the customer tenant based on options selected during Hub onboarding. Typical enabled capabilities include:
- CSPM onboarding
- Image registry integration
- Function scanning for vulnerabilities (without runtime protection)
- Volume scanning
Resources are created in the Azure region selected during onboarding. The integration user must have permission to deploy into that region.
Volume Scanning and Discovery Settings
Volume scanning and other discovery features do not use a separate “Global” region in Aqua’s Auto Connect flow.
| Setting | Guidance |
|---|---|
| Azure subscription location in portal | May show Global for some tenants |
| Region in Aqua Auto Connect script/wizard | Select a specific Azure region where resources should deploy |
| “Global” as Aqua region | Not available—one concrete region is required |
Choose a region where:
- The integration service principal or user has deploy permissions
- Data residency and networking policies allow Aqua integration assets
- Proximity to primary workloads is acceptable for scanning operations
Any supported Azure region accessible to the integration identity is valid; there is no requirement to match the portal’s “Global” label.
Recommended Steps
- In Aqua Hub, start Auto Connect for the Azure subscription
- Enable required capabilities (CSPM, registry integration, function scanning, volume scanning as needed)
- Select the target Azure region for resource deployment
- Complete the generated onboarding script or template in the Azure tenant
- Verify deployed resources in the selected region in the Azure portal
Verification and Monitoring
- Confirm integration stacks and scanning assets appear in the chosen Azure region
- Validate CSPM posture data and volume scanning results in the Aqua Console after onboarding completes
- Re-run onboarding only after reviewing region impact—resources are region-scoped
Platform Coverage
| Component | Platform |
|---|---|
| Aqua Hub Auto Connect | Aqua SaaS |
| Azure CSPM onboarding | Microsoft Azure |
Related Resources
Did you find it helpful? Yes No
Send feedback