🎫 Plan Availability: The MS Azure integration and Microsoft 365 security checks are available on all plans.

The number of cloud environments you can run cloud security scans on depends on your plan:

Free Plan: Run cloud security scans on 1 cloud environment
Cloud Plan: Run cloud security scans on up to 3 cloud environments
Pro Plan: Run cloud security scans on up to 10 cloud environments
Enterprise and Vanguard: Run cloud security scans on unlimited cloud environments

ℹ️ Note:

Our Azure integration synchronizes DNS A records only. External-facing IPs and hostnames are supported automatically, while App Service endpoints and internal-only VMs must be added manually.
Intruder scans comply with Microsoft's Penetration Testing Rules of Engagement.

Introduction

The Microsoft Azure integration connects Intruder to your Azure environment. Once connected, Intruder automatically syncs your external-facing assets as targets, runs daily cloud security scans on your subscriptions, and runs Microsoft 365 security checks across your tenant — all from a single read-only app registration you set up once.

What are Microsoft 365 security checks?

Microsoft 365 security checks are automated configuration checks that Intruder runs against your Microsoft 365 tenant to find security misconfigurations, benchmarked against the CIS Microsoft 365 Benchmark. They inspect settings across Entra ID, Exchange Online, SharePoint, Teams, Intune, and Microsoft Defender — for example, flagging when your tenant has too many Global Administrators or when Defender for Identity has unresolved health issues.

Microsoft 365 security checks run automatically as part of your daily cloud security scans, once per connected Azure tenant. They only return complete results once your app registration has the full set of permissions in Setup Step 1 — including the two external API permissions and the Global Reader role.

How to add an Azure Cloud Environment

There are three places where you can add the Azure integration:

1a. From the Targets page, click '+Add target' > Cloud environments > Microsoft Azure:

⬇️

1b. From the Integrations page. Click + Add, under Azure:

1c. The Discovery page by clicking the yellow + Add asset button > Microsoft Azure:

Setup Instructions

To integrate your Azure environment with Intruder, we need to do the following:

Create an app registration
Grant the app registration the following Graph API permissions:
- AuditLog.Read.All
- Directory.Read.All
- Policy.Read.All
- UserAuthenticationMethod.Read.All
- OnPremDirectorySynchronization.Read.All
- SecurityIdentitiesHealth.Read.All
- SecurityIdentitiesSensors.Read.All
- SharePointTenantSettings.Read.All
- ThreatHunting.Read.All
- DeviceManagementServiceConfig.Read.All
- DeviceManagementConfiguration.Read.All
- DeviceManagementManagedDevices.Read.All
Grant the external API permissions (Office 365 Exchange Online, Skype, and Teams) for Microsoft 365 security checks
Assign the Global Reader role to the app registration
Create a client secret for the app registration
Get the Directory (tenant) ID, Application ID and Client secret and use them in Intruder Portal to add the Azure integration

Step 1 - Creating an App Registration

ℹ️ Note: There are two different options available for configuring the App Registration - please find links to each of these below:

Option A (in the Azure Web Portal)
Option B (using PowerShell)

Option A (in the Azure Web Portal)

Log in to the Azure Portal (portal.azure.com)
Search for App Registrations in the top search bar.
Click + New registration
Provide a name for your app (e.g., Intruder Connector), leave the default values present, and click Register.
In the top toolbar, search for IntruderConnector (or the name you used for the app registration)
Navigate to Manage → API permissions
Select Add a permission → Microsoft Graph → Application permissions.

Please ensure that you select 'Application Permissions' as this is the type we need for the Integration to work!
Enable the following permissions:
- AuditLog.Read.All
- Directory.Read.All
- Policy.Read.All
- UserAuthenticationMethod.Read.All
- OnPremDirectorySynchronization.Read.All
- SecurityIdentitiesHealth.Read.All
- SecurityIdentitiesSensors.Read.All
- SharePointTenantSettings.Read.All
- ThreatHunting.Read.All
- DeviceManagementServiceConfig.Read.All
- DeviceManagementConfiguration.Read.All
- DeviceManagementManagedDevices.Read.All
Click Add permissions

Then select Grant admin consent for [Your Tenant], confirming the selection.
Ensure all permissions have a green check in the Status column.
Add the external API permissions (needed for Microsoft 365 security checks). These live under the "APIs my organization uses" tab, not "Microsoft APIs".

ℹ️ Note: When searching for external API permissions, please type the full name manually. Microsoft's search functionality may not return results for pasted or partial entries.

First, add Exchange Online:
1. Click Add a permission → APIs my organization uses.
2. Type Office 365 Exchange Online word for word and select it. If it doesn't appear, search by its app ID 00000002-0000-0ff1-ce00-000000000000.
3. Choose Application permissions (not Delegated — app-only auth for the Exchange PowerShell module requires application permission).
4. Expand the Exchange group, tick Exchange.ManageAsApp, then click Add permissions.

