Azure.Admin.Console 0.14.0

Assessments: Azure Policy as a whole, AKS clusters through every lens, virtual networks, Log Analytics workspaces and the whole environment in the spirit of Azure Resource Inventory - plus diagnostic settings, Terraform plans, a storage account deployment, and sign-in without a browser (device code, service principals, managed identity).

New

• Invoke-AACPolicyAssessment - Azure Policy assessed as a whole, following the analysis of AzPolicyLens (github.com/Azure/AzPolicyLens): Reader and Azure Resource Graph only, no Az modules. Discovery is tenant-wide: the management group hierarchy, every assignment, exemption, custom definition and initiative, and every role definition. The assigned built-in definitions and initiatives (and their member policies) are then read by ID, from Resource Manager when Resource Graph lacks them, along with the assignments' managed identities' role assignments. Compliance is counted as AzPolicyLens counts it: each resource once, at its worst state, and (compliant + exempt) / all. It is reported overall and by subscription, management group, assignment and subscription, policy and category, rated against -ComplianceWarningPercent (default 80). Findings with what to do: definitions assigned directly, DoNotEnforce, missing definitions, assignments and subscriptions under the threshold, deprecated or preview policies assigned, excluded scopes that don't exist, the same definition assigned twice on one scope path, Deny without a non-compliance message, DeployIfNotExists and Modify without a managed identity or missing the roles their policies list, exemptions expired, expiring (-ExemptionWarningDays, default 30), without expiry or for a deleted assignment, unassigned custom definitions and initiatives, unused policy definition groups, one control under different group names, and no category. Scope: everything, -ManagementGroupId (and everything under it) or -SubscriptionId (with every assignment that reaches them). -Audience Platform|Application follows AzPolicyLens's detailed and basic wikis. Outputs: a console view, AAC.PolicyAssignmentReport objects, a CSV per table, a PDF, and an interactive HTML report with the management group tree and each level's compliance.
• Invoke-AACAksAssessment - AKS clusters through every lens, read-only, no Az modules or kubectl: every setting that matters by area and every node pool; about 35 Well-Architected checks across the five pillars (Pass or Fail, a score per pillar, what to do) - SLA tier, zones, system pool, version support, local accounts, Entra ID and Azure RBAC, API server exposure, network policy, Azure Policy, Defender, workload identity, node images, upgrade channels, audit logs, autoscaler, ephemeral disks, kubenet, subnet IPs at full scale and more; PSRule for Azure's AKS rules (-Baseline, -ExcludeRule, -SkipPSRule); Azure Policy for Kubernetes consolidated by namespace, workload, policy and cluster as the AKS Policy Compliance Toolkit does - workloads inferred from pod names, effects resolved, system namespaces left out unless -IncludeSystemNamespace, Azure Policy's 500-record cap flagged - and, with -IncludeConstraint, Gatekeeper's complete counts through AKS run command; versions, support and upgrades, node images; Advisor and Defender. A console view, AAC.AksCluster objects, CSV files (with each namespace's non-compliant workloads), a PDF and an interactive HTML report.
• Invoke-AACAssessment - an Azure environment assessed end to end, in the spirit of Azure Resource Inventory (ARI), read-only and REST only (no Az modules, no Excel). Scope: the tenant (-TenantId, its ID or a domain, signs in to it when the session is for another), -ManagementGroupId (at any depth), -SubscriptionId, -ResourceGroupName, -TagKey/-TagValue, -Category. A sheet per resource type present - about 95 types in 14 categories, from VMs (with their NIC's IP, network and NSG, the size's vCPUs and memory), scale sets, disks, AKS and node pools, containers and databases to virtual networks, subnets (free IPs), peerings, NSG rules, firewalls, gateways, private endpoints, App Services, backup items and AI services - as Resource Graph projections; each row also carries its Advisor retirement notice and recommendation count, its cost (-IncludeCost) and tags (-IncludeTag). Overview sheets (subscriptions with their management groups, resource groups, resource types, every resource), Advisor recommendations and score, retirements, Defender for Cloud (-SecurityCenter), Azure Policy compliance, outages (Resource Health), compute quotas (-QuotaUsage), support tickets and reservation recommendations. Reports (-Output): a CSV per sheet, an interactive HTML report (tiles, charts, the tenant tree, a table per sheet by category with contents), a bookmarked PDF, and interactive network, organization and resources diagrams (-DiagramFullEnvironment draws every resource). A live Spectre.Console progress display per phase, and a summary of what was found, what needs attention and where the reports are. -Automation runs in an Azure Automation runbook (managed identity sign-in, plain progress lines) and -StorageAccount/-StorageContainer uploads the reports to blob storage.
• Connect-AAC signs in without a browser on this machine: -DeviceCode (a code entered at microsoft.com/devicelogin), a service principal with -ClientSecret, -CertificatePath (a .pfx) or -CertificateThumbprint (the certificate store) - the token request signed with the key, never sent - and -Identity for a managed identity (Azure Automation, a VM, App Service, Functions). App-only sessions get a new token when one runs out, for Azure Resource Manager and any other API (Azure Storage for the upload).
