Skip to content
FencerFencerDocs

Azure Integration

Overview

Section titled “Overview”

The Azure integration connects your Microsoft Azure environment to Fencer using a Service Principal (App Registration) for authentication. Once connected, Fencer scans your Azure subscriptions for infrastructure misconfigurations, maps your resource topology into the architecture graph, and can discover container images across Azure Container Registry (ACR), Azure Kubernetes Service (AKS), Container Instances, and Container Apps.

This integration gives you continuous visibility into your Azure security posture, including IAM role assignments, security policies, network configurations, and compute resources.

Prerequisites

Section titled “Prerequisites”
  • An active Azure subscription.
  • Permissions to create App Registrations in Microsoft Entra ID (formerly Azure Active Directory).
  • Permissions to create custom roles and assign roles in Azure IAM at the subscription level.
  • An active Fencer subscription and the Administrator role in your Fencer organization.

How it works

Section titled “How it works”

Fencer authenticates to Azure using a Service Principal with client credentials (client ID and client secret). The Service Principal is granted the built-in Reader role and a custom Fencer Scanner Role at the subscription level, which together provide read access to your resources plus a small set of additional actions needed for thorough security scanning.

On connection, Fencer queries the Azure Resource Graph API to enumerate the resources in your subscription and fetches additional subscription-level configurations (security settings, policy assignments, role definitions, DDoS protection plans, and more). These resources are mapped into Fencer’s architecture graph and assessed for security misconfigurations. Fencer rescans the subscription daily, or weekly on plans without daily scheduled scans, and checks the connection before each scan.

The connect wizard offers three setup methods as tabs beside the form: Manual Setup (the Azure Portal steps below), Terraform, and Pulumi. The Terraform and Pulumi modules create the App Registration, its secret, the Reader assignment, and the custom role for you, and output the tenant ID, client ID, and client secret the form asks for.

Usage / Configuration

Section titled “Usage / Configuration”

Step 1: Gather your Subscription ID

Section titled “Step 1: Gather your Subscription ID”
  1. In the Azure Portal, navigate to Subscriptions.
  2. Select the subscription you want to connect and copy the Subscription ID from the overview page.

Step 2: Create an App Registration

Section titled “Step 2: Create an App Registration”
  1. In the Azure Portal, go to Microsoft Entra ID > App registrations > + New registration.
  2. Set the name to Fencer Scanner.
  3. Select Single tenant as the supported account type. Leave the Redirect URI blank.
  4. Click Register.
  5. On the app overview page, copy the Application (client) ID and the Directory (tenant) ID.

Step 3: Generate a client secret

Section titled “Step 3: Generate a client secret”
  1. In your App Registration, go to Certificates & secrets > + New client secret.
  2. Enter a description (e.g. “Fencer Access”), set the expiration to 730 days, and click Add.
  3. Copy the secret Value immediately — it is only displayed once.

Step 4: Assign the Reader role

Section titled “Step 4: Assign the Reader role”
  1. Go to Subscriptions > your subscription > Access Control (IAM) > + Add > Add role assignment.
  2. Select the Reader role, then under Members select your Fencer Scanner app.
  3. Save the assignment.

Step 5: Create and assign the Fencer Scanner Role

Section titled “Step 5: Create and assign the Fencer Scanner Role”
  1. In the same subscription’s Access Control (IAM), click + Add > Create custom role.
  2. Name the role Fencer Scanner Role and clone it from the Reader baseline.
  3. Add the following permissions:
    • Microsoft.Authorization/roleAssignments/read
    • Microsoft.Compute/disks/beginGetAccess/action
    • Microsoft.Compute/disks/endGetAccess/action
    • Microsoft.Compute/disks/read
    • Microsoft.Compute/snapshots/beginGetAccess/action
    • Microsoft.Compute/snapshots/endGetAccess/action
    • Microsoft.Compute/snapshots/read
    • Microsoft.Compute/virtualMachines/read
    • Microsoft.Web/sites/config/list/action
    • Microsoft.Web/sites/host/listkeys/action
  4. Create the role, then assign it to your Fencer Scanner app via Access Control (IAM) > Add role assignment.

