Configure Agentless Scanning for Azure

Prisma Cloud gives you the flexibility to choose between agentless security and agent-based security using Defenders. Agentless scanning lets you inspect the risks and vulnerabilities of a cloud workload or container image without installing an agent or affecting the execution of your workload. Prisma Cloud supports agentless scanning for vulnerabilities and compliance on Azure hosts, containers, and clusters.

When you onboard your Azure account, you can enable agentless scanning. Complete the steps below to configure agentless scanning based on the needs of your deployment.

Azure does not support taking snapshots of hosts with ephemeral OS disks due to which Prisma Cloud cannot scan such hosts that use ephemeral OS disks.

Configure Agentless Scanning for Azure

1. Log in to Prisma Cloud Runtime Security.
2. Select Runtime Security > Manage > Cloud Accounts.
3. Click the edit button of your cloud account.
4. Go to the Agentless Scanning section.
5. Hub account: Enable the toggle to configure this account as a hub account.

   
6. Expand the Advanced settings and provide the appropriate values based on your deployment for the following items.

   
7. Click Save to return to Compute > Manage > Cloud accounts.

Scan Settings

Select where to scan: For Azure accounts, you can decide between two scanning modes.

• Same Account: Perform the agentless scanning process using this account.
• Hub Account: Perform the agentless scanning process using a centralized hub account. Select another account from the list to use as the centralized hub account to scan this account.

Auto-scale Scanning

Automatically create the required amount of scanners to scan all of the hosts within a region, up to a limit of 50 scanners. To use a different limit specify the Max number of scanners.

Max number of scanners: Enter the upper limit of scanners that Prisma Cloud can automatically spin up within a region in your account for faster results.

Enforce Permissions Check

When enabled, this account isn’t scanned in case of failure to validate the required permissions.

When disabled, the pre-scan check to validate permissions is skipped. If permissions are missing or blocked by an organizational policy, the scan fails at that stage.

Review the needed permissions to enable agentless scanning in Azure.

Proxy

Enter a Proxy value if traffic leaving your Azure tenant uses a proxy.

Provide the proxy’s CA certificate.

Custom Tags

Apply custom tags to any resources Prisma Cloud creates during agentless scanning.

Scan Scope

Under Scan scope you can refine the scope of the scanning by Regions or using tags.

• All regions: Scan in all Azure regions.
• Custom regions: Specify the Azure regions, which you want scanned.
• Scan non running hosts: Choose whether or not to scan hosts that aren’t running.
• Exclude hosts by tags: Select a subset of hosts which you want to exclude from the scan process

  You can use wildcards to specify a range of tags in both keys and values following these examples:

  "abcd*"
  "*abcd"
  "abcd"
  "*"
  "*abcd*"

• Include hosts by tags: Select a subset of hosts to scan

  You can use wildcards to specify a range of tags in both keys and values following these examples:

  "abcd*"
  "*abcd"
  "abcd"
  "*"
  "*abcd*"

Network Resources

Configure custom network resources for agentless scanning. When using custom network resources, Prisma Cloud assumes those resources have a path to communicate outbound data to the Prisma Cloud backend, as explained in the networking infrastructure section. If left blank, Prisma Cloud creates the needed networking resources with default settings.

• Subnet ID: The ID of the subnet resource in your Azure account.
• Security group ID: The ID of the security group resource in your Azure account.

In Azure, Prisma Cloud does not use the network resources configured directly due to current limit of specifying only one identifier for each subnet or security group across all regions. Azure’s policy prohibits having duplicate subnet or security group IDs within the same resource group, making it unfeasible to ensure these resources exist in every region.

As a result, Prisma Cloud creates these network resources within the PCCAgentlessScanResourceGroup resource group, mirroring the configuration of the provided resources for the subnet and security group. Prisma Cloud copies the route table data to the new resources since this data may contain various addresses that might not necessarily align with the new subnet, such as private IP addresses.

Known Limitation

• Ephemeral OS Disks Unsupported: Agentless scanning is not supported for Ephemeral disks since Azure does not support taking snapshots of hosts with Ephemeral OS disks.