Azure.Admin.Console 0.15.0

Plan a service before it is deployed; check the estate against the Azure Landing Zone checklist and the Azure Proactive Resiliency Library; look inside AKS clusters; and accept findings with a reason, then see what changed since the last run.

Changed behaviour

• Invoke-AACAksAssessment has about 20 more Well-Architected checks, so a cluster's WAF score can drop while nothing about the cluster changed. Compare scores only between runs of the same version.
• Findings carry a FindingKey in Invoke-AACAksAssessment, Invoke-AACM365Assessment and Invoke-AACADOAssessment: a new property and a new CSV column. Nothing was removed.

New

• A service, planned before it is deployed. New-AACServiceBlueprint -Service FunctionApp, StorageAccount, 'Virtual Network' -Workload orders -Environment prod plans any service in Azure's list (read from the Support API, so new services appear without a module update, with tab completion). You get names that follow your naming rules, the Azure Policy that would apply (with -SubscriptionId), PSRule for Azure on the planned configuration, AMBA alerts and APRL recommendations, as a console view, an HTML map, a draw.io file and a PDF. Function App, storage, Event Hubs and Event Grid have checked configurations and work without signing in; other services are planned from their resource types and say what wasn't checked.
• Baseline alerts and resiliency recommendations, offline. Get-AACAlertBaseline -ResourceType 'Microsoft.EventHub/namespaces' lists the alerts Azure Monitor Baseline Alerts suggests, with thresholds and severities; Get-AACResiliencyRecommendation lists the Azure Proactive Resiliency Library's recommendations. Both read data shipped with the module, from pinned commits.
• The Azure Landing Zone checklist, checked. Invoke-AACLandingZoneAssessment runs the checklist's Resource Graph queries (about 130 of its 206 items; the rest are listed as Manual, with why). The queries vary, so a status says what its evidence can bear: Fail, Review (judged by a name only), Pass, Present (the query can only say a resource exists), No evidence, Manual or Not checked. There is no score.
• Your resources against APRL. Invoke-AACResiliencyAssessment runs APRL's own queries for the resource types you use, and lists each resource that doesn't follow a recommendation. About half of APRL's recommendations have no query: those show as Manual, never as a pass.
• What runs inside an AKS cluster. Invoke-AACAksAssessment -IncludeWorkload reads each cluster with AKS run command (kubectl get and jq, read-only) and adds 49 checks: health (failing, pending and restarting pods, nodes, services, volumes), workload design (requests, limits, probes, replicas, spread, disruption budgets), pod security (privileged, host namespaces and paths, capabilities, seccomp, root), namespaces, RBAC, network and storage. Secrets and ConfigMaps aren't read, and no environment variable's value leaves the cluster. It also says whether the workloads could move to a new AKS Automatic cluster, from Microsoft's Deployment Safeguards: Fix first, Changed by Automatic, Review. A check that couldn't see everything (refused, or past run command's 512 kB) says Not checked rather than Pass. These checks are findings, but not in the WAF score.
• Accepted findings, and what changed since last time. -SuppressionFile takes a JSON file of reviewed findings, each with a reason and an optional expiry: they leave the counts, and the report lists them with their reasons. -PreviousPath takes an earlier run's findings CSV: each finding is then New or Open, and the report lists what was resolved. In Invoke-AACAksAssessment, Invoke-AACM365Assessment, Invoke-AACADOAssessment, Invoke-AACLandingZoneAssessment and Invoke-AACResiliencyAssessment. A malformed file stops the command before it reads anything from Azure.
• Quota per region. Test-AACAzureLimit -IncludeQuota adds each region's compute, network and storage quota in use, against the maximum Azure reports for it.
• Invoke-AACAksAssessment, more checks (many following KubeBuddy's AKS checks): Kubernetes RBAC, the Kubernetes dashboard add-on, legacy Entra ID integration, private API server, user-assigned identity, OIDC issuer, Key Vault secrets provider, burstable and older VM sizes, small managed OS disks, Azure Linux, the system pool's taint, managed ingress, the node resource group's name, Cilium, KEDA and the vertical pod autoscaler; and with -IncludeConstraint, whether allowed images and privileged containers are enforced by Gatekeeper. New settings: Cluster SKU, Kubernetes RBAC, node auto-provisioning.
• Invoke-AACM365Assessment, more Conditional Access findings: Global Administrators excluded from an MFA policy, protection for administrators turned off, too many accounts excluded from an all-users policy, an enabled policy with no strong control.
• Invoke-AACADOAssessment, pipeline minutes: each pipeline's total minutes, each project's share of the organization's, pipelines getting slower, and powerful service connections shared by many pipelines. -View SuppressedFinding and -View ResolvedFinding.
• Docs. The guide is split into a page per topic under docs/guide/, with GUIDE.md as its index. llms.txt and llms-full.txt describe the module to AI tools, and are rebuilt with the docs. AGENTS.md has the rules for contributors and coding agents. THIRD-PARTY-NOTICES.md names the data that ships with the module and its licences.

Fixed

• Invoke-AACAksAssessment no longer fails "Cluster autoscaler on user pools" on a cluster with node auto-provisioning.
• The guide's command tables listed neither the four Sentinel commands nor the architecture commands under their own heading.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.15.0

Azure.Admin.Console 0.14.9

The Activity Log, made readable and assessed over a year; the Azure Policy that applies to a resource, before and after it is deployed; Service Bus entities as an entity-scoped role sees them - and the Key Vault assessment renamed to match the others.

Breaking changes

• Get-AACKeyVaultInsight is now Invoke-AACKeyVaultAssessment, alongside the other Invoke-AAC<Thing>Assessment commands: it reads metrics, settings and the audit logs, scores each vault in a heat map and raises findings. The old name is gone (no alias). The per-vault row's type is AAC.KeyVaultAssessment (was AAC.KeyVaultInsight); AAC.KeyVaultOperation, AAC.KeyVaultObject and AAC.KeyVaultFinding are unchanged. The parameters are unchanged; the reports' default title is "Key Vault assessment". In scripts, replace Get-AACKeyVaultInsight with Invoke-AACKeyVaultAssessment, and AAC.KeyVaultInsight with AAC.KeyVaultAssessment anywhere you test the type.

New

• Service Bus entities, as you can see them. Show-AACServiceBusEntity -NamespaceId <id> -EntityName <names> shows queues and topics as the signed-in user can read them - with a role on the namespace, or only on the entities (Azure Service Bus Data Sender or Receiver) - and says which. Live state for everyone: active, dead-lettered, scheduled and transfer messages, size against the maximum, status, each topic subscription and every setting. With namespace access, also wildcards or every entity, and Azure Monitor metrics per queue or topic over -TimeRange (messages in and out, completed and abandoned, requests, errors, throttling, backlog, size, send latency, Premium CPU and memory) with a trend. Without it, -Sample reads the live counts a few times for a backlog trend. Findings (dead-letters, filling up, throttling, a growing backlog, no role, not found), a "What you can see" tab with the role that would show more, and the usual console view, objects (-View Entity, Subscription, Metric, Sample, Finding, Access) and CSV, HTML and PDF reports.
• Activity Log events, readable. Show-AACActivityLogEvent flattens each Activity Log event into one row and a card. A row covers when, what, the result (HTTP status, and for a failure the innermost error code, message and target from the status message, the kind of failure, what to do and a docs link), who (caller kind, app and object ID, sign-in method, home or external tenant, directory roles, token times, caller IP), where (subscription, resource group, type, name, location, tags, portal link) and the IDs to trace it. Events come from a JSON file saved from the portal (no sign-in needed), from -CorrelationId (Activity Log, or -WorkspaceId for Log Analytics), or from the pipeline: events, JSON text, or rows with a correlation ID. Opaque token claims are hidden unless -IncludeClaims. Views: Event, Detail, Error, Caller, Claim; console, CSV, HTML and PDF.
• Activity Log assessment. Invoke-AACActivityLogAssessment shows the Activity Log of every resource over 90, 180 or 365 days (-Days), with subscription, resource group, resource and tags on every row. Its Resources view gives each resource's state (Active, New, Quiet, Idle, Deleted, Gone), when it was last used and how many days it has been idle, and its operations, failures, changes by hand, callers, earliest write and deleter. Further views cover distinct activity, callers, findings (guests and people changing access, keys read by people, failure hotspots, changes by hand, idle resources, missing tags, coverage gaps) and coverage. It reads the fastest way each subscription allows: the Log Analytics workspace its Activity Log is exported to, found automatically from the diagnostic settings (or -WorkspaceId), with monthly queries summarised in the workspace and run in parallel. Otherwise it uses the REST API (90 days), cut into about 1,500 slices read side by side.
• The policy that applies to a resource. Show-AACEffectivePolicy -ResourceId <id> (or -SubscriptionId with -ResourceGroupName / -ResourceType, or piped resources) starts from the resource: every assignment on its path - management groups, subscription, resource group - and each initiative member, with a verdict (Applies, Exempt, Excluded by notScopes, Not selected by resource selectors, Not targeted by the rule, data-plane modes included), the effect in force after parameters and overrides and what it does there (Blocks, Blocks delete, Changes, Deploys, Audits, Reports only when not enforced), the compliance state and - from Policy Insights - why: the field, the value expected and the value found. Non-compliance messages, the assignment's managed identity, definition version and regulatory controls are on each row. Findings: non-compliant resources a deny will refuse at their next deployment, remediation that can't run (no identity) or hasn't, exemptions ending within 30 days or expired. With -Scope and -ResourceType (plus -Location, -Sku, -Tag, -Property) it checks a resource that doesn't exist yet with Azure Policy's checkPolicyRestrictions: what would refuse, audit or change it, and the values allowed.
• Templates checked against Azure Policy before they deploy. Test-AACPolicyDeployment -TemplatePath <main.json|main.bicep> -SubscriptionId <id> -ResourceGroupName <name> works out the template's resources offline (parameters, variables, most template functions, Bicep modules, child resources; what is only known at deployment is left out and named, never guessed), asks Azure Policy about each, and reports Blocked, Audited, Changed or Passes with the reason and allowed values - plus the policies that act only after the deployment. -ParameterPath, -Parameter, and -FailOn Deny or Audit for a pipeline gate.

