Azure

Azure

There are five ways to run scout against an Azure organization.

1. azure-cli

1. On most system, you can install azure-cli using `pip install azure-cli`.
2. Log into an account. The easiest way to do it it with `az login`(for more authentication method,
you can refer to https://docs.microsoft.com/en-us/cli/azure/authenticate-azure-cli?view=azure-cli-latest).
3. Run Scout with the `--cli` flag.

2. Managed Service Identity

1. Configure your identity on the Azure portal (you can refer to
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/)
2. Run Scout with the `--msi` flag.

3. Service Principal

1. Set up a service principal on the Azure portal (you can refer to
https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal)
2. Run Scout with the `--service-principal` flag. Scout will prompt you for the required information.

4. File-based Authentication

1. Create a Service Principal for azure SDK. You can do this with azure-cli using
`az ad sp create-for-rbac --sdk-auth > mycredentials.json`.
2. Run Scout while providing it with the credentials file using
`--azure-file-auth path/to/credentials/file`.

5. User Credentials

1. Run Scout using `--user-account`. The application will prompt you for your credentials.

Scout will require the Reader role over all the resources to assess. The easiest way is to authenticate with a principal that has this role over the target Subscription, as it will be inherited on all the resources.

MFA

To run Azure with an MFA-enabled account, you must use the Azure CLI. To do this, first install the cli: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest. Then, you can use az login to log the cli into your account. This will open a web browser and let you log in.

Once this is done, you can run Scout with the Azure --cli option.

Please note that there is currently no mechanism to login with MFA without a web browser.