Scan Microsoft Azure Virtual Machines
Scan Microsoft Azure virtual machines, snapshots, and disks with cnspec.
Use cnspec to scan Microsoft Azure virtual machines, snapshots, and disks through an Azure registered app. This lets you evaluate the security of your VMs without deploying agents.
Prerequisites
To scan Azure virtual machines with cnspec, you must have:
- An Azure virtual machine to run the scan from, with cnspec installed. cnspec snapshots the target, attaches the copy to the VM it runs on, and reads that VM's subscription and resource group from the Azure instance metadata service, so these scans must run from an Azure VM.
- An Azure registered app with the appropriate permissions
- The app's tenant ID, client ID, and either a certificate or a client secret
Authenticate
Pass the registered app's credentials on the command line. Each scan command below accepts the same authentication flags:
| Flag | Value |
|---|---|
--tenant-id | Your Azure tenant ID |
--client-id | The registered app's client ID |
--client-secret | A client secret (or use --certificate-path instead) |
--certificate-path | Path to the authentication certificate, in PKCS #12/PFX or PEM format |
--certificate-secret | Passphrase for the authentication certificate file |
--auth-method | Comma-separated sign-in methods to try when no client secret or certificate is given: cli, env, workload-identity, managed-identity (default: try all, in that order) |
For NAME, substitute the name of a VM, snapshot, or disk in the same resource group and subscription as the scanner VM. To scan a target in a different resource group or subscription, pass its full Azure Resource Manager resource ID instead (for example, /subscriptions/SUBSCRIPTION-ID/resourceGroups/RESOURCE-GROUP/providers/Microsoft.Compute/virtualMachines/NAME).
Scan a VM
cnspec scan azure compute instance NAME \
--tenant-id YOUR-TENANT-ID \
--client-id YOUR-CLIENT-ID \
--client-secret YOUR-CLIENT-SECRETScan a compute snapshot
cnspec scan azure compute snapshot NAME \
--tenant-id YOUR-TENANT-ID \
--client-id YOUR-CLIENT-ID \
--client-secret YOUR-CLIENT-SECRETScan a compute disk
cnspec scan azure compute disk NAME \
--tenant-id YOUR-TENANT-ID \
--client-id YOUR-CLIENT-ID \
--client-secret YOUR-CLIENT-SECRETUnderstand your results
To learn how to read the scan report, including scores and remediation guidance, see Understand cnspec Results.
Learn more
- Secure an Azure Subscription: scan subscription-level Azure configuration
- Mondoo Azure Resource Pack Reference: every Azure resource and field cnspec can query
- Write Effective MQL: guide to authoring checks and queries
- Continuously Scan Azure: set up the Mondoo Azure integration for ongoing assessment