prowler/docs/tutorials/azure/getting-started-azure.md

Getting Started With Azure on Prowler

Prowler App

> Walkthrough video onboarding an Azure Subscription using Service Principal.

???+ note "Government Cloud Support" Government cloud subscriptions (Azure Government) are not currently supported, but we expect to add support for them in the near future.

Prerequisites

Before setting up Azure in Prowler App, you need to create a Service Principal with proper permissions.

For detailed instructions on how to create the Service Principal and configure permissions, see Authentication > Service Principal.

---

Step 1: Get the Subscription ID

1. Go to the Azure Portal and search for Subscriptions

2. Locate and copy your Subscription ID

   

---

Step 2: Access Prowler App

1. Navigate to Prowler Cloud or launch Prowler App

2. Navigate to Configuration > Cloud Providers

   

3. Click on Add Cloud Provider

   

4. Select Microsoft Azure

   

5. Add the Subscription ID and an optional alias, then click Next

   

Step 3: Add Credentials to Prowler App

Having completed the Service Principal setup from the Authentication guide:

1. Go to your App Registration overview and copy the Client ID and Tenant ID

   

2. Go to Prowler App and paste:

   • Client ID
   • Tenant ID
   • Client Secret from earlier

   

3. Click Next

   

4. Click "Launch Scan"

   

---

Prowler CLI

Configure Azure Credentials

To authenticate with Azure, Prowler CLI supports multiple authentication methods. Choose the method that best suits your environment.

For detailed authentication setup instructions, see Authentication.

Service Principal (Recommended)

Set up environment variables:

export AZURE_CLIENT_ID="XXXXXXXXX"
export AZURE_TENANT_ID="XXXXXXXXX"
export AZURE_CLIENT_SECRET="XXXXXXX"

Then run:

prowler azure --sp-env-auth

Azure CLI Credentials

Use stored Azure CLI credentials:

prowler azure --az-cli-auth

Browser Authentication

Authenticate using your default browser:

prowler azure --browser-auth --tenant-id <tenant-id>

Managed Identity

When running on Azure resources:

prowler azure --managed-identity-auth

Subscription Selection

To scan a specific Azure subscription:

prowler azure --subscription-ids <subscription-id>

To scan multiple Azure subscriptions:

prowler azure --subscription-ids <subscription-id1> <subscription-id2> <subscription-id3>