Changed

• Invoke-AACActivityLogAssessment's Activity rows carry the latest operation's CorrelationId and SubscriptionId and, for failures, ErrorCode and ErrorMessage. The failure-hotspot finding names the error. Statuses read from Log Analytics (Failure, Success, Start) are normalised to the REST API's (Failed, Succeeded, Started), so workspace failures are counted.
• Get-AACResourceError, Invoke-AACActivityLogAssessment and Show-AACActivityLogEvent read a failed event's error with one shared reader. The "Not found" advice now mentions versions and the region.
• Deploy-AACStorageAccount's policy gate uses the same checkPolicyRestrictions helper as the new commands; what it reports is unchanged.
• The policy assignment read (shared by Get-AACAssignedPolicy and the tenant assessment) also reads resource selectors, non-compliance messages, definition version, managed identity type and definition mode.
• Read-AACMetric (internal) returns each call's HTTP status, so a 403 shows as "no permission" rather than a failure.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.9

Azure.Admin.Console 0.14.8

Architecture design - from requirements to a validated design, diagrams (Mermaid and a multi-page draw.io with Azure icons) and decision records - plus a tenant assessment with a tab for each audience, SBOM in the Azure DevOps assessment and a tabbed Log Analytics workspace report.

Breaking changes

• Invoke-AACAssessment is now Invoke-AACTenantAssessment, alongside the other Invoke-AAC<Thing>Assessment commands: the old name is gone (no alias), and its result's type is AAC.TenantAssessment (was AAC.Assessment). Rename the command in scripts and runbooks; the sheet names are unchanged. The report's default title is now 'Azure tenant assessment', and its Cost tab is now FinOps.
• Invoke-AACTenantAssessment writes each report where you say, and nothing by default. -Output, -ReportDir, -ReportName and -SkipDiagram are gone, and so is the result's ReportFolder: give -HtmlPath and -PdfPath (files), -CsvPath (a folder, a CSV file per sheet) and -DiagramPath (a folder: TenantAssessment-Network.html, -Organization.html and -Resources.html) - any, all or none; without them the run shows its summary and returns the sheets. With -StorageAccount and no path, every report is written to a temporary folder and uploaded, now under TenantAssessment/<date>/ in the container (was AzureAssessment/).
• Get-AACADOInventory is now Invoke-AACADOAssessment (no alias). Its parameters, views and result types are unchanged, with additions (below); the report's default title is now 'Azure DevOps assessment'. Pipelines and Coverage gain an SBOM column, and -ToolRule takes the SBOM category.

New

• Architecture design, a new area. Six commands under src\Architecture take a workload from requirements to a validated design, offline: New-AACArchitectureBrief (about 20 probe questions on the business, reliability, security, performance, cost and operations, each tied to a Well-Architected pillar - asked at the prompt or from a file, with open decisions and assumptions), Get-AACArchitecturePattern (15 Azure Architecture Center cloud design patterns ranked against the brief, with why and their pillar trade-offs), New-AACArchitectureDesign (components, zones, settings and connections from the answers and the patterns; the landing zone's inherited Azure Policy and allowed locations read live; -Override), Test-AACArchitectureDesign (rules mapped to the Well-Architected pillars, built-in Azure Policy and PSRule for Azure, guardrails from a file, blocking findings for what Azure would deny, accepted risks, a score per pillar, -FailOnGap; tabbed HTML and PDF), New-AACArchitectureDiagram (Mermaid, Markdown and draw.io, with WAF, Azure Policy, guardrail, PSRule and Azure Recommendations layers) and Export-AACArchitectureDecision (ADRs for the topology, each pattern and each accepted risk, with the open decisions). The catalog is versioned and every artifact records the version it was made with.

• A detailed, multi-page draw.io for architecture designs. New-AACArchitectureDiagram now writes a five-page .drawio: a Cover (the designs facts, open findings by severity, pillar scores, links to each page), the Architecture (Azure icons inside landing zone, region, hub and spoke virtual network, data, operations and pipeline boxes; a status dot for each components worst finding; each components details as shape data; WAF, Azure Policy, Guardrails, PSRule and Recommendations as draw.io layers), Policy and compliance (the inherited assignments, allowed locations and every design rule for each component with its Azure Policy, PSRule for Azure rule and result), Findings (with open decisions and assumptions) and a Legend. The Azure icons are embedded, so it opens offline.

• A tabbed report and a PDF for the Log Analytics workspace assessment. Invoke-AACLogAnalyticsWorkspaceAssessment -HtmlPath now writes a tabbed report like the other assessments - a Summary tab (headline, tiles, charts), then a tab per section (Recommendations, Tables, Settings, Usage, Health, Agents, Query audit, Data collection rules, Change log) with hover cards on the recommendations, operations, slowest queries and data collection rules - and the new -PdfPath writes it as a PDF, each section a bookmarked heading.

• The tenant assessment has a tab for each audience. Invoke-AACTenantAssessment adds Identity and access (privileged role assignments at the root, management groups and subscriptions - permanent, time-bound, activated or eligible in Privileged Identity Management, with guests, service principals and deleted principals flagged; custom roles allowing *; classic administrators; Defender plans against what each subscription runs; Key Vault and app registration credentials expired or expiring within -ExpiryDays; SSH, RDP and WinRM open to the internet; PaaS public network access), Architecture (the management group hierarchy, subscriptions at the root and policy in force at each level; regions with zones and paired regions; zone redundancy, Azure Backup and Site Recovery of the critical resources; hub and spoke or Virtual WAN, address overlaps and private DNS zones), Operations (diagnostic settings coverage and workspaces; Service Health alerts per subscription and alert rules without an action group; Update Manager patch compliance and Arc servers; locks on production; the Activity Log over -ActivityDays and failed deployments; retired and retiring SKUs; naming against the Cloud Adoption Framework's abbreviations and owner tags) and Service delivery (subscription offers and support plans; reservation and savings plan use; quota headroom; the month-on-month cost trend; the ownership map). Every gap is a resource recommendation. New parameters: -SkipIdentity, -SkipKeyVault, -ActivityDays, -ExpiryDays, -OwnerTag, -ProductionPattern.

