Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configure Agentless Scanning for Azure

  1. Log in to your Prisma Cloud Compute Console.

  2. Go to Manage > Cloud Accounts.

  3. Click +Add account.

  4. Enter the needed information in the Account config pane.

    azure managed identity auth

    1. Select Cloud provider: Azure

    2. Name: For example: PCC Azure Agentless.

    3. Description: Provide an optional string, for example: <Product-name> release.

    4. Authentication method:

      1. Service key: Paste the JSON object for the Service Principal you created.

      2. Certificate: Use a client certificate for authentication.

      3. Managed Identity: Use Managed Identity authentication to access Azure resources without entering any client secrets or certificates.

  5. Click Next.

  6. Complete the configuration in the Scan account pane:

    agentless azure scan config basic

    1. Enable Agentless scanning.

    2. Set the Console URL and Port to the address of your Prisma Cloud console that can be reached from the internet. To create an address or FQDN reachable from the internet, complete the Subject Alternative Names procedure.

    3. Hub account: Enable the toggle to configure this account as a hub account.

      agentless hub toggle

    4. Expand Advanced settings and provide the appropriate values based on your deployment for the following items.

      agentless configuration azure

  7. Click Save to return to Compute > Manage > Cloud accounts.

Scan Settings

Select where to scan: For Azure accounts, you can decide between two scanning modes.

  • Same Account: Perform the agentless scanning process using this account.

  • Hub Account: Perform the agentless scanning process using a centralized hub account. Select another account from the list to use as the centralized hub account to scan this account.

Auto-scale Scanning

Automatically create the required amount of scanners to scan all of the hosts within a region, up to a limit of 50 scanners. To use a different limit specify the Max number of scanners.

Max number of scanners: Enter the upper limit of scanners that Prisma Cloud can automatically spin up within a region in your account for faster results.

Enforce Permissions Check

When enabled, this account isn’t scanned in case of failure to validate the required permissions.

When disabled, the pre-scan check to validate permissions is skipped. If permissions are missing or blocked by an organizational policy, the scan fails at that stage.

Review the needed permissions to enable agentless scanning in Azure.

Proxy

Enter a Proxy value if traffic leaving your Azure tenant uses a proxy.

Provide the proxy’s CA certificate.

Custom Tags

Custom tags: Apply custom tags to any resources Prisma Cloud creates during agentless scanning.

Scan Scope

Under Scan scope you can refine the scope of the scanning by Regions or using tags.

tags scope

  • All regions: Scan in all Azure regions.

  • Custom regions: Specify the Azure regions, which you want scanned.

  • Scan non running hosts: Choose whether or not to scan hosts that aren’t running.

  • Exclude hosts by tags: Select a subset of hosts which you want to exclude from the scan process

    You can use wildcards to specify a range of tags in both keys and values following these examples:

  • Include hosts by tags: Select a subset of hosts to scan

    You can use wildcards to specify a range of tags in both keys and values following these examples:

Network Resources

Configure custom network resources for agentless scanning. When using custom network resources, Prisma Cloud assumes those resources have a path to communicate outbound data to the Prisma Cloud backend, as explained in the networking infrastructure section. If left blank, Prisma Cloud creates the needed networking resources with default settings.

  • Subnet ID: The ID of the subnet resource in your Azure account.

  • Security group ID: The ID of the security group resource in your Azure account.

In Azure, Prisma Cloud does not use the network resources configured directly due to current limit of specifying only one identifier for each subnet or security group across all regions. Azure’s policy prohibits having duplicate subnet or security group IDs within the same resource group, making it unfeasible to ensure these resources exist in every region.

As a result, Prisma Cloud creates these network resources within the PCCAgentlessScanResourceGroup resource group, mirroring the configuration of the provided resources for the subnet and security group. Prisma Cloud copies the route table data to the new resources since this data may contain various addresses that might not necessarily align with the new subnet, such as private IP addresses.

Known Limitation

  • Ephemeral OS Disks Unsupported: Agentless scanning is not supported for Ephemeral disks since Azure does not support taking snapshots of hosts with Ephemeral OS disks.

PreviousOnboard Azure AccountsNextOnboard GCP Accounts

Last updated

Was this helpful?