Test or Troubleshoot an Azure Integration

If an Azure integration fails to scan, run the same checks from cnspec to isolate whether the issue is the certificate, the app registration, or your permissions.

Scan with cnspecCopy Anchor Link

1. Download the latest cnspec from releases.mondoo.com/cnspec. For example:

   Copy Text

   wget https://releases.mondoo.com/cnspec/14.0.1/cnspec_14.0.1_linux_amd64.tar.gz
   tar -xvf cnspec_14.0.1_linux_amd64.tar.gz

2. Scan your Azure subscription:

   Copy Text

   cnspec scan azure \
     --subscription YOUR-SUBSCRIPTION-ID \
     --tenant-id YOUR-TENANT-ID \
     --client-id YOUR-CLIENT-ID \
     --certificate-path certificate.combo.pem \
     --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-azure-security.mql.yaml

   The client ID is the same as the application ID (or app ID).

Pay attention to queries with Error results. They usually point at missing permissions.

If the certificate scan fails, try a client secretCopy Anchor Link

Authenticate with a client secret to isolate certificate issues:

1. Create a client secret:

   1. In the Azure portal, open Microsoft Entra ID > App registrations.
   2. Select the Mondoo app.
   3. Select Certificates & secrets > New client secret.
   4. Enter a description and a Duration.
   5. Select Add and copy the Value immediately (it disappears shortly).

2. Scan with the secret:

   Copy Text

   cnspec scan azure \
     --subscription YOUR-SUBSCRIPTION-ID \
     --tenant-id YOUR-TENANT-ID \
     --client-id YOUR-CLIENT-ID \
     --client-secret YOUR-CLIENT-SECRET-VALUE \
     --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-azure-security.mql.yaml

   If this scan succeeds, the issue is the certificate. Generate and upload a new one.

If the app scan fails, try direct authenticationCopy Anchor Link

To rule out the app registration itself, scan as your own user account. This only works if your account has the needed privileges.

cnspec scan azure \
  --subscription YOUR-SUBSCRIPTION-ID \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-azure-security.mql.yaml

Renew the application certificateCopy Anchor Link

If you set up the integration with the Terraform setup, the application certificate cnspec integrate azure created has a limited lifetime: 4,096 hours, roughly 170 days. When the certificate expires, the integration stops working. Renew it from the Azure CLI, which creates a new certificate with the Azure CLI's own default lifetime of 1 year. The keyless automated setup uses no certificate, so it has nothing to renew.

To renew the certificate:

1. Navigate to the app registration you created for Mondoo. Copy its application ID for the next step.

2. Open Azure Cloud Shell (top right of the window) and create a new certificate, inserting the application ID you copied:

   Copy Text

   az ad app credential reset --id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX --create-cert

3. The certificate is stored in your cloud shell. Download it using the Manage files button in Azure Cloud Shell.

4. In the Mondoo App, open Settings > Credentials for the space. Find the certificate credential that belongs to your Azure integration, then select Rotate.

5. Upload the new certificate file and select ROTATE. The integration starts using it to communicate with Azure.

   If you can't find a credential for the integration (its edit page has no Authentication step), its certificate can't be replaced from the Mondoo App. Recreate the integration, preferably with the keyless automated setup.

Still stuck?Copy Anchor Link

If none of the above works, try Microsoft's manual app registration path: Manually Set Up Azure Continuous Scanning.