Skip to main content
tpontes
Staff
Staff
April 2, 2026

Technical Tip: FortiCNAPP DSPM Azure Integration Setup

  • April 2, 2026
  • 0 replies
  • 174 views
Description This article describes how to configure Data Security Posture Management (DSPM) integration for Microsoft Azure in a FortiCNAPP account using Terraform. The content covers provider configuration, required module calls, deployment, and a basic validation flow.
Scope
  • Initial DSPM integration setup for Azure from a zero-state environment.
  • Terraform-based deployment using official modules.
  • Basic post-deployment validation in Azure and FortiCNAPP.
Solution

Prerequisites

  • Azure CLI version 2.50.0 or later.
  • Terraform version 1.9 or later.
  • Azure Subscription with Owner or Contributor permissions.
  • Azure AD permissions to register an application and create a Service Principal.
  • Active FortiCNAPP account with API Key and API Secret.
  • DSPM feature enabled for the FortiCNAPP account.

 

Provider and module configuration.

Use the following content in main.tf:

 

# =============================================================================
# FortiCNAPP DSPM Azure Integration - Fully Automated
# =============================================================================

terraform {
  required_version = ">= 1.9"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.80"
    }
    lacework = {
      source  = "lacework/lacework"
      version = "~> 2.3"
    }
  }
}

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }
}

provider "lacework" {
  account    = var.lacework_account
  api_key    = var.lacework_api_key
  api_secret = var.lacework_api_secret
}

# ── Step 1: Create Service Principal with Required Permissions ──────────────

module "dspm_service_principal" {
  source  = "lacework/dspm/azure//service_principal"
  version = "~> 0.2"

  service_principal_name              = "forticnapp-dspm-deployment-sp"
  scanning_subscription_id            = var.scanning_subscription_id
  client_secret_expiry_duration_hours = "4380h" # ~6 months
}

# ── Step 2: Deploy DSPM Infrastructure Using Created Service Principal ──────

module "lacework_azure_dspm" {
  source  = "lacework/dspm/azure"
  version = "~> 0.2"

  lacework_integration_name = var.lacework_integration_name
  regions                   = var.regions
  scanning_subscription_id  = var.scanning_subscription_id
  tenant_id                 = var.tenant_id
  resource_prefix           = var.resource_prefix
  owner_id                  = module.dspm_service_principal.service_principal_object_id

  # Scanner Configuration
  scan_frequency_hours = var.scan_frequency_hours
  max_file_size_mb     = var.max_file_size_mb

  # Datastore Filtering
  datastore_filters = var.datastore_filters

  tags = var.tags
}

 

Create variables.tf and terraform.tfvars.

 
Example variables for terraform.tfvars:
 
scanning_subscription_id  = "<azure-subscription-id>"
tenant_id                 = "<azure-tenant-id>"
regions                   = ["East US"]
lacework_account          = "<forticnapp-account>.lacework.net"
lacework_api_key          = "<forticnapp-api-key>"
lacework_api_secret       = "<forticnapp-api-secret>"
lacework_integration_name = "azure-dspm"
resource_prefix           = "forticnapp"
scan_frequency_hours      = 24
max_file_size_mb          = 20
datastore_filters         = []

tags = {
  Environment = "production"
  ManagedBy   = "terraform"
}
 

Deploy the integration:

Run the following commands in the Terraform working directory:

 

terraform init
terraform plan
terraform apply

 

Basic integration test:

 

After applying, validate the integration with the following checks:
  1. Confirm Azure resources were created successfully.
  2. Sign in to FortiCNAPP.
  3. Open Settings -> Cloud Accounts.
  4. Confirm the Azure DSPM integration is listed and healthy.
  5. Trigger a basic scan (if available in the environment) and verify resource discovery results.
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!