cnspec integrate azure
Onboard Azure subscriptions into Mondoo Platform for continuous scanning.
Connect your Azure environment to Mondoo Platform. The command creates an app registration, its credentials, and the role assignments Mondoo needs. To learn about the full setup, read Terraform setup.
By default, Mondoo discovers every subscription and integrates it for continuous scanning:
cnspec integrate azureTo scan only specific subscriptions, pass them with --allow:
cnspec integrate azure --allow SUBSCRIPTION_ID_1 --allow SUBSCRIPTION_ID_2To scan every subscription except the ones you specify, pass them with --deny:
cnspec integrate azure --deny "SUBSCRIPTION_ID_1,SUBSCRIPTION_ID_2"You can't use --allow and --deny together.
The integration's resources are created in a primary subscription. If you don't set it with --subscription-id, cnspec lists your subscriptions with the Azure CLI (az account list) and asks you to select one. In a non-interactive shell, cnspec lists them and exits, so pass --subscription-id. To authenticate with Workload Identity Federation instead of a certificate, add --use-wif. To also scan Azure VMs using RunCommand, add --scan-vms.
Options
--allow strings Set the Azure subscriptions to include in scanning
--deny strings Set the Azure subscriptions to exclude from scanning
-h, --help help for azure
--scan-vms Enable scanning Azure VMs using RunCommand
--subscription-id string Set the Azure subscription used to create resources
--use-wif Use Workload Identity Federation (keyless) instead of a certificateOptions inherited from parent commands
--api-proxy string Set the proxy for communications with Mondoo Platform API
--auto-update Enable automatic provider installation and update (default true)
--config string Set config file path (default $HOME/.config/mondoo/mondoo.yml)
--integration-name string Set the name of the integration
--log-level string Set the log level: error, warn, info, debug, trace (default "info")
--logging-config string Path to a logging configuration file (YAML or JSON) that selects the log writer, level, and writer-specific options
--output string Set the location to write automation code
--space string Set the space to create the integration
--strict Default MQL strict mode for policies that do not declare one: every link in an MQL chain must resolve
-v, --verbose Enable verbose outputSEE ALSO
- cnspec integrate - Onboard integrations for continuous scanning into the Mondoo Platform