Cloud security scans on Microsoft Azure automatically check your Azure subscriptions and your Microsoft 365 tenant for misconfigurations and security weaknesses, once per day. They run through the Microsoft Azure integration you already use to sync your targets — there's no separate product to set up.
🎫 Plan Availability: The Microsoft Azure integration and Microsoft 365 security checks are available on all plans. The number of cloud environments you can run cloud security scans on depends on your plan:
Free: 1 cloud environment
Cloud: up to 3 cloud environments
Pro: up to 10 cloud environments
Enterprise and Vanguard: unlimited cloud environments
What are cloud security scans on Azure?
Cloud security scans on Azure are automated daily checks Intruder runs against your connected Azure environment to find misconfigurations and security weaknesses. They read your configuration through the Azure app registration you set up when connecting the integration — no agents, and they don't consume target licenses.
Cloud security scans on Azure cover two levels: your Azure subscriptions and your Microsoft 365 tenant.
What Azure cloud security scans check
Cloud security scans on Azure check two levels of your environment:
Subscription level — misconfigurations across your Azure resources, such as identity and access, networking, storage, and logging, benchmarked against cloud security best practices
Tenant level (Microsoft 365 security checks) — configuration across Entra ID, Exchange Online, SharePoint, Teams, Intune, and Microsoft Defender, benchmarked against the CIS Microsoft 365 Benchmark. For example, flagging when your tenant has too many Global Administrators or when Defender for Identity has unresolved health issues.
Microsoft 365 security checks run once per connected Azure tenant. They need the full set of permissions granted during setup, including the two external API permissions and the Global Reader role — see the Microsoft Azure integration guide for the complete list.
How to set up cloud security scans on Azure
Cloud security scans run through the Microsoft Azure integration — set it up once, and scans run automatically. Follow the Microsoft Azure integration guide to create the app registration, grant the required permissions, and connect Azure to Intruder.
ℹ️ Note: Each Azure tenant needs its own integration. Repeat the setup for each tenant you want to scan.
How to manage and monitor your Azure scans
Cloud security scans run automatically once per day, and results appear on the Scans page, filtered by the Cloud security scan type. To enable or disable scans per subscription, or to set the default for newly discovered subscriptions, use the controls on your Azure integration's page — see managing cloud security scans in the integration guide.
If Intruder detects missing permissions or invalid credentials during a scan, you'll see an error in your portal. Update the app registration's permissions or client secret to resolve it.
How to manage which assets get synced
To control which Azure assets sync into Intruder as targets, use the sync rules on each subscription. See What is Cloud sync, and how do I use it? for how sync rules work.
FAQ
Do cloud security scans use licenses?
No. Cloud security scans and Microsoft 365 security checks don't consume target licenses. Targets that sync into Intruder use a license only when they're scanned for vulnerabilities.
Do I need a separate setup for Microsoft 365 security checks?
No. Microsoft 365 security checks run through the same Azure integration. They need a few extra permissions on the app registration, all covered in the Microsoft Azure integration guide.
How often do cloud security scans run?
Once per day, automatically.
Which cloud providers support cloud security scans?
Intruder supports cloud security scans for AWS, Azure, and Google Cloud. Let us know if you'd like to see another provider.
Troubleshooting
A specific Microsoft 365 check reports that an API isn't accessible.
Individual checks fail with a message naming the permission they need — for example, "Defender for Identity APIs are not accessible. Ensure the Service Principal has SecurityIdentitiesSensors.Read.All and SecurityIdentitiesHealth.Read.All permissions granted."
Cause: The named permission, or the Global Reader role, wasn't granted. → Fix: Add it to the app registration and grant admin consent — see the Microsoft Azure integration guide.
Cause: The check relies on a Microsoft 365 service you don't use. → Fix: No action needed — the check passes or is skipped when the service isn't present.
Scans stopped running successfully
Cause: Your client secret has expired. → Fix: Create a new secret in Azure and update it in the integration's settings.