Prowler gets stuck on Entra-ID checks

[beaaedo]

Issue search

• I have searched the existing issues and this bug has not been reported yet

Which component is affected?

Prowler UI

Cloud Provider (if applicable)

Azure

Steps to Reproduce

Running a scan on an Azure subscription.

Expected behavior

Hi!!

When running a scan for an Azure subscription, the scan stays on the Entra ID checks for more that 4 hours (sometimes even failing). It even happens while scanning very small suscriptions with barely any resources.

The Service Principal was created following the Prowler documentation (https://docs.prowler.com/user-guide/providers/azure/create-prowler-service-principal).

I don't know how to fix it and have tried searching online but haven't found a solution that has fixed it.

Thanks in advance.

Actual Result with Screenshots or Logs

I checked the logs and discovered the following error keeps appearing when those checks are being executed: "/me request is only valid with delegated authentication flow.".

Here are the logs (I have redacted some of the information, also in this example I had only been executing the scan for a few minutes):
2026-03-09 13:14:53,313 [File: azure_provider.py:948] [Module: azure_provider] ERROR: ODataError[942] --
APIError
Code: 400
message: None
error: MainError(additional_data={}, code='BadRequest', details=None, inner_error=InnerError(additional_data={}, client_request_id='', date=datetime.datetime(''), odata_type=None, request_id=''), message='/me request is only valid with delegated authentication flow.', target=None)

[...]

Executing 106 checks, please wait...
-> Scanning entra service |▉▉▉▉▉▉▉▉▉▉▉▉▉▏ | - 35/106 [33%] in 4:32

How did you install Prowler?

Docker (docker pull toniblyx/prowler)

Environment Resource

Docker container locally (published using NGINX)

OS used

Ubuntu

Prowler version

5.19.0

Python version

3.12.3

Pip version

24.0

Context

No response

[HugoPBrito]

Hi @beaaedo,

Thanks for reporting this.

We'll review this as soon as possible. Just to be sure, did you add the permissions stated in our Azure Authentication Guide?

[beaaedo]

Hi! yes I created the Service Pincipal with the permissions stated there.

[HugoPBrito]

Hi! yes I created the Service Pincipal with the permissions stated there.

Perfect! Did you grant the Read role to the app in the subscriptions you want to scan as well? If so, please share your logs so we can take a further look at what could be happening, as I've not been able to replicate the error.

Nevertheless, one of the possible solutions for the error you shared in the logs (/me access) can be fixed granting User.Read delegated permission to the app. I did not need it to execute azure on our test account though.