Focus

Prisma Cloud Compute Edition Administrator’s Guide

Onboard Azure Accounts for Agentless Scanning

Table of Contents

Onboard Azure Accounts for Agentless Scanning

Agentless scanning lets you inspect the risks and vulnerabilities of a cloud workload without having to install an agent or affecting the execution of the workload. Prisma Cloud gives you the flexibility to choose between agentless and agent-based security using Defenders. Prisma Cloud supports agentless scanning on Azure hosts, containers, and clusters for vulnerabilities and compliance. To learn more about how agentless scanning works, see the How Agentless Scanning Works?

This guide enables Agentless scanning for Prisma Cloud Compute Edition (PCCE or self-hosted) in Azure. The procedure shows you how to complete the following tasks.

Create a role and a service principal in Azure.

Configure agentless scanning in the Prisma Cloud console.

Start an agentless scan.

Create a Role and a Service Principal in Azure

Download the azureAgentlessPermissions.json file.

Determine your subscriptionId with the following Azure CLI command.

az account subscription list

Replace <subscriptionId> in the azureAgentlessPermissions.json file with your Azure subscriptionId. You can find the field under the "AssignableScopes": [ "/subscriptions/<subscriptionId>"] element.

Create the role using the JSON file with the following Azure CLI command.

az role definition create --role-definition azureAgentlessPermissions.json

Create a Service Principal account with the following Azure CLI command.

az ad sp create-for-rbac --name PCEE-Agentless --role "Prisma Cloud Compute Agentless Scanner" --scope /subscriptions/<subscriptionId> --sdk-auth

Copy and save the returned JSON object for the Service Principal, for example:

{
  "clientId": "<clientId>",
  "clientSecret": "<clientSecret>",
  "subscriptionId": "<subscriptionId>",
  "tenantId": "<tenantId>",
  "activeDirectoryEndpointUrl": "https://login.microsoftonline.com",
  "resourceManagerEndpointUrl": "https://management.azure.com/",
  "activeDirectoryGraphResourceId": "https://graph.windows.net/",
  "sqlManagementEndpointUrl": "https://management.core.windows.net:8443/",
  "galleryEndpointUrl": "https://gallery.azure.com/",
  "managementEndpointUrl": "https://management.core.windows.net/"
}

Configure Agentless Scanning

Complete the agentless scanning configuration for your Azure accounts.

Configure Managed Identities for Azure

Onboard your Azure Cloud account using Managed Identity authentication method to access Azure resources that support AD authentication without adding the service keys in Prisma Console.

Create a Managed Identity in Azure

There are two types of managed identities: System-assigned
and User-assigned
.

Prerequisites
:

Create a VM in Azure.

Install Console and Defender on the VM in Azure and both the Console and the Defender must use the same version.

Assign Azure roles to a managed identity. The minimum required permission role is "Contributor".

To enable System assigned managed identity:

Go to your Virtual Machine and select Identity
.

Under System assigned, Status
select On
.

Select the Azure role assignments
, the minimum required permission Role
is Contributor
.

Click Save
.

To enable User assigned managed identity:

Create a user-assigned managed identity in the same Resource group as the VM.

Go to your Virtual Machine and select Identity
.

Add the role you created under Add user assigned managed identity
.

Click Add
.

Configure Azure Managed Identity in Prisma

Prerequisite
:

Create a Managed Identity in Azure.

Go to Manage > Cloud accounts > Add account
.

Select cloud provider
as Azure.

Select your Region type
.

Specify an Account Name
.

Add a Description
, this is optional.

Select the Authentication method
as Managed Identity
.

Select the Managed Identity type
.

System Assigned
: Enter your Subscription ID

User Assigned
: Enter your Subscription ID
and Client ID
.

Select Next
and complete the setup.

Start an Agentless Scan

Agentless scans start immediately after onboarding the cloud account. By default, agentless scans are performed every 24 hours, but you can change the interval on the Manage > System > Scan
page under Scheduling > Agentless
.