AWS CloudTrail ingestion (Preview)
Defender for CloudMicrosoft
AWS CloudTrail ingestion (Preview)
December 17, 2025
AWS CloudTrail management event ingestion is now available in preview in Microsoft Defender for Cloud.
When enabled, AWS CloudTrail ingestion enhances Cloud Infrastructure Entitlement Management (CIEM) by incorporating observed AWS management event activity alongside existing entitlement signals such as Access Advisor data. The additional usage context helps improve the accuracy of AWS security recommendations, including identifying unused permissions, dormant identities, and potential privilege escalation paths.
CloudTrail ingestion is supported for single AWS accounts and AWS Organizations that use centralized logging.
