Automatically Set Up Azure Continuous Scanning

Use the keyless automated setup to configure the Mondoo Azure integration to scan Azure subscriptions

The automated setup is keyless. You run a generated az script in Azure Cloud Shell that creates an app registration and a federated identity credential trusting Mondoo. No client secret or certificate is created, stored, or rotated. The whole process takes a few minutes.

Two other setup paths are available on the same page:

Terraform setup runs cnspec integrate azure, which drives a Terraform run. It creates an app registration with a client secret.
Manual setup is for large environments, management group integrations, or key vaults that use the legacy access policy permission model.

Before you start

You need:

In Mondoo: Editor or Owner access in the space where you want to add the integration.
In Azure: the Azure CLI installed and configured, plus permission to create App Registrations in Microsoft Entra ID.
To assign app registration roles: Privileged Role Administrator or Global Administrator.
To assign reader roles: Owner or User Access Administrator on every subscription you want to scan.
Azure Cloud Shell access to run the scripts.

Check your Azure roles in the portal: Microsoft Entra ID > Users > (your account) > Assigned roles.

What the setup creates

The provisioning script creates these resources in your tenant:

Resource	Purpose
App registration	The `Mondoo Security` application and its service principal.
Federated identity credential	Trusts Mondoo as an OIDC identity provider so no secret is needed.
Directory Readers role	Lets Mondoo read Microsoft Entra ID without admin consent.
Reader role	Read access on every subscription you chose to scan.
`Mondoo VM Run Command` role	Only if you enable VM scanning. A custom role that permits read-only Run Command execution.

Set up the integration

Step 1: Open the Azure integration

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations, then select + INSTALL in the top right. Find Azure and select it.

The Automated Setup tab is selected by default.

Automated approach to adding an Azure integration to Mondoo

Step 2: Verify permissions (preflight check)

Under Verify permissions (preflight check), copy the read-only snippet and run it in Azure Cloud Shell. It checks whether your account can create app registrations and assign roles on your subscriptions.

Each check prints one of:

Result	Meaning
`OK`	You have the role.
`COULD NOT CONFIRM`	No direct role assignment was found. You may still hold the role through a group.
`MISSING`	You don't have the role. Get it assigned before continuing, or the provisioning script fails.

The snippet only reads; it changes nothing in your tenant.

Step 3: Enable security policies (optional)

Under Enable security policies, choose the policies on which you want to base assessments of your Azure environment. To learn more, read Manage Policies.

Step 4: Choose scan targets

To automatically discover and scan Linux and Windows virtual machines using Azure Run Command, enable Scan virtual machines. This adds the custom Mondoo VM Run Command role to the provisioning script.
Leave Scan all subscriptions connected to the Directory (tenant) ID enabled to scan every subscription in the tenant.
To scan only certain subscriptions, turn the toggle off, select Allow list, and enter one subscription ID per line (or comma-separated).
To scan everything except certain subscriptions, turn the toggle off, select Deny list, and enter the subscription IDs to exclude.

To find your subscription IDs, go to Subscriptions in the Azure portal.

Your scan target choices are baked into the provisioning script Mondoo generates in Step 6, so make them before you create the integration.

Step 5: Create the integration

In the Directory (Tenant) ID box, enter your Microsoft Entra tenant ID. Find it in the Azure portal under Microsoft Entra ID > Overview.
Select Create integration.

Mondoo creates a keyless integration record and returns the federation details (issuer and subject) that the provisioning script needs. No token or secret is generated or stored.

Finish both remaining steps

The integration isn't usable until you complete Steps 6 and 7. If you leave the page now, you'll have an incomplete integration you need to delete and recreate.

Step 6: Run the provisioning script

Copy the script Mondoo generated.
Select Azure Cloud Shell to open Cloud Shell in a new tab, then paste the script and press Enter. You can also run it from any shell with the Azure CLI installed and signed in to the target tenant.
When the script finishes, it prints a Client ID. Copy that value.

Step 7: Finish

Back in Mondoo, paste the value into the Application (client) ID box.
Select Finish.

Mondoo begins scanning your Azure resources. When the first scan completes, you can see results on the INVENTORY page. To learn more, read Monitor Your Infrastructure Security.

Troubleshoot

The preflight check reports MISSING. Get the named role assigned to your account, then run the check again. COULD NOT CONFIRM is not a failure; it means the role wasn't found as a direct assignment and may come from a group.
The provisioning script fails partway through. Confirm you're signed in to Azure with an account that has the roles listed in Before you start, then run the script again.
The script printed no Client ID. It didn't reach the end. Scroll back for the error, fix it, and re-run the script.
Your new integration doesn't appear in the Mondoo App. Refresh the page.
For deeper checks, including app registration and permission issues, see Test or Troubleshoot an Azure Integration.