Then add Teams:
5. Go back to the APIs my organization uses tab.
6. Type Skype and Teams Tenant Admin API word for word and select it. If it doesn't appear, search by its app ID 48ac35b8-9aa8-4d74-927d-1f4a14a0b239.
7. Choose Application permissions.
8. Tick application_access, then click Add permissions.
9. Back on the API permissions screen, click Grant admin consent for [your tenant] and confirm. The Status column must show a green check ("Granted").
In the top toolbar, search for Management Groups
Select your root management group (usually Tenant Root Group).

⚠️ If you see, "You are not authorized to view this Management Group," when trying to click "Tenant Root Group," try navigating to Tenant properties and toggling "Access management for Azure resources" to "Yes":
👇
👇
Click Access control (IAM) → Role assignments
Choose Add → Add role assignment
Select the Reader role:

Click on the Members tab, and then Select members.

In the Select Members panel, search for the name of the app registration that you created earlier, then click on it and click Select
Click Review + assign (twice) to complete
Assign the Global Reader role (needed for Microsoft 365 security checks). This gives the app read-only visibility across the Microsoft 365 admin settings that the API permissions don't cover.

1. Go to Microsoft Entra ID (Azure Active Directory).
2. In the left menu, click Roles and administrators.
3. In the search box, type Global Reader and click the role name to open it.
4. Click + Add assignments.
5. In the Add assignments panel, click No member selected.
6. Search for your app registration's name and select it.
7. Click Add at the bottom of the panel.
8. To verify: back on the Global Reader page, click Assignments and confirm your app is listed.

⚠️ Important: The picker lists users, groups, and apps (service principals) together. Make sure you select your app — not a user with a similar name.
Return to App registrations and open your app.

Note the Application (client) ID and Directory (tenant) ID from this page - you will need to copy these across to the Intruder portal
Navigate to Manage → Certificates & secrets → Client secrets
1. Click + New client secret, provide a name and expiry, and click Add
Note the Value of the secret - this is the final data point you will need to copy across to the Intruder portal.

Move to Step 2: Integrate Azure with Intruder

Option B (using PowerShell)

The script below will set up the application and all the required permissions. The example app in the script will be created with the name IntruderConnector and a client secret with 12-month expiration. Adjust the values as needed.

First, ensure you have the PowerShell modules for Azure and Microsoft Graph installed:

Install-Module -Name Az -AllowClobber -Scope CurrentUser

Install-Module -Name Microsoft.Graph -AllowClobber -Scope CurrentUser

Then, run the following script:

function New-IntruderConnector {
    [CmdletBinding()]
    param(
        [string] $DisplayName = "IntruderConnector",
        [string] $RedirectUri = "https://portal.azure.com/",
        [int]    $SecretMonths = 12
    )

    # 1. Create an app registration (with a redirect URI so admin consent works)
    $app = New-AzADApplication -DisplayName $DisplayName -ReplyUrls $RedirectUri
    $appId = $app.AppId
    $tenantId = (Get-AzContext).Tenant.Id

    # 2. Add Graph API permissions
    $graphAppId = "00000003-0000-0000-c000-000000000000"
    $graphSp = Get-AzADServicePrincipal -Filter "AppId eq '$graphAppId'"

    $graphPermissions = @(
        "AuditLog.Read.All",
        "Directory.Read.All",
        "Policy.Read.All",
        "UserAuthenticationMethod.Read.All",
        "OnPremDirectorySynchronization.Read.All",
        "SecurityIdentitiesHealth.Read.All",
        "SecurityIdentitiesSensors.Read.All",
        "SharePointTenantSettings.Read.All",
        "ThreatHunting.Read.All",
        "DeviceManagementServiceConfig.Read.All",
        "DeviceManagementConfiguration.Read.All",
        "DeviceManagementManagedDevices.Read.All"
    )

    foreach ($permission in $graphPermissions) {
        $role = $graphSp.AppRole | Where-Object { $_.Value -eq $permission }
        Add-AzADAppPermission -ObjectId $app.Id -ApiId $graphAppId -PermissionId $role.Id -Type Role
    }

    # 3. Add external (non-Graph) API permissions
    $externalApis = @(
        # Office 365 Exchange Online
        @{ AppId = "00000002-0000-0ff1-ce00-000000000000"; Permission = "Exchange.ManageAsApp" },
        # Skype and Teams Tenant Admin API
        @{ AppId = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239"; Permission = "application_access" }
    )

    foreach ($api in $externalApis) {
        $apiSp = Get-AzADServicePrincipal -Filter "AppId eq '$($api.AppId)'"
        $role = $apiSp.AppRole | Where-Object { $_.Value -eq $api.Permission }
        Add-AzADAppPermission -ObjectId $app.Id -ApiId $api.AppId -PermissionId $role.Id -Type Role
    }

