Skip to main content

cnspec scan ms365

Scan a Microsoft 365 tenant.

Synopsis​

This command triggers a new policy scan for Microsoft 365:

$ cnspec scan ms365 --tenant-id {tenant id} --client-id {client id} --client-secret {client secret}

This example connects to Microsoft 365 using the PKCS #12 formatted certificate:

$ cnspec scan ms365 --tenant-id {tenant id} --client-id {client id} --certificate-path {certificate.pfx} --certificate-secret {certificate secret}
$ cnspec scan ms365 --tenant-id {tenant id} --client-id {client id} --certificate-path {certificate.pfx} --ask-pass
cnspec scan ms365 [flags]

Options​

      --annotation stringToString        Add an annotation to the asset. (default [])
      --ask-pass                         Ask for connection password.
      --asset-name string                User override for the asset name.
      --certificate-path string          path to certificate that's used for certificate-based authentication in PKCS 12 format (pfx)
      --certificate-secret string        passphrase for certificate file
      --client-id string                 application (client) ID of the service principal
      --client-secret string             secret for application
      --datareport string                set the MS365 datareport for the scan
      --detect-cicd                      Try to detect CI/CD environments and, if successful, set the asset category to 'cicd'. (default true)
      --discover string                  Enable the discovery of nested assets. Supported: 'all|auto|instances|host-instances|host-machines|container|container-images|pods|cronjobs|statefulsets|deployments|jobs|replicasets|daemonsets' (default "auto")
      --discover-filter stringToString   Additional filter for asset discovery. (default [])
  -h, --help                             help for ms365
      --id-detector string               User override for platform ID detection mechanism. Supported: hostname, machine-id, aws-ec2, cloud-detect, ssh-host-key, transport-platform-id
  -i, --identity-file string             Select a file from which to read the identity (private key) for public key authentication.
      --incognito                        Run in incognito mode. Do not report scan results to the Mondoo platform.
      --insecure                         Disable TLS/SSL checks or SSH hostkey config.
      --inventory-ansible                Set the inventory format to Ansible.
      --inventory-domainlist             Set the inventory format to domain list.
      --inventory-file string            Set the path to the inventory file.
  -j, --json                             Set output to JSON (shorthand).
      --no-pager                         Disable interactive scan output pagination.
      --option --option key=value        Additional connection options. You can pass multiple options using --option key=value. (default [])
  -o, --output string                    Set output format: compact, csv, full, json, junit, report, summary, yaml (default "compact")
      --pager string                     Enable scan output pagination with custom pagination command. The default is 'less -R'.
  -p, --password string                  Password, such as for SSH/WinRM.
      --path string                      Path to a local file or directory for the connection to use.
      --policy strings                   Lists policies to execute. This requires incognito mode. You can pass multiple policies using --policy POLICY
  -f, --policy-bundle strings            Path to local policy bundle file.
      --props stringToString             Custom values for properties (default [])
      --score-threshold int              If any score falls below the threshold, exit 1.
      --sudo                             Elevate privileges with sudo.
      --tenant-id string                 directory (tenant) ID of the service principal

Options inherited from parent commands​

      --config string      Set config file path (default $HOME/.config/mondoo/mondoo.yml)
      --log-level string   Set log level: error, warn, info, debug, trace (default "info")
  -v, --verbose            Enable verbose output

SEE ALSO​