• SBOM in the Azure DevOps assessment. Invoke-AACADOAssessment has an SBOM tab: which build pipelines generate a software bill of materials - the Microsoft SBOM Tool (sbom-tool generate, the Manifest Generator task, GenerateSBOM=true), 1ES Pipeline Templates, Syft, CycloneDX, Trivy, Docker - and which validate one (sbom-tool validate); then the SBOM each one's latest successful run published, read from its artifacts (pipeline or build artifacts: the _manifest/spdx_2.2 or spdx_3.0 manifest.spdx.json, or any SPDX or CycloneDX JSON file) - format, the tool that made it, components, files, completeness against the NTIA minimum elements, licences by kind (permissive, weak or strong copyleft, unknown); every component with its version, ecosystem, supplier, licence and package URL (-View SbomComponent); licences per project (-View SbomLicense). Findings (area Supply chain): pipelines that deploy or publish with no SBOM, an SBOM generated but not published, incomplete SBOMs, strong copyleft licences, mostly unknown licences, SBOMs never validated. -Skip Sbom leaves the artifacts unread.

• The tenant assessment covers the Well-Architected Framework, FinOps and each resource's policy compliance. Invoke-AACTenantAssessment now also runs Invoke-AACWafAssessment's checks across the scope (unless -SkipWaf): WAF pillars (score and maturity), WAF design principles, WAF checks and WAF findings, on a Well-Architected tab. A FinOps tab: Savings opportunities by lever (waste - unattached disks, unused public IPs, VMs stopped but billed, empty plans, old snapshots; rightsizing and rate from Advisor; Azure Hybrid Benefit; old VM generations) with an estimated annual saving, Cost allocation (cost-allocation tags per subscription, -CostTag, and the untagged cost), Budgets (spent and forecast against each budget, its alerts, and the subscriptions with none) and, with -IncludeCost, Cost by service, Cost by resource group and Top cost resources (this month projected against last month). Every inventory sheet and All resources gain Policy (Non-compliant, Compliant, Exempt, Not evaluated), Non-compliant policies, Failing policies (by name), WAF gaps and, with -PSRule, PSRule failures. Resource recommendations add the Well-Architected gaps (not Advisor's or Defender's twice) and FinOps (budgets over or missing, untagged cost). New tiles and charts for the score, savings, tag coverage and budgets; -Full turns on -SecurityCenter, -IncludeCost, -IncludeTag, -PSRule and -QuotaUsage at once. The result adds WafScore, AnnualSavings and Recommendations.

• IP address management, with no server to run. Get-AACIPAMReport measures Azure's address space - read from Azure Resource Graph, nothing stored - against your address plan (-AddressPlan: spaces and blocks plus external ranges, from a .psd1, .json or .csv file or a hashtable; the private ranges when none is given). Spaces; blocks with the address space allocated (overlaps counted once), free space, the largest free range, the next free range and how many still fit, against -WarningPercent and -CriticalPercent; every network - virtual networks, Virtual WAN hubs, external ranges - as Managed, Partly managed or Unmanaged, with DNS servers, peerings and the Azure IPAM reservation tag; every subnet and every private IP address Azure counts in it (virtual machines, scale set instances, private endpoints, load balancers, firewalls, gateways, Bastion, application gateways, unattached network interfaces), so a subnet's count and its list agree; overlaps (High when peered, Medium with an external range or a hub); the next ranges of each -NextAvailable size (best fit and lowest address); -TestCidr checks; findings. A tabbed HTML report with the plan as a tree, a Space selector and hover cards; -Open opens it. Console view, objects (-View), CSV and PDF.

• Function App assessment. Invoke-AACFunctionAppAssessment assesses Function Apps (Windows, Linux, containers, Flex Consumption) end to end: hosting and plan (SKU, instances, burst, z...

Azure.Admin.Console 0.14.7

An Azure DevOps inventory - pipelines and the tools they run (with evidence), security posture and delivery metrics - application permissions listed, and rights over chosen Entra groups only; the module organised into child areas (Core, Azure, M365, DevOps) and a faster import. The stable release of everything in 0.14.6-preview1 too.

New

• Azure DevOps inventory. Get-AACADOInventory: one or more organizations (-Organization a, b, or -DiscoverOrganization from your sign-in) - projects, pipelines (YAML, or classic with no YAML file - flagged) and classic releases with their last run and each repository's last push; every task (with its version and what it does, from the task catalogue) and CLI tool (Docker, az, npm, Node.js, MSBuild, Helm, kubectl, Terraform, PowerShell, linters, scanners...) with the version an installer task or the script sets (-View Task); YAML read with its templates - local, template@repo and nested to -TemplateDepth - and classic pipelines' tasks mapped by ID, so lint, build, test, security, deploy and publish categories and "no security scanning" apply to both (-ToolRule adds your own); the security posture of service connections (open to every pipeline, client secret instead of workload identity federation, unused), variable groups (secrets outside Key Vault, secret-looking values not marked secret - names only), environments (production with no approval, no checks, open access) and default branches (required reviewers, build validation); GitHub Advanced Security per repository with active alert counts; delivery metrics over -MetricDays - success rate, duration, queue time, deployment frequency and change failure rate; -YamlPath saves every pipeline's YAML, templates and classic steps for offline review; -IncludeAzure links service connections to their service principals' Azure roles; findings for all of these, secrets in the YAML (never shown), deprecated tasks, unpinned containers and retired images; a PAT, AZURE_DEVOPS_EXT_PAT, or the Azure sign-in (-UseAzureSignIn); -Skip for a faster read; disabled repositories and their pipelines left out unless -IncludeDisabledRepository; progress for each stage with the projects done, the time left and the project being read; each file (pipeline or template) analysed once however many pipelines include it; -View Pipeline|Project|Repository|Task|Tool|ServiceConnection|VariableGroup|Environment|Finding, CSV, HTML and PDF.
• Azure DevOps tools, with evidence. Get-AACADOInventory finds tools from one catalogue (about 150 tools, new GitOps category - Flux, Argo CD, Kustomize - and more linters: MegaLinter, Super-Linter, ansible-lint, SQLFluff, commitlint, cspell, kube-linter, kubeconform...) matched against every file a pipeline runs: its YAML and templates, the script files it calls (and the scripts those call), the package.json scripts and Makefile targets it runs, classic tasks, and container images (their tag is the version). New tabs and views: Evidence (every match with its file, line and masked line text), Coverage (Yes/No per stage per pipeline), Unrecognised (commands no rule knows, most-run first, and templates and files that couldn't be read), and a Tools matrix with versions and how each tool was found. -ToolRulePath loads rules from a .psd1 or JSON file; -MaxScriptFiles limits the files read per pipeline. Command-line tools moved from the Tasks view to the evidence.
• Application permissions, listed. Get-AACApplicationPermission: everything an enterprise application or managed identity holds - application and delegated API permissions, Entra directory roles with their scope (tenant, administrative unit, object; direct, through role-assignable groups, PIM-eligible), Azure roles, owned objects, group memberships, and API permissions requested but not granted - with findings for the privileged ones; by object ID, app ID, app registration ID, name or managed identity resource ID; several at once; -SkipAzure; -View Permission|Finding|Summary, CSV, HTML and PDF.
• Application permission. New-AACApplicationPermission: an enterprise application or managed identity manages specific Entra groups only - an administrative unit with the groups, a custom role with just the group actions (-Access MemberReadWrite|MemberRead|MemberAndOwnerReadWrite, or -AllowedResourceAction) or a built-in role, assigned on the unit instead of the tenant. Plan, confirm (-WhatIf, -Force), apply in order, verify; findings for tenant-wide Graph permissions that override the scope (-RemoveTenantWidePermission), the role at tenant scope, other objects in the unit, dynamic and role-assignable groups; -RestrictedManagement.

