Appearance
Cloud & Identity Discovery
Where to find it: Integrations, then Cloud & Identity Discovery (/integrations/discovery).
Cloud & Identity Discovery is OrviQ's automated pipeline for reconciling enterprise directory accounts and cloud infrastructure resources into compliance scopes and asset inventories.
Requires the cloud_discovery entitlement.
Ship-dark behavior
Cloud & Identity Discovery ships dark. When cloud_discovery is disabled on a tenant, the module remains completely suppressed from navigation bars, avoiding unentitled UI clutter. Underlying API routes refuse requests with 403 Forbidden.
Architecture: Dual Discovery Pipelines
The module runs two parallel discovery disciplines: Identity Directory Ingestion and Cloud Infrastructure Inventory.
1. Identity Discovery
Identity discovery connects to directory platforms to map user accounts, administrative privileges, and authentication mechanisms.
Supported Identity Connectors
| Connector | Mechanism | Telemetry Gathered |
|---|---|---|
Microsoft Entra ID (entra_id) | Native API (Graph) | User accounts, MFA registration status, directory roles, enterprise applications |
Active Directory (active_directory) | Webhook push / File | Customer-hosted PowerShell collector pushing JSON over HTTPS; or manual JSON report upload |
Okta (okta) | Native API | Directory users, group memberships, administrator privileges, enrolled MFA factors |
The Core Principle: People are Not Assets
Identities are scope populations, not asset rows or platform users
In OrviQ, human beings and directory accounts are never entered as pseudo-asset rows in the asset register, nor are they automatically granted platform login access as AuthUser accounts.
Discovered accounts are ingested as Discovered Identities (DID-YYYY-NNNN) and projected into Scope Registry Populations (account_population in SCP-...).
Scope Projection & Automated Coverage
Discovered directory accounts are bound to target compliance scopes through three standard population projections:
all_accounts: Complete inventory of all directory accounts across the organization.privileged_accounts: Accounts carrying high-privilege roles (e.g. Global Administrator, Security Administrator, Domain Admins).enabled_accounts: Active directory accounts excluding disabled and terminated users.
Each identity records:
- Identity attributes: UPN, primary email, display name, account status (
enabled/disabled), user type (member,guest,service). - Assurance posture: MFA registration (
mfa_registered), MFA capability (mfa_capable), and last sign-in timestamp. - Presence tracking:
present,stale, ormissing.
These populations directly feed Continuous Assurance indicators (e.g., verifying that 100% of the privileged_accounts population has MFA registered and enforced).
2. Cloud Infrastructure Discovery
Cloud discovery queries public cloud providers and hypervisors to identify provisioned infrastructure and evaluate security posture.
Supported Cloud Connectors
| Platform | Connector Key | Mechanism | Ingested Assets |
|---|---|---|---|
| Microsoft Azure | azure | Native REST | Subscriptions, Virtual Machines, Virtual Networks, Storage Accounts |
| Amazon Web Services | aws | Native REST | Accounts, EC2 instances, S3 buckets, VPCs via Resource Explorer and AWS Config |
| Google Cloud | gcp | Native REST | Organization, folder, and project compute instances, storage buckets, network firewalls |
| VMware vSphere | vmware | Native REST | ESXi host servers, virtual machines, hypervisor clusters, and datastores |
| GitHub / GitLab | github | Native REST | Repositories as application assets; branch protection, secret scanning alerts |
| Microsoft 365 | microsoft_365 | Native REST | Microsoft Secure Score controls mapped to configuration evidence |
| Prowler | prowler | File Import | OCSF / CSV benchmark evaluations across CIS, ISO 27001, and PCI DSS |
Discovered Asset Provenance & Review Workflow
Cloud resources flow into the Scope Registry with strict governance safeguards:
- Source Attribution: Every discovered cloud workload is tagged with its origin (e.g.
source="scanner:azure",source="scanner:aws"). - Review Queue Gate: Newly discovered cloud assets enter the inventory in an unassigned state (
discovery_review_status = "unassigned"). - Governance Decisions: An authorized user with
asset.discovery_reviewevaluates new resources:- Approve (
reviewed): Confirms the resource into the active technology inventory. - Merge (
merged): Unifies a multi-cloud or dual-reported resource with an existing canonical asset record. - Ignore (
ignored): Excludes transient, ephemeral, or out-of-scope resources from governed registers.
- Approve (
- Non-Overwriting Rule: Automated synchronization populates blank technical fields (instance IDs, hostnames, OS types, IP addresses). Automated syncs never overwrite human-governed attributes (
owner,custodian,criticality,data_classification,environment). - No Automatic Decommissioning: If a cloud instance is terminated in AWS or Azure, its presence state becomes
staleormissing. The asset is never silently removed or auto-decommissioned; asset decommissioning remains an intentional governance action.
Semantic Doctrine
Semantic Doctrine: Cloud Discovery & Compliance
- Discovery != compliance: Discovering that 400 cloud instances exist does not establish that they comply with cloud security baselines, configuration hardening, or regulatory mandates.
- Passing checks != operating effectiveness: A passing benchmark check in Prowler or AWS Config provides a point-in-time technical observation. Control effectiveness requires validation across declared scopes and evaluation by control owners.
- Evidence != effectiveness: Ingested cloud configurations serve as evidence inputs; they do not replace human review, risk acceptance, or independent audit.
Permissions & Access
| Action | Permission Key | Required Role(s) |
|---|---|---|
| View discovered identities, cloud resources, and sync jobs | discovery.read | Tenant Admin, Compliance Manager, Compliance Officer, Auditor |
| Configure discovery connections, syncs, and scope projections | discovery.manage | Tenant Admin, Compliance Manager |
| Review and approve/merge/ignore discovered cloud assets | asset.discovery_review | Tenant Admin, Compliance Manager, Compliance Officer |