> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure subscription

> Integrate Plerion with Microsoft Azure subscriptions to enable Cloud Security Posture Management (CSPM) and optionally Cloud Workload Protection Platform (CWPP).

With the [Microsoft Azure subscription integration](https://app.plerion.com/settings/integrations/add/Azure/AzureSubscription), you can connect Azure subscriptions to Plerion. This enables **Cloud Security Posture Management (CSPM)** for continuous configuration checks, and optionally **Cloud Workload Protection Platform (CWPP)** to scan workloads for vulnerabilities.

<Warning>
  Before onboarding Azure subscriptions, ensure you have a [Microsoft Entra ID integration](/guides/integrations/azure/setting-up-azure-active-directory). The subscription integration reuses the same app registration created in Microsoft Entra ID.
</Warning>

***

## Prerequisites

* **Owner role at the subscription scope**\
  Needed to grant the Plerion App registration permissions for CSPM, and to create the resource group, managed identity, and role assignments for CWPP.

* **CWPP requirements**\
  If you plan to enable CWPP, review the [Azure CWPP prerequisites](/guides/integrations/azure/prerequisites). These are not needed if you only want CSPM.

***

## Steps to add a Microsoft Azure subscription integration

<Steps>
  <Step title="On the Plerion dashboard, go to Settings > Integrations">
    <Frame>
      <img src="https://mintcdn.com/pleriondocs/xqwXbDdIvpJS066S/images/integrations/aws/settings-integrations-sidenav.png?fit=max&auto=format&n=xqwXbDdIvpJS066S&q=85&s=76e3ee2c20634eb080fc39574d8b029f" alt="Sidebar navigation with Settings expanded and Integrations highlighted" width="655" height="853" data-path="images/integrations/aws/settings-integrations-sidenav.png" />
    </Frame>
  </Step>

  <Step title="Find Microsoft Azure subscription and click the + button">
    <Frame>
      <img src="https://mintcdn.com/pleriondocs/rDG914-TLqofr4Lz/images/integrations/azure/add-azure-subscription.png?fit=max&auto=format&n=rDG914-TLqofr4Lz&q=85&s=b8416ca20032502d55f35ee937f6b91b" alt="Integrations page with Azure subscription option and plus button to add integration" width="991" height="769" data-path="images/integrations/azure/add-azure-subscription.png" />
    </Frame>
  </Step>

  <Step title="Select a Microsoft Entra ID integration">
    Choose an existing Microsoft Entra ID integration to reuse its app registration.
  </Step>

  <Step title="Grant the app registration subscription access">
    * Provide access to the App registration using either the Azure CLI or Azure Portal.
    * If enabling CWPP, select the default region where Plerion will create a dedicated resource group.
  </Step>

  <Step title="Download and run the setup script">
    * Download the script and run it in your CLI or [Azure Cloud Shell](https://shell.azure.com).

    ```bash theme={"system"}
    bash ms-azure-install-plerion.sh
    ```

    * This will list the available subscriptions.
    * Use the associated number to select one, or press `y` to install on all subscriptions.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/rDG914-TLqofr4Lz/images/integrations/azure/subscription-cspm-cli.png?fit=max&auto=format&n=rDG914-TLqofr4Lz&q=85&s=9ad43932c56c7b64c214ac7d8df8d203" alt="CLI output showing available subscriptions" width="2712" height="854" data-path="images/integrations/azure/subscription-cspm-cli.png" />
    </Frame>
  </Step>

  <Step title="Install CSPM roles">
    * Press `y` to install CSPM roles on all subscriptions, or enter the subscription number to install on a specific subscription.
    * To skip optional CSPM roles, press `s`. To install them, press `y`.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/rDG914-TLqofr4Lz/images/integrations/azure/subscription-cspm-optional-cli.png?fit=max&auto=format&n=rDG914-TLqofr4Lz&q=85&s=cb69ea84b00de63371232d26c31cc15c" alt="CLI output showing CSPM role installation prompt" width="2756" height="228" data-path="images/integrations/azure/subscription-cspm-optional-cli.png" />
    </Frame>
  </Step>

  <Step title="Install CWPP roles (optional)">
    Press `y` to enable CWPP on all subscriptions, or enter a subscription number to enable it only on that subscription.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/rDG914-TLqofr4Lz/images/integrations/azure/subscription-cwpp-cli.png?fit=max&auto=format&n=rDG914-TLqofr4Lz&q=85&s=62c66c1388e7e49b299d317561b9440a" alt="CLI output showing CWPP role installation prompt" width="2880" height="636" data-path="images/integrations/azure/subscription-cwpp-cli.png" />
    </Frame>
  </Step>

  <Step title="Return to Plerion and verify access">
    * On the Plerion platform, click `Verify access`.
    * Subscriptions with correct permissions will be displayed.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/rDG914-TLqofr4Lz/images/integrations/azure/Add-Azure-AD-integration-addazuresubscriptionverifyaccess.png?fit=max&auto=format&n=rDG914-TLqofr4Lz&q=85&s=eb84bc8a18e9d8e118d64c69d86aa3df" alt="Verification screen showing Azure subscriptions added successfully" width="2706" height="1058" data-path="images/integrations/azure/Add-Azure-AD-integration-addazuresubscriptionverifyaccess.png" />
    </Frame>
  </Step>

  <Step title="Add subscriptions to your tenant">
    * Select the subscriptions to onboard and click `Add subscriptions`.
    * These subscriptions will now be available in Plerion for CSPM and CWPP.
  </Step>
</Steps>

***

## Troubleshooting

See the [Azure subscription troubleshooting guide](/guides/integrations/azure/troubleshooting) for common onboarding errors and solutions.