Changed

• One module, child areas. The code is organised as a parent with child areas under src\: Core (Connect-AAC, Disconnect-AAC, Show-AACJson, and what every area builds on - HTTP, tokens, the Resource Manager, Resource Graph and Microsoft Graph helpers, progress, console views, CSV, HTML and PDF reports), Azure (68 commands scoped to subscriptions and management groups), M365 (4 commands for the Entra ID / Microsoft 365 tenant: Invoke-AACM365Assessment, Get-AACEntraGroupMembership, Get-AACApplicationPermission, New-AACApplicationPermission) and DevOps (Get-AACADOInventory). Each area has an area.psd1, its commands in Public\ and its helpers in Private\; a test fails if one area calls another area's functions (shared helpers live in Core). Still one module and one install: every command, parameter and output is unchanged. The tests are grouped the same way (Tests\<Area>\), the docs index and the README's command list are grouped by area, and the published package still merges every function into one file for a fast import.
• Faster import. The published module carries every function in one file (Azure.Admin.Console.Functions.ps1, made by build.ps1): it imports in about 2.5 seconds instead of about 5. The repository still loads the files one by one. The display settings of the module's 113 output types are registered in one call instead of 113, and the Spectre.Console hash is checked with .NET's SHA-256.
• Invoke-AACArmParallel (the module's parallel reader) can send an Authorization header of its own instead of the Azure token, follows Azure DevOps' x-ms-continuationtoken paging, and reports an answer that isn't JSON (a sign-in page) as that request's error.
• Internal clean-up, with no change to any command, parameter or output: one KQL string-literal helper instead of 34 copies in six variants (16 didn't escape backslashes, so a value such as a -Query or tag filter ending in \ could break a query); the long-running operation helpers read retry headers through Get-AACRetryDelay (now also a date-form Retry-After and the services' own retry headers); the Defender plan, Defender alert and workspace-name queries, the -TimeRange table and seven copies of a nested-value reader are written once; the unused Invoke-AACPagedRestMethod is gone, and Read-AACNetworkHealthMetric is Read-AACMetric.

Fixed

• Get-AACADOInventory failed at the end of a run ("The property 'Pipelines' cannot be found") when a script ran a command named keys, values or count: a PowerShell hashtable answers .Keys with the entry of that name. The Unrecognised commands are read through .PSBase.Keys now - and so are the tag dictionaries of Export-AACResource, where a tag named Keys, Values or Count had the same effect.
• Get-AACChangeHistory found no alerts for a window that started more than 14 days ago: the 14-day limit of Resource Graph's property-change history was applied to the alerts query too, which then asked for alerts from a start later than its end. Only the property changes are clipped to 14 days now; alerts follow the window.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.7

Azure.Admin.Console 0.14.6-preview1

Governance across the tenant in the spirit of the Azure Governance Visualizer - eleven new commands and one workbook - Service Bus and Cosmos DB assessments, editable draw.io diagrams of what you have, existing resources exported as Terraform, and a dashboard that now covers security, policy, governance, cost and what to do next. Published as a pre-release (0.14.6-preview1) first.

New

• Service Bus assessment. Invoke-AACServiceBusAssessment: every namespace's requests, errors and throttling, Premium CPU and memory, and every queue, topic and subscription's messages as they are now - active, dead-lettered, transfer dead-lettered, scheduled, how full it is, when it was last used; findings under health, capacity, messages, security, resilience and cost (dead letters, entities filling up, backlogs, topics with no subscription, SAS keys, open networks, no logs, no zones or Geo-DR, idle entities, too many messaging units), a heat map, and -View Namespace|Entity|Finding.
• Cosmos DB assessment. Invoke-AACCosmosDBAssessment, for every API (NoSQL, MongoDB, Cassandra, Gremlin, Table): availability, requests by status and rate limiting (429), request units and the busiest partition, latency, storage, every database and container with its throughput (autoscale, manual, shared, serverless); findings under availability, throttling, errors, security, resilience and cost (single region, no failover, periodic backup, open networks, account keys, over-provisioned throughput, many small containers with their own throughput), a heat map, and -View Account|Container|Finding.
• Terraform export. Export-AACTerraform exports existing resources as Terraform through the Azure Export for Terraform API (2026-09-01-preview):
  • a resource group (several in one subscription exported together, with their child resources), resource IDs - or anything piped with an Id or ResourceId - or a Resource Graph where-clause; a folder per subscription;
  • the export is a long-running operation: submitted, polled as Azure asks (Retry-After), with Azure's reason when it fails; each export shows its status, how long it has run and how many batches are done (Azure gives no percentage);
  • large exports: the resources are counted first (Resource Graph), with advice when an export is large; -BatchSize splits it into exports that run at the same time (-ThrottleLimit) and merges them into one folder - a resource two batches return is kept once, and references to it follow; several subscriptions are exported at the same time;
  • -Resume: the operations are saved in export.json as soon as Azure accepts them, so an export still running after Ctrl+C or -TimeoutMinutes is collected later without exporting again;
  • a folder ready for terraform init and plan: terraform.tf, providers.tf (with the subscription ID), main.tf, import.tf (import blocks - no terraform import to run) and export.json;
  • what couldn't be exported is listed, never dropped; -FallbackToAzApi exports what azurerm can't again with the azapi provider, merged into one module (azapi.tf);
  • -Plan runs terraform init, validate and plan and reads the plan as Get-AACTerraformPlan does: a faithful export plans only imports, anything else is listed;
  • sensitive values masked unless -IncludeSensitive; existing Terraform files not overwritten without -Force; -RegisterProvider registers Microsoft.AzureTerraform where it isn't (asks first, honours -WhatIf).
• Editable diagrams. Export-AACDiagram draws your existing resources as a draw.io diagram you can edit - not a picture:
  • four views: Resources (resource groups or subscriptions, with network links, peerings, private endpoints, routes, DNS links and dependencies), Network (hubs and spokes, gateways, firewalls), ApplicationGateway (each gateway's flow) and Governance (the management group hierarchy);
  • boxes are draw.io containers; resources carry the Azure icons, their data and a portal link; connections stay attached when you move things;
  • -Update refreshes the diagram from Azure and keeps your edits: new resources are added and marked, removed ones faded (-Prune deletes them);
  • -SplitBy puts each subscription, resource group, management group, region or gateway on its own page; a Legend page explains the boxes and lines;
  • -HtmlPath and -PdfPath write a clean copy with a legend: an interactive page, and a one-page vector PDF drawn by Microsoft Edge or Google Chrome.
• Governance, each question a command of its own:
  • Invoke-AACGovernanceAssessment: the hierarchy, access, identities, policy remediation, limits, settings, tags, locks and changes in one tabbed workbook, with the high and medium findings of every area; -MarkdownPath writes it as a wiki page (GitHub or Azure DevOps) with the hierarchy as a Mermaid diagram.
  • Show-AACManagementGroupMap: the management group hierarchy as an interactive map and a console tree, with the subscriptions, policy and role assignments at each level.
  • Get-AACRoleAssignment: every role assignment at every scope - user, guest, group, application or another tenant's, system- or user-assigned identity, deleted - what the role can do, how far it reaches, standing or PIM, group members (-ExpandGroup), who created it; orphaned assignments, privileged guests, applications as Owner and custom roles unused or equivalent to Owner flagged.
  • Get-AACServicePrincipalInsight: applications and managed identities with Azure roles, their credentials about to expire, other tenants' applications, user-assigned identities attached to nothing or shared too widely.
  • Test-AACAzureLimit: scopes close to an Azure limit - role assignments, custom roles, policy assignments, definitions, initiatives and exemptions, resource groups, tags, management group depth - with what to do; -Maximum for a raised limit, -FailOnLimit for a pipeline gate.
  • Get-AACGovernanceSetting: who can create management groups, where new subscriptions land, management group activity logs, Defender security contacts, classic administrators, preview features, resource providers registered unevenly, each subscription's offer and state.
  • Get-AACPolicyRemediation: DeployIfNotExists and Modify policies with resources they could fix, and what their remediation tasks did - never run, failed, drifted again, or no identity to run with.
  • Get-AACTagUsage: tag coverage and consistency - names that clash in casing, near-duplicates, values in mixed casing, how far -RequiredTag reaches.
  • Get-AACResourceLock: every lock, the critical resources no lock protects, and ReadOnly locks that break more than they protect.
  • Get-AACGovernanceChange: policy and access created or updated in the last days, with the author resolved and privileged grants flagged.
  • Test-AACAlzPolicy: your management groups' policy assignments against the Azure Landing Zones archetypes (a local copy of the ALZ Library) - missing, different or present, and the library file to deploy from.