Step 6: Complete the connection in Fencer

Section titled “Step 6: Complete the connection in Fencer”
  1. In Fencer, go to Admin > Integrations, click the Azure card under Available Integrations, and click Continue.
  2. Fill in the Subscription ID, Integration Name, Environment (Production, Development, Test, or Mixed), Application (client) ID, Directory (tenant) ID, and Client Secret Value.
  3. Under Regions to scan, keep Scan every region or limit the scan to the regions you select.
  4. Click Connect. Fencer verifies the credentials and role assignments, then begins scanning your Azure environment.

Editing or removing a connection

Section titled “Editing or removing a connection”

On Admin > Integrations, click Edit on the Azure connection to change the Integration Name, Environment, Application (client) ID, or Client Secret Value (leave it blank to keep the stored secret), and the Scan registry images and Scan container images toggles. Fencer checks the credentials again when you click Save changes. The regions to scan are edited in the card below the form.

To disconnect, click Remove on the connection and confirm. Fencer clears the stored client secret and soft-deletes the connection and its cloud account.

(Optional) Enable container scanning

Section titled “(Optional) Enable container scanning”

Azure Container Registry (ACR)

To scan container images stored in Azure Container Registry, assign the AcrPull role to your Fencer Scanner app on each registry:

  1. Go to your Container Registry > Access Control (IAM) > + Add > Add role assignment.
  2. Select the AcrPull role, then under Members select your Fencer Scanner app.
  3. Repeat for each ACR you want Fencer to scan.

Azure Kubernetes Service (AKS)

To scan container images running in AKS clusters, assign the Azure Kubernetes Service Cluster Admin Role to your Fencer Scanner app on each cluster or at the subscription level:

  1. Go to your AKS cluster > Access Control (IAM) > + Add > Add role assignment.
  2. Search for and select Azure Kubernetes Service Cluster Admin Role, then under Members select your Fencer Scanner app.
  3. Repeat for each cluster, or assign at the subscription level to cover all clusters automatically.

Note: AKS scanning requires local accounts to be enabled on the cluster (the default setting). Clusters with local accounts disabled are not supported.

Examples

Section titled “Examples”

Connecting a production Azure subscription:

  1. In Fencer, go to Admin > Integrations and click the Azure card, then Continue.
  2. Enter the Subscription ID (e.g. a1b2c3d4-e5f6-7890-abcd-ef1234567890).
  3. Set the Integration Name to “Production Azure” and Environment to “Production”.
  4. Paste the Application (client) ID, Directory (tenant) ID, and Client Secret from your App Registration.
  5. Click Connect. Fencer validates the connection, confirms the Reader and Fencer Scanner Role are assigned, and triggers an initial cloud infrastructure scan and architecture discovery.

After the scan completes, your Azure resources appear under Posture > Infrastructure and in the Assets graph. Any misconfigurations are reported as vulnerabilities.

Troubleshooting

Section titled “Troubleshooting”
  • “The app registration is missing the Reader role on subscription …” — The Fencer Scanner app does not have the Reader role at the subscription level. Assign it via Access Control (IAM).
  • “The app registration is missing permissions on subscription …: …” — The custom role has not been created or assigned, or is missing the actions the message lists. Verify all ten permissions listed above are included.
  • “The app registration cannot see subscription …” — Double-check the Subscription ID and confirm the Reader role is assigned at the subscription scope.
  • “The app registration is not allowed to read resources in subscription …” or ”… is not allowed to read its role assignments …” — The service principal lacks the required role assignments. Re-check both the Reader and Fencer Scanner Role assignments.
  • “The client secret is wrong. Paste the secret’s Value, not its Secret ID.” — You pasted the secret’s ID. Copy the secret’s Value instead.
  • “Directory (tenant) ID … was not found.” — Copy the Directory (tenant) ID from the app registration’s overview page.
  • “The client secret has expired.” — Azure client secrets have a maximum lifetime. Generate a new secret in your App Registration and enter its Value on the connection’s edit page.
  • ACR images not appearing — Ensure the AcrPull role is assigned on each Container Registry you want to scan.
  • AKS images not appearing — Ensure the Azure Kubernetes Service Cluster Admin Role is assigned to the Fencer Scanner app on each AKS cluster (or at subscription level). Also confirm local accounts are enabled on the cluster.
Section titled “Related pages”