Azure Cloud Discovery

^{Last Updated}^{: 2025-12-03}

Purpose

This article describes how to set up Microsoft Azure the App for Discovery on OUTSCAN.

Introduction

Azure Cloud Discovery enables Outpost24 to enumerate and import Azure virtual machine instances by querying the Azure API using provided credentials. It captures identifiers such as tenant, subscription, resource group, and any associated IPs, hostnames or MAC addresses, and applies import tags based on those attributes. This capability enhances visibility into Azure environments and ensures that dynamically changing infrastructure is reliably reflected within the vulnerability management system.

Prerequisites

Microsoft Azure account (Home - Microsoft Azure)
The Azure account must be at least a Application Developer

Setup the App for Discovery in Azure

Register an Application

To obtain the credentials needed for the azure discovery process, an application must be created.

To register an Application, follow the procedure in this link: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

To read more about Microsoft Entra ID applications: https://learn.microsoft.com/en-us/entra/identity-platform/how-applications-are-added

Create a Role

To discover resources, we must create a role in IAM, which is belongs to a subscription, you can read more about it in Organize your Azure resources effectively.

Go to the current subscription > IAM.
Click Add followed by Add custom role.

In Create a custom role, provide the JSON with the necessary permissions, replace your role name and your subscription ID.

Create a custom role

JavaScript

{
    "properties": {
        "roleName": "<Your role name here>",
        "description": "",
        "assignableScopes": [
            "/subscriptions/<Your subscription ID here>"
        ],
        "permissions": [
            {
                "actions": [
                    "Microsoft.Compute/virtualMachines/*/read",
                    "Microsoft.Compute/virtualMachines/read",
                    "Microsoft.Network/networkInterfaces/read",
                    "Microsoft.Network/networkInterfaces/*/read",
                    "Microsoft.Network/publicIPAddresses/read",
                    "Microsoft.Network/publicIPAddresses/*/read",
                    "Microsoft.Resources/subscriptions/read",
                    "Microsoft.Resources/subscriptions/*/read",
                    "Microsoft.Network/dnszones/read",
                    "Microsoft.Network/dnszones/*/read"
                ],
                "notActions": [],
                "dataActions": [],
                "notDataActions": []
            }
        ]
    }
}

After saving the changes, press Review + Create and create the role with the necessary permissions.

Assign the Role to the App

Go to the newly created role in Subscription > IAM > Add > Add role assignment.
Filter by type Custom Role and select that role.
Select a member in Select members, which is the app name previously created.
Review + Assign to finish the process.

Create Azure Credential in Portal

Obtain application’s information in Microsoft Entra ID > Applications.
Fill it in the Portal’s new credential. See Generate Azure Credentials for more information.
1. In the drop-down menu select Microsoft Azure.
2. Add the Name of your Azure account.
3. Add the Tenant ID.
4. Add the Client ID.
5. Add the Secret.
See Steps to Find Azure Parameters in the Azure Console for reference
1. Click the blue Add button.

Run Discovery

Create a new discovery scan, with selected credential and perform the scan.

Create a scan configuration. You can provide subscription directly by input string inside input Subscriptions, or you can leave empty and trigger scan for the first time to get all subscription.
Click on the Scan icon to run the first time to get all the subscriptions.
Wait till the scan is finished.

🕘 …

check mark

Go back to scan configuration and update scan configuration with subscription.
Click on the Scan icon to run the scan. Trigger the scan and wait till the scan is finished.
Wait till the scan is finished.