Changed

• Show-AACDashboard - the second edition, from the same single Resource Graph batch (24 queries instead of 8):
  • an Estate score (0-100) from availability, secure score, policy compliance and the Advisor score, and a second row of score tiles;
  • Security (secure score, alerts and recommendations by severity, Defender plans), Governance (policy compliance, the closest role assignment limit, privileged role assignments, unused disks, public IPs and NICs, tag coverage), Advisor savings, resources by type and subscription, the last 14 days of changes and who made them;
  • -IncludeCost: month to date against the same days last month, a forecast, 30 days and what costs most (Cost Management);
  • What to do next: the actions that matter most, ranked across every section, each with the command that goes deeper (.Actions returns them);
  • -Section shows only some sections; -HtmlPath, -PdfPath and -CsvPath write it as a report with a tab per section; -Watch refreshes it for a screen on the wall.
  • Every property of AAC.Dashboard is still there; the status also turns to Needs attention for high-severity security alerts, policy compliance below 80%, a subscription at 80% of the role assignment limit, or spend more than 10% above last month.
• The browser maps (Show-AACResourceMap, Show-AACNetworkTopology, Show-AACApplicationGatewayMap): a draw.io button saves the map as an editable diagram exactly as laid out; the legend now explains the boxes too (subscription, resource group, virtual network, hub, subnet, Application Gateway) and the resource flags; "Open in the Azure portal" sits at the top of a resource's details.
• Show-AACResourceMap, Show-AACNetworkTopology and Show-AACApplicationGatewayMap read Azure through shared readers, the same ones the diagrams use (no change to what they show).
• Invoke-AACArmWrite (the module's write helper) runs POST actions too and returns their result; the new Invoke-AACArmOperationBatch runs several long-running operations side by side.
• Get-AACServicePrincipalInsight asks Microsoft Graph for the app registrations in a fixed order, so the same principals always make the same requests.
• The tests run on Pester 6.2+ (below 7) instead of Pester 5: build.ps1, CI and the release workflow install and require it, and build.ps1 -Task Test says what to install when it's missing. Pester 6 needs PowerShell 7.4 or later to run the tests; the module itself still runs on 7.2. The test files needed no change.
• CI and the release workflow install their modules through tools/Install-BuildModule.ps1, which tries again (up to four times, waiting longer each time) when the PowerShell Gallery answers 5xx - a 504 from the Gallery had failed a release.
• The release workflow publishes pre-releases: a Prerelease value in...

Azure.Admin.Console 0.14.5

A Well-Architected assessment with a go-live gate, insights for Key Vault, storage accounts, Application Gateways and the hybrid network, a network topology diagram, workbook-style heat maps in every report, and clearer Entra ID group membership.

New

• Well-Architected assessment across the five pillars, scored by pillar, design principle and check, from one Resource Graph batch:

  • Invoke-AACWafAssessment: Reliability, Security, Cost Optimization, Operational Excellence and Performance Efficiency. Scores are 0-100, with checks weighted by severity, each pillar's maturity, and heat maps by subscription, resource group or resource type. It checks about 60 catalogue items plus Advisor and Defender for Cloud, counting a finding once when Advisor or Defender repeat a catalogue check (-KeepDuplicates counts both). -AttestationPath scores the team's questionnaire answers, and -HistoryPath keeps the trend.
  • Test-AACGoLiveReadiness: a go-live gate. It checks pillar scores against -MinimumScore or -PillarMinimum, high-severity findings, -RequiredCheck, and principles covered. The verdict is Ready or Not ready, with the blockers listed. -FailOnGap fails a pipeline.
  • Export-AACWafQuestionnaire: one question per design principle (24), for what no API can test.
  • Get-AACWafCheck: the check catalogue, and how each principle is covered.

• Get-AACKeyVaultInsight: what Azure Monitor's Key Vault workbook shows (availability, transactions, latency, failures by status code, operations from the audit logs), plus:

  • saturation (SaturationShoebox);
  • posture: soft delete, purge protection, RBAC, network, private endpoints, Defender, audit logs;
  • callers denied or throttled, from both AzureDiagnostics and AZKVAuditLogs, with -IncludeOperations;
  • secrets, keys and certificates expired, expiring or never expiring (metadata only), with -IncludeObjects;
  • findings and a vault-by-signal heat map.

• Show-AACApplicationGatewayMap: Application Gateways as their connection flow, opened in your browser. It shows frontend IPs, listeners, rules, path rules and redirects, backend settings and probes, pools and targets (resolved to VMs and App Services), and WAF policies, inside their network and subnet.

  • Health: from metrics, or the live backend health check with -IncludeHealth (each target's state and the probe's reason).
  • At the prompt: the flows and findings: v1 SKU, WAF off or in Detection, old TLS policy, HTTP not redirected, certificates expired, expiring or uploaded, missing or mismatched probes, empty or unhealthy pools, and unused parts.

• Get-AACNetworkHealth: the Azure Network Monitoring workbook's signals with % of capacity, thresholds, findings and Resource Health, for:

  • ExpressRoute circuits: BGP and ARP availability per peering and link, link utilisation, traffic on one link, QoS drops, provisioning;
  • ExpressRoute gateways: CPU, packets per second, routes advertised and learned against their limits;
  • VPN and point-to-site gateways: bandwidth, BGP peers, point-to-site users, active-active;
  • connections and tunnels: connected or not, drops;
  • Azure Firewall: health, SNAT, throughput, latency;
  • NAT gateways: data path, drops, SNAT.

  Every finding says when it happened (the peak, the first and last time it was seen, or since when), and each report gives the period covered.

• Invoke-AACStorageAccountAssessment: what Azure Monitor's Storage accounts workbook shows - its Overview tab (transactions, end-to-end and server latency, errors by response type) and Capacity tab (used, blob, file, queue and table capacity, with blob, container and share counts) - plus:

  • health: availability, throttling, server, authorization and network errors, slow responses, time lost between client and service;
  • security: HTTPS, TLS, anonymous blob access, network access, shared keys and their age, key and SAS expiry policies, cross-tenant replication, blob logs, Defender for Storage;
  • data protection: redundancy, blob, container and file share soft delete, versioning;
  • cost: legacy account kinds, lifecycle rules, idle accounts, hot tier with little activity;
  • findings and an account-by-signal heat map; the reports' tabs follow the workbook.

• Heat maps in the console, PDF and HTML reports of any command (the report engine's new HeatMaps). The HTML is workbook style: a cell's colour is its score, and clicking it lists its findings.

• Show-AACNetworkTopology: the network topology of the tenant, management groups, subscriptions or regions, as an interactive diagram in your browser. Read-only, with Resource Graph.

  • What it reads: networks, subnets and peerings (across subscriptions, and to networks you can't see); VPN and ExpressRoute gateways, connections and circuits; Virtual WAN hubs; Azure Firewalls and network virtual appliances (VMs whose NIC forwards IP traffic); NSGs, route tables, NAT, Bastion, load balancers and Application Gateways; VMs, scale sets and private endpoints in their subnets, with the PaaS resources the endpoints serve. -NetworkOnly leaves out the workloads.
  • Roles: each network is a hub, a spoke of a hub, peered or standalone.
  • Two layouts, switched on the page: Hub & spoke puts each hub at the centre with its spokes in rings around it. Hierarchy nests boxes: tenant, management group, subscription, region, resource group, network, subnet (-GroupBy for fewer levels). Subnets are drawn in rows, sized by their prefix.
  • Lines: peerings with their state (red when not Connected), private endpoints to their PaaS, routes to the firewall or appliance that inspects them.
  • Findings: peerings not connected, routes to unknown next hops, spoke subnets whose internet traffic isn't inspected, peerings to networks you can't see, standalone networks.

• Get-AACDiagnosticSetting -Status: only the resources with these statuses (Exported, Partial, Not to workspace, No setting, No logs, Unknown). The view, objects, CSV, HTML and PDF, and the misconfigurations, then cover only those resources, while the coverage tiles still describe the whole scope. -Status 'No setting' lists the resources that support diagnostic logs but have no diagnostic setting at all.

• Get-AACEntraGroupMembership shows each group's owners (users and service principals, Name (UPN)), when it was created (UTC) and its membership type (Assigned, Dynamic, or Dynamic (paused)), next to its type and source. You'll find them in the console (groups table and each group's heading), on every row (MembershipType, GroupCreated, GroupOwners), in the HTML and PDF groups tables, and in the CSV, as three columns after Export-EntraGroupMemberShip.ps1's five (Owners, CreatedDateTime, MembershipType). Owners are read only for the groups asked for, not for the groups nested in them.

