Azure

Azure Sentinel Using Terraform + Terragrunt

Q: What are the minimum changes required to deploy Azure Sentinel using this Terraform setup?

You only need to modify three inputs in the terragrunt.hcl file located in the production folder: the Prefix (which sets names for all resources), Location, and license settings for P2 in AD and E5 in O365. No other changes are needed besides basic authentication and tool setup, allowing you to have a complete Sentinel solution running in 10-15 minutes.

Q: Which Azure Sentinel components and connectors are deployed by this Terraform configuration?

The configuration deploys a resource group, Log Analytics Workspace, SecurityInsights solution, four types of alert rules (Fusion, Machine Learning Behavior Analytics, MS Security Incident, and Scheduled), an Automation Rule, and six connectors including O365, AAD, App Security, ATP, Microsoft Defender ATP, and Cloud Security connectors.

Q: What is the difference between the Modules and Live code folders in this repository?

The Modules folder (shown in red) contains reusable Terraform modules that define the infrastructure components, while the Live code folder (shown in yellow) contains the actual configuration and deployment code used to instantiate those modules in your environment.

Q: What prerequisites do I need to deploy this Sentinel solution?

You need to have Terraform and Terragrunt installed on your system, along with proper Azure authentication configured. Additionally, you should have the appropriate Microsoft licenses (P2 in Azure AD and/or E5 in Office 365) depending on which features you want to enable.

Q: What command should I use to deploy the Azure Sentinel infrastructure?

Navigate to the production folder and use the `terragrunt run-all apply` command to deploy the entire infrastructure. Before running this command, make sure you have updated the terragrunt.hcl file with your desired Prefix, Location, and license settings.

ARNAV SHARMA

2022.06.20 · 1 MIN READ

Azure DevOps

Azure Sentinel Using Terraform + Terragrunt

Last Updated on August 13, 2025 by Arnav Sharma

I recently compiled all (all of the available resources in TF) the components and deployed them using Terraform.

To deploy a complete setup, just change 3 inputs and the complete sentinel solution should be up and running in 10-15 mins.

Here’s the code to set up Sentinel using Terraform and Terragrut.

Repo: sharmaarnav/as-sentinel (github.com)

Changes needed to deploy Sentinel: Go to the terragrunt.hcl file in the production folder and modify:

Prefix – this sets names for all resources
Location
And set if you have enabled P2 license in AD and E5 in O365. (Set the value to 0 if you don’t have a license and set 1 if you have activated the license)

No other changes are needed apart from the basics (authentication, terraform and terragrunt)

Resources Deployed:

A resource group
Log Analytics Workspace
Solution – SecurityInsights
Sentinel Fusion Alert Rule.
Sentinel Machine Learning Behavior Analytics Alert Rule.
Sentinel MS Security Incident Alert Rule.
Sentinel Scheduled Alert Rule.
Sentinel Automation Rule.

Connector to O365
Connector to AAD
Connector to App Security
Connector to ATP
Connector to Microsoft Defender ATP
Connector to Cloud Security

The code:

Source modules: as-sentinel/Modules at main · sharmaarnav/as-sentinel (github.com)

Live Repo: as-sentinel/SentinelLiveRepo/Production at main · sharmaarnav/as-sentinel (github.com)

To Deploy:

Fork the repo and clone to your system. Open the related path using VSCode or other tools.
Browse to the production folder and update the terragrunt.hcl file.
Use terragrunt run-all apply command to deploy.

(PS – You need to install Terragrunt and Terraform to have this up and running)

Code Structure:

Red: Modules

Yellow: Live code

Arnav Sharma Microsoft MVPMCT

Microsoft Certified Trainer · Cloud · Cybersecurity · AI

I help organisations secure their cloud infrastructure and stay ahead of evolving cyber threats. Microsoft MVP and Certified Trainer, author of Mastering Azure Security, and founder of arnav.au — a platform for practical Cloud, Cybersecurity, DevOps and AI content.

LinkedIn Twitter / X 📖 Mastering Azure Security Book a Session