- After deployment, copy Tenant ID and{" "} - Application ID from the deployment outputs. The - certificate private key you generated locally goes in the - “Certificate Private Key” field below. -
-
- Generate a self-signed X.509 certificate right in your browser.
-
- {" "}
- The certificate and private key are generated locally
-
- . The base64-encoded certificate/private-key bundle goes into the
- field below and is submitted with the rest of the form. The public
- certificate downloads as a text file for you to paste into the Bicep{" "}
- Certificate Base64 parameter in the Portal.
+ Your Azure account needs permissions in two separate systems.
+ The wizard cannot work around a missing role — request them from your
+ Azure administrator if needed:
{generatorError}
- )} - {generatedThumbprint && ( -
- Done. Certificate SHA-1 thumbprint:{" "}
- {generatedThumbprint}. Downloaded{" "}
- prowler-cert-base64.txt — paste its contents into the
- Bicep Certificate Base64 parameter, then keep filling
- the fields below.
-
Reader and custom ProwlerRole{" "}
+ roles.
+
+ Open the Portal in a new tab, sign in to the tenant you want
+ Prowler to scan, and register a new application. Any name works
+ (e.g. Prowler); keep the default single-tenant
+ audience and no redirect URI.
+
+ In your new App Registration, open{" "}
+ Certificates & secrets → Certificates → Upload
+ certificate and upload the public certificate file
+ (.cer). The button below generates the keypair in your
+ browser — the private key is auto-filled into the form below and
+ the public certificate downloads as a text file you decode and
+ upload.
+
+ The certificate never leaves your browser.{" "} + Prowler generates the keypair client-side and only receives the + private half; the public half goes to Entra ID via the manual + upload. +
+ + {generatorError && ( ++ {generatorError} +
+ )} + {generatedThumbprint && ( +
+ Done. Certificate SHA-1 thumbprint:{" "}
+ {generatedThumbprint}. Downloaded{" "}
+ prowler-cert-base64.txt — decode it back to a{" "}
+ .cer with{" "}
+ base64 -D -i prowler-cert-base64.txt -o prowler.cer{" "}
+ and upload prowler.cer in the Portal.
+
+ Prefer the command line? See the{" "} + + openssl / PowerShell instructions + + . +
++ You need the App Registration's Service Principal + Object ID — not the same as the App Registration's + Object ID. Find it in{" "} + + Entra ID → Enterprise applications + {" "} + → search for the app you just created → Overview → Object + ID. Then click Deploy to Azure below and paste that Object ID + when the Portal asks. +
+ ++ Copy the Tenant ID from Entra ID → Overview, + the Application (client) ID from your App + Registration's Overview page, and paste both into the fields + below. The private key field is already pre-filled from step 2 (or + paste your own base64-encoded PEM bundle / PKCS#12 if you + generated the keypair manually). +
+- This is the base64-encoded private key that matches the - certificate uploaded to Entra ID by the Bicep template (not the public + This is the base64-encoded private key that matches + the certificate you uploaded to Entra ID in step 2 (not the public certificate, and not the thumbprint). Use the{" "} - Generate certificate for me button above, or follow the manual - openssl / PowerShell instructions in the{" "} + Generate certificate for me button in step 2, or follow the + manual openssl / PowerShell instructions in the{" "} export const PROWLER_CF_TEMPLATE_URL = "https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/aws/cloudformation/prowler-scan-role.yml"; -// ARM JSON template URL for the Prowler quick-start Azure deployment (App -// Registration + Service Principal + Reader + custom ProwlerRole + certificate -// credential). The template is authored in Bicep at -// `permissions/templates/azure/bicep/prowler-scan.bicep` and compiled to ARM -// JSON at `prowler-scan.json` — the Azure Portal `#create/Microsoft.Template` -// deep link only accepts ARM JSON, not raw Bicep source. Regenerate with -// `make -C permissions/templates/azure/bicep build` after editing the .bicep. -// URL-encoded and appended to the Portal deep link built by -// `getAzureDeploymentQuickLink` below. Points at the same public S3 bucket -// that hosts the AWS templates. +// ARM JSON template URL for the Prowler quick-start Azure deployment. The +// template only grants a pre-existing App Registration the read-only +// subscription roles Prowler needs (built-in `Reader` + custom +// `ProwlerRole`); the App Registration itself and its certificate credential +// are created through the Portal UI in earlier wizard steps, because +// `Microsoft.Graph/*` Bicep resources are not deployable via the Portal +// `Deploy to Azure` URL flow (`msgraph-bicep-types` issue #294, closed as a +// documented Microsoft limitation). +// +// Authored in Bicep at `permissions/templates/azure/bicep/prowler-scan.bicep` +// and compiled to ARM JSON at `prowler-scan.json` — the Azure Portal +// `#create/Microsoft.Template` deep link only accepts ARM JSON, not raw +// Bicep source. Regenerate with `make -C permissions/templates/azure/bicep +// build` after editing the .bicep. URL-encoded and appended to the Portal +// deep link built by `getAzureDeploymentQuickLink` below. Points at the same +// public S3 bucket that hosts the AWS templates. export const PROWLER_AZURE_BICEP_TEMPLATE_URL = "https://prowler-cloud-public.s3.eu-west-1.amazonaws.com/permissions/templates/azure/bicep/prowler-scan.json";