• Get-AACEntraGroupMembership reports are easier to read: each group is laid out the way admins read it, with its details first, then its direct members, then each nested group's members.

  • Console: each group has its own heading, then its details (type, source, membership type, created, owners, and counts with guests and disabled accounts), a Direct members table, and a Nested group table for each nested group. A nested group in a table says its members are listed below, or that it's a loop already listed above.
  • HTML: the overview opens on a tree of the groups. Each group opens to its owners and direct members, and each nested group opens to its own members, with GUEST and DISABLED flags and search. A report of a few groups opens fully. New Members tab: everyone in each group once, marked Direct, Nested or Direct and nested, with the nested groups they come through. A "groups without owners" tile.
  • PDF: a page per group with its details, its direct members, and each nested group's members.

Fixed

• Show-AACResourceMap drew false VNet peerings, with no state, between a hub's VPN gateway and its spokes. A spoke peering's remoteGateways and a gateway's remoteVirtualNetworkPeerings were read as peerings. Only a network's link to its remote network is a peering now.
• The map page (Show-AACResourceMap, Show-AACNetworkTopology) showed the hub-and-spoke layout buttons on every map: a CSS rule overrode their hidden attribute.
• Get-AACEntraGroupMembership left service principals out of every group, and so a nested group whose members were service principals looked empty, in the console view, the objects and every export. Microsoft Graph v1.0 leaves service principals out of /groups/{id}/members unless the request is an advanced query. The members are now read with $count=true and ConsistencyLevel: eventual, which returns them. Sign-in is unchanged: the Connect-AAC session.
• Nested group members are now shown expanded, not hidden under their group:
  • CSV (one row per group, Export-EntraGroupMemberShip.ps1's five columns): Members is everyone in the group, flattened. It holds the direct members and the members of every nested group at any depth, each once, with no name (Group) entries. NestedGroupMembers follows every depth and names each group by its path (grp-a: x, y; grp-a > grp-b: z), listing each group once.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.5

Azure.Admin.Console 0.14.4

A fix to Export-AACResource.

Fixed

• Export-AACResource failed or wrote a broken row for a resource whose type has no entry in its details table (for example Microsoft.Insights/actionGroups): it tried to read settings that type doesn't have. Such resources now come out with an empty Details column, and the rest of the export is unchanged.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.4

Azure.Admin.Console 0.14.2

The estate on one screen with Show-AACDashboard, ten commands for the questions cost, security, operations and compliance teams ask every day, and an access review that tells people and workloads apart.

New

• Ten commands for cost, security, operations, compliance and resilience (#10). All are read-only, take the usual scope, and give a console view, objects, CSV, HTML and PDF. Each finding has a severity, impact, remediation and effort.
  • Get-AACCostAnomaly: spend spikes, drops, new spend, level shifts and steady rises per service, resource group, region or meter, found with robust statistics (a median/MAD baseline). Includes the resources behind the largest anomalies, a month-end forecast and how each subscription compares with the others. The issue's name, Get-AACCostAnomalies, was made singular because the build's analyzer rule rejects plural nouns.
  • Get-AACAttackPath: paths from the Internet (NSG rules evaluated in priority order, public apps, AKS API servers, open data stores) through managed identities to control or data access, with blast radius and risk. Defender for Cloud's own attack paths are added when Defender CSPM provides them.
  • Get-AACAccessReview: covers Azure RBAC (permanent, PIM-activated, eligible), classic admins, Entra ID roles and Microsoft Graph application permissions. It finds standing privileged access, guests, apps that can grant access or take over the tenant, disabled, dormant and deleted principals, unused write access (Activity Log), wildcard custom roles and too many Global Administrators. The attestation CSV has Decision and Reviewer columns. Every row has an Action - what to do, for the kind of principal. Just-in-time (PIM) is recommended only for users, guests and groups. Service principals and managed identities with elevated access are flagged as the risk they are, but PIM needs a person to activate a role: they are told how to narrow it (Role Based Access Control Administrator with a condition in place of Owner, resource groups in place of the subscription) and how to protect the credential, and access they haven't used is "Review usage" - check the sign-in logs first - not "Remove". Unused write access is judged only on what the Activity Log records, so roles with data-plane access (blobs, secrets, messages) are never called unused.
  • Get-AACChangeHistory: one entry per operation, with caller, client IP, correlation ID and status. It shows the before and after of each property (Resource Graph changes), how to undo it, its risk and origin (manual, automation, Azure), and the alerts and health events that followed.
  • Invoke-AACHealthCheck: endpoint probes for availability, latency and TLS expiry, with no Azure credential sent. Also database TCP checks, Service Bus backlog and dead letters, Resource Health, Service Health and fired alerts. Results come by tier, with an SLA report; -Watch gives a live board and -SkipAzure runs without signing in.
  • Get-AACComplianceGap: CIS, PCI-DSS, HIPAA, SOC 2, GDPR, ISO 27001, NIST and MCSB, from Defender regulatory compliance and Azure Policy initiatives. It flags failing and manual controls, frameworks not assessed and resources nothing evaluates, with priority × effort as a roadmap and New/Open/Closed against a baseline CSV.
  • Get-AACFailoverReadiness: each workload's backups (fresh, succeeding, restore-tested) and Site Recovery state (health, RPO, test failover, failover allowed). Also vault settings and recovery plan runbooks (they exist and are published), with a confidence score and RPO on track or at risk.
  • Get-AACDependencyGraph: dependencies from networks, pools, Front Door, plans, private endpoints, identities and Application Insights telemetry. It reports blast radius, redundancy, single points of failure, cycles and critical services, with a Graphviz DOT export.
  • Get-AACResourceUtilization: rates resources idle, under-used, hot or right sized from hourly Azure Monitor metrics (CPU, memory, activity), with the trend. Under-used VMs get a size suggestion priced from the public Azure Retail Prices API; -IncludeCost adds an unused-cost chargeback.
  • Get-AACConfigurationDrift: drift against a saved snapshot baseline, desired-state rules (a file, or a built-in security baseline) or a Terraform plan's resource_drift. It shows who changed each setting (Resource Graph's change history), the strategy (Fix, Revert, Re-deploy, Update the baseline, Review) and the trend across runs.
  • Shared plumbing: one finding shape, scope resolution, and one report model that drives the console view, the HTML and a generic PDF writer.
• Invoke-AACM365Assessment reports Microsoft 365 tenant discovery and security posture from the Microsoft Graph REST API, with no AzureAD, MSOnline, AzureADPreview or Microsoft.Graph modules. Every call uses the one Graph token of the Connect-AAC sign-in; about 25 calls run in parallel, each followed through its pages.

  • Entra ID:

    • tenant details and directory sync
    • licences and security defaults
    • user and guest settings, and cross-tenant access
    • Conditional Access policies and named locations
    • admin roles, active and eligible (PIM), with each admin's MFA registration
    • every user's MFA registration
    • authentication methods and identity providers

  • Microsoft 365:

    • domains
    • Microsoft Secure Score and its controls, with the gap and how to fix each
    • SharePoint and OneDrive sharing
    • audit logging: Purview audit log search, from its Secure Score control, and the Entra audit log

  • Intune:

    • tenant settings and enrollment restrictions
    • compliance policies
    • endpoint security policies: antivirus, firewall, disk encryption, EDR, attack surface reduction and account protection
    • managed devices: compliance, encryption, jailbreak, stale
    • Entra ID devices no MDM manages

  • Zero-trust findings, each with what to do. For example:

    • MFA not required of everyone or of admins
    • legacy authentication not blocked
    • no risk-based policy, or policies left in report-only
    • Global Administrator count and standing privileged access
    • admins and users without MFA registered
    • SMS and voice on, FIDO2 off
    • users able to register apps, invite guests or create tenants
    • Anyone links and guest resharing
    • audit log search off and a low Secure Score
    • devices with no compliance policy counted as compliant
    • non-compliant, stale, unencrypted and rooted devices
    • missing endpoint security policies
    • personal enrollment and active unmanaged devices

  • Identity and application checks:

    • MFA coverage: registered and phishing-resistant MFA for members, admins and guests, and the MFA policy's exclusions.
    • Emergency access accounts: found by being excluded from every enabled Conditional Access policy, or by name. Checked for two of them, Global Administrator, cloud-only, enabled, and a passkey.
    • Dangling admins: privileged roles held by deleted, disabled, guest, idle or on-premises-synced accounts, or by apps.
    • Role overlap: Global Administrator plus other roles, three or more privileged roles, and roles both active and eligible.
    • Expiring and long-lived credentials: secrets and certificates on app registrations and non-Microsoft enterprise apps.
    • Over-privileged app permissions: application permissions on Microsoft Graph and delegated consents, rated Critical (can take over the tenant), High (tenant-wide data) or Medium. Microsoft's apps are told apart from yours and third parties', and verified publishers from unverified ones.
    • Dangling redirect URIs: each host is looked up in DNS, so a deleted Azure host anyone could claim is flagged. Wildcard, non-HTTPS and localhost-on-multi-tenant URIs are flagged too.
    • Legacy authentication: the actual IMAP, POP, SMTP AUTH, ActiveSync and similar sign-ins in the last -SignInDays, read with one query per protocol.
    • User consent: who can consent to which apps, group owner consent and the admin consent workflow.
    • Security defaults: flagged when left on in a tenant licensed for Conditional Access.
    • PIM role settings: MFA, approval and justification on activation, maximum activation time, and permanent assignments, for every privileged role.
    • Groups behind exclusions and roles: who is actually in the groups excluded from Conditional Access and the groups holding admin roles, nested members included. Large or dynamic excluded groups and guests in role-holding groups are flagged.
    • Access reviews: whether admin roles and guests are reviewed.
    • Directory sync settings: password hash sync and accidental deletion prevention.
    • Threat protection (a new tab): risky users, Identity Protection risk detections and Microsoft Defender XDR incidents.
    • Inactive licensed users: no activity in 30 days, from the Microsoft 365 usage report.
    • App protection (MAM): iOS and Android policies for personal devices.

  • A Coverage tab replaces the Permissions tab. It lists every lens as Assessed, Partly assessed, Not assessed (with Graph's reason, the permission and any licence it needs) or Not in this run. It also lists what Microsoft Graph doesn't reach, each with what would cover it: Exchange Online, the unified audit log switch, Defender for Office 365, Purview, Teams, Defender for Cloud Apps, Sentinel and Entra Connect servers.

    Graph is read in batches, one after another, each with its own progress line: Entra ID tenant and policies; admin roles, MFA and users; sign-in and audit logs; applications; Microsoft 365; Intune; then the redirect URIs in DNS. Reads inside a batch run in parallel. The latest audit event and th...

Azure.Admin.Console 0.14.1

Microsoft Defender for Cloud assessed end to end, Azure Policy initiatives opened up to their member policies, and HTML reports that fit the screen - on a laptop or an external monitor.

New

• Invoke-AACDefenderAssessment assesses Microsoft Defender for Cloud across subscriptions. It is read-only: Reader or Security Reader is enough, and it needs no Az modules. It reads Azure Resource Graph (securityresources), plus the Defender for Cloud REST API for the settings Resource Graph doesn't hold. Those are one call per subscription and setting, in parallel.
  • Sections (-Section):
    • Recommendations: every recommendation with its unhealthy, healthy and not applicable resources, the risk level, risk factors and attack paths (Defender CSPM), its control, description and remediation steps, and every unhealthy resource.
    • Attack paths: each path from entry point to target, step by step, with its risk factors, MITRE tactics and techniques, attack story and remediation.
    • Security alerts: alerts of the last -AlertDays (default 30), in every status, with MITRE tactics and techniques, compromised entity and remediation steps, plus the suppression rules.
    • Inventory: every resource Defender assesses, with the plan that covers it (on or off), its recommendations by severity, vulnerabilities, alerts and attack paths.
    • Vulnerabilities: sub-assessments, with CVEs and whether a patch exists.
    • Posture: secure score per subscription, the controls with their potential increase, plans with their sub-plan and extensions, multicloud and DevOps connectors, and just-in-time policies.
    • Regulatory compliance: standards, controls and the failed assessments.
    • Environment settings: security contacts, alert and attack path e-mails, and the Defender for Endpoint and Defender for Cloud Apps integrations.
  • Findings, each with what to do:
    • a plan off for resources the subscription has
    • Defender CSPM or Resource Manager off
    • Servers on Plan 1
    • no security contact, alert e-mails off or only for High alerts, owners not notified
    • the Defender for Endpoint integration off
    • a secure score under -ScoreWarningPercent
    • Critical and High attack paths
    • High alerts still active, and Medium alerts open for over a week
    • suppression rules with no expiry
    • just-in-time ports open to any source
  • Outputs: a console view, an AAC.DefenderAssessment object with every table, a CSV per table, and a tabbed HTML report in the portal's order.
• HTML reports can have tabs. A report that asks for them (Write-AACHtmlReport -Tab) gets an Overview tab, with the tiles, charts and tree, then a tab per section, each with a count badge.
  • The open tab is kept in the URL (#tab=).
  • A tile or chart that filters a table opens that table's tab.
  • Printing still shows every tab.
  • Other reports keep their layout.
  • A new path column type shows a chain of steps (a → b → c) as chips joined by arrows, and as a numbered list in the row details.

Changed

• HTML report tables fit the screen, on a laptop or an external monitor. Every command's HTML report shares one page (Private\DataReport.html), so all of them have these changes.

  • Each table scrolls in its own box, sized to the window. Its header row and its horizontal scrollbar stay on screen, and its first column stays put when the table scrolls sideways. Before, the scrollbar was at the bottom of up to 200 rows, and the headers scrolled away with the rows.
  • Width: Fit (the whole window) or Centered.
  • Rows: Compact (one line per cell) or Comfortable (up to two).
  • Sensible defaults: until the viewer picks, a wide screen (1600px and over) gets Fit and a short one (900px and under) gets Compact. Each choice is remembered in the browser for every report.
  • Readable text columns: plain text columns are no longer squeezed to a word per line.
  • Row details: clicking a row opens all its fields in a panel on the right, in full, including the columns hidden from the table. Each field has a Copy button, and resources link to the portal. ↑ and ↓ move through the rows, and Esc closes the panel.
  • Printing is unchanged: every table at full width, with the full text.

• Initiatives opened up: their member policies and the values their parameters end up with. An initiative's parameters alone don't say what each of its policies does: a member policy's parameter can take an initiative parameter (which the assignment may set), a value fixed in the initiative, or the policy's own default. Get-AACAssignedPolicy -ExpandPolicySet returns one row per policy in force and parameter (AAC.AssignedPolicyMember). That covers every member policy of an assigned initiative, and every policy assigned on its own. Each row has the policy's effect, its default, what the initiative passes it (InitiativeValue, InitiativeParameter), the effective value and where it comes from (ValueSource: Assigned, Initiative default, Initiative, Policy default, Expression, Not set). The effect is resolved the same way, and an effect override on the assignment counts (EffectSource Override). The view then lists each initiative's policies under its assignment, -CsvPath writes these rows, and the HTML report always has the table (Policies in force). Invoke-AACPolicyAssessment opens up every assigned initiative too: each member policy with its effect, its parameter values and its compliance, including policies with no compliance data. They come back as the InitiativePolicies of each returned assignment, an initiative-policies CSV and an HTML table (Policies in the initiatives). Both commands resolve the values with one helper (Resolve-AACPolicySetMember).

Fixed

• Warnings were lost at an interactive terminal. There, a command's work runs inside the live progress display, and PowerShell drops the warnings written inside it. So -WarningVariable and -WarningAction never saw messages such as "No group named 'grp-typo' was found", and the warnings that were printed broke the display. They are now kept and written once the display ends.
• The view was paged even when it wasn't drawn to the terminal. Invoke-AACPagedOutput paged whenever the PowerShell console was interactive, even when Spectre.Console was drawing somewhere else (a capture, as the tests use). That output went to the terminal instead of where it was being drawn. It now pages only when Spectre draws to the terminal.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.1

Azure.Admin.Console 0.14.0

Assessments: Azure Policy as a whole, AKS clusters through every lens, virtual networks, Log Analytics workspaces and the whole environment in the spirit of Azure Resource Inventory - plus diagnostic settings, Terraform plans, a storage account deployment, and sign-in without a browser (device code, service principals, managed identity).

