Configuration

{
  "config": {
    "tenantId": "<azure-tenant-id>",
    "clientId": "<azure-client-id>",
    "clientSecret": "<azure-client-secret>",
    "subscriptionNames": ""
  }
}

Field

Required

Description

tenantId

Yes

Azure Entra ID tenant (directory) ID

clientId

Yes

Service principal (application) client ID

clientSecret

Yes

Service principal client secret

subscriptionNames

No

Comma-separated subscription display names to scan. Supports * wildcard patterns (e.g. prod-*). Leave empty to scan every subscription the principal can see. Subscription IDs (UUIDs) are not accepted — use display names, matched case-insensitively.

Selector Examples

  • "" (empty) — scan every subscription the principal can see
  • "Production East" — scan only that subscription, matched exactly (case-insensitive)
  • "prod-*" — scan every subscription whose display name starts with prod-
  • "prod-*, Shared Services" — comma-separated selectors are unioned; duplicates are removed

A selector that matches no subscription in the tenant produces a logged warning but does not fail the scan; other matching selectors still run normally.

Incremental Scans

This plugin does not support incremental scans — every scan is a full scan. The config includes an incrementalScanEnabled toggle purely for runner scheduling UI consistency with other plugins; it is always disabled in the UI schema and has no effect on scan behavior. If a scan request's state.lastScanDate is non-empty, the scan is rejected with an error result (STATE_ERROR) rather than silently ignored — clear the state and retry.