Set Up Azure Continuous Scanning with Terraform

Use cnspec integrate azure to provision the Mondoo Azure integration with Terraform from Azure Cloud Shell.

The Terraform setup runs cnspec integrate azure in Azure Cloud Shell. The command drives a Terraform run that provisions the app registration, credentials, and role assignments Mondoo needs to continuously scan one or more Azure subscriptions.

This path creates an app registration with a self-signed certificate, which you have to renew before it expires. If you'd rather not manage a credential at all, take the keyless automated setup instead, which uses a federated identity credential. For large environments, management group integrations, or key vaults that use the legacy access policy permission model, take the manual setup.

Before you start

You need:

In Mondoo: Editor or Owner access in the space where you want to add the integration.
In Azure: the Azure CLI installed and configured.
On the subscription: the Owner or Contributor role.
In Microsoft Entra ID: permission to create App Registrations.
Azure Cloud Shell access, or any shell with the Azure CLI.

Set up the integration

Step 1: Open the Azure integration

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations, then select + INSTALL in the top right. Find Azure and select it, then select the Terraform tab.

Step 2: Install cnspec and set your Mondoo credentials

cnspec integrate azure creates the integration in your space, so it needs a Mondoo credential with the Editor role. Mondoo generates a short-lived one for you.

Select Generate setup command.
Copy the command Mondoo shows. It installs cnspec and exports the credential as MONDOO_CONFIG_BASE64.

This credential is used only to run the integrate command. Once the integration exists, it gets its own identity, so your scans keep running. The credential expires after 24 hours; if you come back later, generate a fresh one.

Step 3: Enable security policies (optional)

Under Enable security policies, choose the policies on which you want to base assessments of your Azure environment. To learn more, read Manage Policies.

Step 4: Choose scan targets

To automatically discover and scan Linux and Windows virtual machines using Azure Run Command, enable Scan virtual machines. This adds --scan-vms to the generated command.
Leave Scan all subscriptions connected to the Directory (tenant) ID enabled to scan every subscription in the tenant.
To scan only certain subscriptions, turn the toggle off, select Allow list, and enter one subscription ID per line (or comma-separated). This adds --allow to the command.
To scan everything except certain subscriptions, turn the toggle off, select Deny list, and enter the subscription IDs to exclude. This adds --deny to the command.

To find your subscription IDs, go to Subscriptions in the Azure portal.

Step 5: Copy the installation command

Under Copy the installation command, copy the cnspec integrate azure command Mondoo generated from your choices. Mondoo names the integration for you; to use a different name, change the value in quotes after --integration-name, or rename the integration later in the Mondoo App.

Step 6: Run both commands in Azure Cloud Shell

Select Azure Cloud Shell to open Cloud Shell in a new tab.
Paste and run the setup command from Step 2, then the integrate command from Step 5.
Respond to the prompts:
- Select the primary subscription. This is where Mondoo creates the resources it needs to run scans, not the subscription it scans. Use the arrow keys to choose one, then press Enter.
- Select Show details to review the resources Mondoo will create, then press Enter to confirm.
Setup takes about two minutes. Wait for the success message. If it doesn't appear within five minutes, see Troubleshoot.

Mondoo begins scanning your Azure resources. When the first scan completes, you can see results on the INVENTORY page. To learn more, read Monitor Your Infrastructure Security.

Renew the application certificate

cnspec integrate azure generates a self-signed certificate valid for 4,096 hours, roughly 170 days. When it expires, the integration stops working, so plan to renew it. Certificates you create later with az ad app credential reset --create-cert get the Azure CLI default lifetime of one year.

Note the application ID of the app registration Mondoo created. Its display name is mondoo_security.

In Azure Cloud Shell, run (substituting your application ID):

az ad app credential reset --id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX --create-cert

Download the certificate from Cloud Shell's Manage files button.
In the Mondoo App, navigate to Integrations > Azure > your Azure integration and edit it.
Upload the new certificate.
Save the updated configuration.

To avoid certificate renewal entirely, use the keyless automated setup instead.

Troubleshoot

The command fails with a permission error creating the integration. Your MONDOO_CONFIG_BASE64 credential expired or was never exported. Return to Step 2, generate a fresh setup command, and run it again.
The automation pauses for more than two minutes after you choose the primary subscription. Press Control+C to end it, then run the integrate command again.
The automation fails. Confirm you're signed in to Azure with an account that has the roles listed in Before you start.
Your new integration doesn't appear in the Mondoo App. Refresh the page.
For deeper checks, including certificate, app registration, and permission issues, see Test or Troubleshoot an Azure Integration.