New

• Invoke-AACPolicyAssessment - Azure Policy assessed as a whole, following the analysis of AzPolicyLens (github.com/Azure/AzPolicyLens): Reader and Azure Resource Graph only, no Az modules. Discovery is tenant-wide: the management group hierarchy, every assignment, exemption, custom definition and initiative, and every role definition. The assigned built-in definitions and initiatives (and their member policies) are then read by ID, from Resource Manager when Resource Graph lacks them, along with the assignments' managed identities' role assignments. Compliance is counted as AzPolicyLens counts it: each resource once, at its worst state, and (compliant + exempt) / all. It is reported overall and by subscription, management group, assignment and subscription, policy and category, rated against -ComplianceWarningPercent (default 80). Findings with what to do: definitions assigned directly, DoNotEnforce, missing definitions, assignments and subscriptions under the threshold, deprecated or preview policies assigned, excluded scopes that don't exist, the same definition assigned twice on one scope path, Deny without a non-compliance message, DeployIfNotExists and Modify without a managed identity or missing the roles their policies list, exemptions expired, expiring (-ExemptionWarningDays, default 30), without expiry or for a deleted assignment, unassigned custom definitions and initiatives, unused policy definition groups, one control under different group names, and no category. Scope: everything, -ManagementGroupId (and everything under it) or -SubscriptionId (with every assignment that reaches them). -Audience Platform|Application follows AzPolicyLens's detailed and basic wikis. Outputs: a console view, AAC.PolicyAssignmentReport objects, a CSV per table, a PDF, and an interactive HTML report with the management group tree and each level's compliance.
• Invoke-AACAksAssessment - AKS clusters through every lens, read-only, no Az modules or kubectl: every setting that matters by area and every node pool; about 35 Well-Architected checks across the five pillars (Pass or Fail, a score per pillar, what to do) - SLA tier, zones, system pool, version support, local accounts, Entra ID and Azure RBAC, API server exposure, network policy, Azure Policy, Defender, workload identity, node images, upgrade channels, audit logs, autoscaler, ephemeral disks, kubenet, subnet IPs at full scale and more; PSRule for Azure's AKS rules (-Baseline, -ExcludeRule, -SkipPSRule); Azure Policy for Kubernetes consolidated by namespace, workload, policy and cluster as the AKS Policy Compliance Toolkit does - workloads inferred from pod names, effects resolved, system namespaces left out unless -IncludeSystemNamespace, Azure Policy's 500-record cap flagged - and, with -IncludeConstraint, Gatekeeper's complete counts through AKS run command; versions, support and upgrades, node images; Advisor and Defender. A console view, AAC.AksCluster objects, CSV files (with each namespace's non-compliant workloads), a PDF and an interactive HTML report.
• Invoke-AACAssessment - an Azure environment assessed end to end, in the spirit of Azure Resource Inventory (ARI), read-only and REST only (no Az modules, no Excel). Scope: the tenant (-TenantId, its ID or a domain, signs in to it when the session is for another), -ManagementGroupId (at any depth), -SubscriptionId, -ResourceGroupName, -TagKey/-TagValue, -Category. A sheet per resource type present - about 95 types in 14 categories, from VMs (with their NIC's IP, network and NSG, the size's vCPUs and memory), scale sets, disks, AKS and node pools, containers and databases to virtual networks, subnets (free IPs), peerings, NSG rules, firewalls, gateways, private endpoints, App Services, backup items and AI services - as Resource Graph projections; each row also carries its Advisor retirement notice and recommendation count, its cost (-IncludeCost) and tags (-IncludeTag). Overview sheets (subscriptions with their management groups, resource groups, resource types, every resource), Advisor recommendations and score, retirements, Defender for Cloud (-SecurityCenter), Azure Policy compliance, outages (Resource Health), compute quotas (-QuotaUsage), support tickets and reservation recommendations. Reports (-Output): a CSV per sheet, an interactive HTML report (tiles, charts, the tenant tree, a table per sheet by category with contents), a bookmarked PDF, and interactive network, organization and resources diagrams (-DiagramFullEnvironment draws every resource). A live Spectre.Console progress display per phase, and a summary of what was found, what needs attention and where the reports are. -Automation runs in an Azure Automation runbook (managed identity sign-in, plain progress lines) and -StorageAccount/-StorageContainer uploads the reports to blob storage.
• Connect-AAC signs in without a browser on this machine: -DeviceCode (a code entered at microsoft.com/devicelogin), a service principal with -ClientSecret, -CertificatePath (a .pfx) or -CertificateThumbprint (the certificate store) - the token request signed with the key, never sent - and -Identity for a managed identity (Azure Automation, a VM, App Service, Functions). App-only sessions get a new token when one runs out, for Azure Resource Manager and any other API (Azure Storage for the upload).
• Invoke-AACVirtualNetworkAssessment - virtual networks assessed from Azure Resource Graph, read-only: every network you can see, or by subscription, management group, resource group and name (wildcards). Per network: role (hub, spoke), address space with total, in-subnet, unallocated, usable, used and available IPs, the free CIDR blocks a new subnet can take, overlaps with any other network, DNS servers and linked private DNS zones, DNS resolvers, DDoS, encryption, flow logs, gateways, firewalls and Bastion. Per subnet: usable / used / available IPs, purpose, NSG, route table and default route, NAT gateway, the outbound path (NAT gateway, firewall, forced tunnelling, public IPs, private subnet, default outbound access), service endpoints, delegations, private endpoints and their policies, NICs and VMs. Peerings with state, sync, flags, remote space and reverse peering; private endpoints with their connection and DNS zone; ASGs with their members and the NSG rules naming them; and the NSGs on the subnets assessed as Get-AACNetworkSecurityGroup does. Findings by severity with what to do - full subnets, peerings down or out of sync, special subnets too small, an NSG or default route on GatewaySubnet, subnets without NSGs, public-IP VMs, default outbound access, no DDoS, no flow logs, unlinked privatelink zones, Basic or non-zonal gateways, overlaps and more. A console view, AAC.VirtualNetwork objects (with their subnets, peerings, free ranges and findings), and CSV, PDF and interactive HTML reports.
• Deploy-AACStorageAccount - creates or updates a storage account and what's in it (containers, file shares, queues, tables, lifecycle rules, private endpoints with a private DNS zone group, diagnostic settings, role assignments, a lock, blobs) idempotently with the Azure REST APIs - no ARM, Bicep or Terraform template. The Azure Verified Module's parameter names and defaults (enforced on every run, as Bicep would); a .psd1, a .json or an AVM parameters file, and parameters. Plan: read and compared property by property - Create, Update, No change, Replace (can't change in place: location, kind, hierarchical namespace, infrastructure encryption, zonal or Premium redundancy), Drift (-Prune deletes). Gates: the name, the policy assignments for storage, Azure Policy's verdict on every write's exact body (checkPolicyRestrictions: Deny blocks, Audit reported, Modify and Append shown), PSRule for Azure on the account as it will be. Apply: dependency order, PUT to create, PATCH with only what changed, long-running operations followed, role assignments named from scope, principal and role, blobs only when their MD5 differs. Verify: read again - no changes. A failing PSRule rule blocks the deployment and comes with its fix - the setting and value (Get-AACStorageRuleFix), or what to do when no setting can fix it; the view gathers the settings into a configuration snippet, and -UseSuggestedFix deploys with them after checking every gate again (tested against the real PSRule for Azure rules: every automatic fix makes its rule pass). -WhatIf, -Force, -FailOn Audit/Drift, -ExcludeRule, -PlanPath. The module's first command that writes: the HTTP layer gained PUT, PATCH, HEAD and response headers (Invoke-AACArmWrite), and the PSRule engine can run on objects given to it.
• Get-AACDiagnosticSetting - every resource's diagnostic settings, flattened, and the resources whose logs don't reach a Log Analytics workspace. Lists the resources with one KQL query (Resource Graph), adds each storage account's blob, file, queue and table services and each subscription's activity log, reads which types have log categories once per type and kind (diagnosticSettingsCategories), then each resource's settings (diagnosticSettings, 2021-05-01-preview) in parallel. Each resource gets a status - Exported, Partial, Not to workspace, No setting, Unknown - with the reason, counting a category reached by name or through allLogs / audit. Misconfigurations by severity: no setting, activity log not exported, no workspace destination, a deleted workspace, missing categories, nothing enabled, logs sent to a workspace twice, a wo...