> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-azure.md).
# Configure Agentless Scanning for Azure
Prisma Cloud gives you the flexibility to choose between agentless security and agent-based security using Defenders. Agentless scanning lets you inspect the risks and vulnerabilities of a cloud workload or container image without installing an agent or affecting the execution of your workload. Prisma Cloud supports agentless scanning for vulnerabilities and compliance on Azure hosts, containers, and clusters.
When you [onboard your Azure account](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/connect/connect-cloud-accounts/onboard-azure/onboard-azure.md), you can enable agentless scanning. Complete the steps below to configure agentless scanning based on the needs of your deployment.
Azure does not support taking snapshots of hosts with ephemeral OS disks due to which Prisma Cloud cannot scan such hosts that use ephemeral OS disks.
## Configure Agentless Scanning for Azure
1. Log in to Prisma Cloud Runtime Security.
2. Select **Runtime Security > Manage > Cloud Accounts**.
3. Click the edit button of your cloud account.
4. Go to the **Agentless Scanning** section.
5. **Hub account**: Enable the toggle to configure this account as a [hub account](/content-collections/runtime-security/agentless-scanning/agentless-scanning-modes.md).
6. Expand the **Advanced settings** and provide the appropriate values based on your deployment for the following items.
7. Click **Save** to return to **Compute > Manage > Cloud accounts**.
### Scan Settings
**Select where to scan**: For Azure accounts, you can decide between [two scanning modes](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#scanning-modes).
* **Same Account**: Perform the agentless scanning process using this account.
* **Hub Account**: Perform the agentless scanning process using a centralized hub account. Select another account from the list to use as the centralized hub account to scan this account.
### Auto-scale Scanning
Automatically create the required amount of scanners to scan all of the hosts within a region, up to a limit of 50 scanners. To use a different limit specify the **Max number of scanners**.
**Max number of scanners**: Enter the upper limit of scanners that Prisma Cloud can automatically spin up within a region in your account for faster results.
### Enforce Permissions Check
When enabled, this account isn’t scanned in case of failure to validate the required permissions.
When disabled, the pre-scan check to validate permissions is skipped. If permissions are missing or blocked by an organizational policy, the scan fails at that stage.
Review the [needed permissions to enable agentless scanning in Azure](/content-collections/runtime-security/configure/permissions.md#azure-agentless).
### Proxy
Enter a **Proxy** value if traffic leaving your Azure tenant uses a proxy.
Provide the proxy’s CA certificate.
### Custom Tags
Apply custom tags to any resources Prisma Cloud creates during agentless scanning.
### Scan Scope
Under **Scan scope** you can refine the scope of the scanning by **Regions** or using tags.
* **All regions**: Scan in all Azure regions.
* **Custom regions**: Specify the Azure regions, which you want scanned.
* **Scan non running hosts**: Choose whether or not to scan hosts that aren’t running.
* **Exclude hosts by tags**: Select a subset of hosts which you want to exclude from the scan process
You can use wildcards to specify a range of tags in both keys and values following these examples:
```
"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"
```
* **Include hosts by tags**: Select a subset of hosts to scan
You can use wildcards to specify a range of tags in both keys and values following these examples:
```
"abcd*"
"*abcd"
"abcd"
"*"
"*abcd*"
```
### Network Resources
Configure custom network resources for agentless scanning. When using custom network resources, Prisma Cloud assumes those resources have a path to communicate outbound data to the Prisma Cloud backend, as explained in the [networking infrastructure section](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#networking-infrastructure). If left blank, Prisma Cloud creates the needed [networking resources with default settings](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/runtime-security/agentless-scanning/agentless-scanning.md#networking-infrastructure).
* **Subnet ID**: The ID of the subnet resource in your Azure account.
* **Security group ID**: The ID of the security group resource in your Azure account.
In Azure, Prisma Cloud does not use the network resources configured directly due to current limit of specifying only one identifier for each subnet or security group across all regions. Azure’s policy prohibits having duplicate subnet or security group IDs within the same resource group, making it unfeasible to ensure these resources exist in every region.
As a result, Prisma Cloud creates these network resources within the `PCCAgentlessScanResourceGroup` resource group, mirroring the configuration of the provided resources for the subnet and security group. Prisma Cloud copies the route table data to the new resources since this data may contain various addresses that might not necessarily align with the new subnet, such as private IP addresses.
## Known Limitation
* **Ephemeral OS Disks Unsupported:** Agentless scanning is not supported for Ephemeral disks since Azure does [not support](https://learn.microsoft.com/en-us/azure/virtual-machines/ephemeral-os-disks#unsupported-features) taking snapshots of hosts with Ephemeral OS disks.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.prismacloud.io/content-collections/runtime-security/agentless-scanning/configure-accounts/configure-azure.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.