    # 4. Create the service principal for the app
    $sp = New-AzADServicePrincipal -ApplicationId $appId

    # 5. Add Reader role assignment to tenant root management group (covers subscriptions)
    $mgId = (Get-AzManagementGroup -GroupName $tenantId).Id
    New-AzRoleAssignment -ObjectId $sp.Id -RoleDefinitionName "Reader" -Scope $mgId

    # 6. Assign the Global Reader Entra directory role to the service principal
    #    (Global Reader built-in role template ID)
    $roleDefId = "f2ef992c-3afb-46b9-b7cf-a126ee74c451"
    $roleAssignmentBody = @{
        "@odata.type"    = "#microsoft.graph.unifiedRoleAssignment"
        roleDefinitionId = $roleDefId
        principalId      = $sp.Id
        directoryScopeId = "/"
    } | ConvertTo-Json -Compress
    $uri = "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments"
    Invoke-AzRestMethod -Method POST -Uri $uri -Payload $roleAssignmentBody | Out-Null

    # 7. Create a client secret
    $endDate = (Get-Date).AddMonths($SecretMonths)
    $secret = New-AzADAppCredential -ObjectId $app.Id -EndDate $endDate

    # 8. Output
    $adminConsentUrl = "https://login.microsoftonline.com/$tenantId/adminconsent?client_id=$appId&redirect_uri=$RedirectUri"

    # Return the key values as an object too, for programmatic use
    return [PSCustomObject]@{
        ApplicationId   = $appId
        TenantId        = $tenantId
        ClientSecret    = $secret.SecretText
        AdminConsentUrl = $adminConsentUrl
    }
}


New-IntruderConnector

This will output the Application ID, Directory ID and Client Secret which you will need to enter in Intruder Portal when adding the Azure integration.
Before adding the integration, you will need to grant administrator consent for the Microsoft Graph API permissions required by the app registration.

This cannot be done via PowerShell, but if you have Azure CLI installed with Global Administrator privileges, you can use the following command:
```
az ad app permission admin-consent --id $appId
```
Substitute the $appId with the application ID from the script output.

Alternatively, you can grant administrator consent via the Azure Portal:

Log in to the Azure Portal (portal.azure.com)
In the top toolbar, search for IntruderConnector (or the name you used for the app registration)
Select Grant admin consent for [Your Tenant], confirming the selection.

Done! You can now log in to the Intruder Portal and proceed to Step 2: Integrate Azure with Intruder

Setup Step 2 - Integrate Azure with Intruder

Log in to your Intruder portal (portal.intruder.io)
Navigate to Targets → Add target

Cloud asset sync → Microsoft Azure
Enter the previously noted:
- Application ID
- Directory ID
- Client Secret
Click Add asset and confirm the setup.

You will be redirected to view your newly added Azure integration. The overview page lists all your subscriptions, and you can manage settings for syncing and scanning them directly from there, or click into each subscription to view its resources and settings.

You're done! 🎉

The overview page lists all your subscriptions, and you can manage settings for syncing and scanning them directly from there, or click into each subscription to view its resources and settings.

You will also note that the validity period for your secret key is shown at the top of the page. You will be prompted to update this once it expires, but please ensure that this is kept up-to-date for continuous coverage:

Managing and Monitoring Cloud Security Scans

Scans run automatically once per day, and results are accessible on the Scans page:

To enable or disable cloud security scans, you have two options:

1. Open your Azure integration's detail page from the Discovery or Targets page and click the 'Cloud security scans' checkbox:

2. Open an Azure subscription's detail page and enable the 'Cloud security scans' toggle:

Cloud Asset Sync Rules:

To manage the sync rules for an Azure subscription, open your desired subscription and click 'Sync rules':

💡Tip: To learn more about the different sync rules, please check out this article.

How Tenant and Subscription Settings Work

When you connect Azure to Intruder, every subscription belongs to a tenant. Intruder represents that tenant as an organization-level integration that hosts all your subscriptions.

Unlike some other cloud providers, Azure includes tenant-level security checks that run alongside your subscription-level scans. In practice, this means that if you run cloud security scans for any subscription, you'll get the tenant-level checks too. If you don't enable scans for any subscription, the tenant-level checks won't run either.

The cloud security scan settings shown on the tenant-level integration are defaults for newly imported subscriptions only. They don't apply retroactively to subscriptions that are already imported, so enabling scans at the tenant level won't switch them on for your existing subscriptions.

To manage scans for existing subscriptions:

Use the table on the integration page to enable or disable scans for one or more subscriptions at a time.
Use the header-level checkbox in that table to toggle every subscription at once.
Use the tenant-level integration settings to set the default for subscriptions Intruder discovers in the future.

⬇️

Microsoft Azure Integration