Skip to content

Getting Started With Azure on Prowler

Prowler App

Walkthrough video onboarding an Azure Subscription using Service Principal.

Government Cloud Support

Government cloud subscriptions (Azure Government) are not currently supported, but we expect to add support for them in the near future.

Prerequisites

Before setting up Azure in Prowler App, you need to create a Service Principal with proper permissions.

For detailed instructions on how to create the Service Principal and configure permissions, see Authentication > Service Principal.

Step 1: Get the Subscription ID

  1. Go to the Azure Portal and search for Subscriptions

  2. Locate and copy your Subscription ID

    Search Subscription Subscriptions Page

Step 2: Access Prowler App

  1. Navigate to Prowler Cloud or launch Prowler App

  2. Navigate to Configuration > Cloud Providers

    Cloud Providers Page

  3. Click on Add Cloud Provider

    Add a Cloud Provider

  4. Select Microsoft Azure

    Select Microsoft Azure

  5. Add the Subscription ID and an optional alias, then click Next

    Add Subscription ID

Step 3: Add Credentials to Prowler App

Having completed the Service Principal setup from the Authentication guide:

  1. Go to your App Registration overview and copy the Client ID and Tenant ID

    App Overview

  2. Go to Prowler App and paste:

    • Client ID
    • Tenant ID
    • Client Secret from earlier

    Prowler Cloud Azure Credentials

  3. Click Next

    Next Detail

  4. Click "Launch Scan"

    Launch Scan Azure

Prowler CLI

Configure Azure Credentials

To authenticate with Azure, Prowler CLI supports multiple authentication methods. Choose the method that best suits your environment.

For detailed authentication setup instructions, see Authentication.

Service Principal (Recommended)

Set up environment variables:

export AZURE_CLIENT_ID="XXXXXXXXX"
export AZURE_TENANT_ID="XXXXXXXXX"
export AZURE_CLIENT_SECRET="XXXXXXX"

Then run:

prowler azure --sp-env-auth

Azure CLI Credentials

Use stored Azure CLI credentials:

prowler azure --az-cli-auth

Browser Authentication

Authenticate using your default browser:

prowler azure --browser-auth --tenant-id <tenant-id>

Managed Identity

When running on Azure resources:

prowler azure --managed-identity-auth

Subscription Selection

To scan a specific Azure subscription:

prowler azure --subscription-ids <subscription-id>

To scan multiple Azure subscriptions:

prowler azure --subscription-ids <subscription-id1> <subscription-id2> <subscription-id3>