Connected is a milestone. Evidence is the proof.

AWS: four independent checks#

1. Deployment: the CloudFormation stack is CREATE_COMPLETE, or the manually created provider and role exist in the correct account.
2. Trust and permissions: the provider is account-local; audience and approved workspace subject conditions are present; audit and any separately approved optional policies match the intended profile.
3. Registration: Transilience Integrations shows the correct account ID and role ARN, with a successful onboarding status. Manual setup requires the approved non-secret role-ARN handoff and registration.
4. Evidence: request an initial collection in the authenticated Transilience workspace. Confirm collection time, account, region, source coverage, and any access-denied errors. The public portal cannot perform that test for you.

Read-only identity sanity check#

Run in your customer administrator’s own approved CLI session. This checks the identity you are currently using; it does not test Transilience’s OIDC role assumption or grant access.

aws sts get-caller-identity --query '{Account:Account,Arn:Arn}' --output json

Azure: prove each evidence plane#

1. Tenant and identity: verify the tenant ID, application/client ID, service principal, and selected subscriptions against your approved scope.
2. Azure RBAC: inspect role assignments at each approved subscription, management group, and any explicitly supplied workspace or billing scope.
3. Consent: inspect the Application permissions and Granted status for Microsoft Graph and Defender for Endpoint. Permission names alone do not prove consent succeeded.
4. Registration and credential: confirm secure callback receipt or approved secret handoff, integration status, and a recorded rotation owner and expiry.
5. Evidence: validate resource counts, security posture, identity/log data, endpoint evidence, and timestamps. Empty results can mean no data, no licence, missing configuration, wrong scope, or insufficient effective permissions.

Read-only tenant sanity check#

az account show --query '{tenantId:tenantId,subscriptionId:id,name:name}' --output json

This checks the signed-in administrator’s current context, not the app’s effective access. Never print an access token or client secret as a diagnostic step.

Record a useful handoff#

Keep the non-secret account/tenant IDs, approved scopes, role ARN or app ID, permission profile, installation time, first successful collection time, missing evidence, rotation owner, and offboarding owner. Do not include passwords, access tokens, session credentials, or the secret-bearing Azure credentials file.

A checklist is not a live health test#

The checklist on this page stores only local completion flags. It never calls AWS, Azure, or the Transilience backend. Clear it when starting a different customer’s setup. The authenticated workspace remains the source for live connection and collection status.