• Invoke-AACVirtualNetworkAssessment - virtual networks assessed from Azure Resource Graph, read-only: every network you can see, or by subscription, management group, resource group and name (wildcards). Per network: role (hub, spoke), address space with total, in-subnet, unallocated, usable, used and available IPs, the free CIDR blocks a new subnet can take, overlaps with any other network, DNS servers and linked private DNS zones, DNS resolvers, DDoS, encryption, flow logs, gateways, firewalls and Bastion. Per subnet: usable / used / available IPs, purpose, NSG, route table and default route, NAT gateway, the outbound path (NAT gateway, firewall, forced tunnelling, public IPs, private subnet, default outbound access), service endpoints, delegations, private endpoints and their policies, NICs and VMs. Peerings with state, sync, flags, remote space and reverse peering; private endpoints with their connection and DNS zone; ASGs with their members and the NSG rules naming them; and the NSGs on the subnets assessed as Get-AACNetworkSecurityGroup does. Findings by severity with what to do - full subnets, peerings down or out of sync, special subnets too small, an NSG or default route on GatewaySubnet, subnets without NSGs, public-IP VMs, default outbound access, no DDoS, no flow logs, unlinked privatelink zones, Basic or non-zonal gateways, overlaps and more. A console view, AAC.VirtualNetwork objects (with their subnets, peerings, free ranges and findings), and CSV, PDF and interactive HTML reports.
• Deploy-AACStorageAccount - creates or updates a storage account and what's in it (containers, file shares, queues, tables, lifecycle rules, private endpoints with a private DNS zone group, diagnostic settings, role assignments, a lock, blobs) idempotently with the Azure REST APIs - no ARM, Bicep or Terraform template. The Azure Verified Module's parameter names and defaults (enforced on every run, as Bicep would); a .psd1, a .json or an AVM parameters file, and parameters. Plan: read and compared property by property - Create, Update, No change, Replace (can't change in place: location, kind, hierarchical namespace, infrastructure encryption, zonal or Premium redundancy), Drift (-Prune deletes). Gates: the name, the policy assignments for storage, Azure Policy's verdict on every write's exact body (checkPolicyRestrictions: Deny blocks, Audit reported, Modify and Append shown), PSRule for Azure on the account as it will be. Apply: dependency order, PUT to create, PATCH with only what changed, long-running operations followed, role assignments named from scope, principal and role, blobs only when their MD5 differs. Verify: read again - no changes. A failing PSRule rule blocks the deployment and comes with its fix - the setting and value (Get-AACStorageRuleFix), or what to do when no setting can fix it; the view gathers the settings into a configuration snippet, and -UseSuggestedFix deploys with them after checking every gate again (tested against the real PSRule for Azure rules: every automatic fix makes its rule pass). -WhatIf, -Force, -FailOn Audit/Drift, -ExcludeRule, -PlanPath. The module's first command that writes: the HTTP layer gained PUT, PATCH, HEAD and response headers (Invoke-AACArmWrite), and the PSRule engine can run on objects given to it.
• Get-AACDiagnosticSetting - every resource's diagnostic settings, flattened, and the resources whose logs don't reach a Log Analytics workspace. Lists the resources with one KQL query (Resource Graph), adds each storage account's blob, file, queue and table services and each subscription's activity log, reads which types have log categories once per type and kind (diagnosticSettingsCategories), then each resource's settings (diagnosticSettings, 2021-05-01-preview) in parallel. Each resource gets a status - Exported, Partial, Not to workspace, No setting, Unknown - with the reason, counting a category reached by name or through allLogs / audit. Misconfigurations by severity: no setting, activity log not exported, no workspace destination, a deleted workspace, missing categories, nothing enabled, logs sent to a workspace twice, a workspace other than -ExpectedWorkspace, another region, the retired retention policy. -NotExportedOnly, -ExpandSetting (one row per setting), -IncludeUnsupported, -ResourceType (wildcards). Console view, objects, CSV, HTML and PDF.
• Invoke-AACLogAnalyticsWorkspaceAssessment -WorkspaceId - one Log Analytics workspace assessed, read-only, by workspace ID (GUID), resource ID or name: billable and not billable tables with their size over -Days (billable and free GB, share, daily average, last record) merged with each table's plan and retention; every workspace setting (anything not mapped goes under Other); recommendations from Azure Advisor and the assessment's own rules (pricing and commitment tiers, the daily cap, spikes, retention, Basic/Auxiliary plan candidates, ContainerLog, AzureDiagnostics, unused custom tables, retired MMA agents, silent agents, operation errors, unassociated DCRs, shared keys, network access, access control mode, query auditing, diagnostic settings); the data collection rules sending to it with their associations; and the Workspace Insights views - Overview, Usage (per day, solution, resource, computer), Health (_LogOperation, latency), Agents, Query Audit (LAQueryLogs), Data Collection Rules and Change Log (activity log). KQL runs up to 5 queries at a time, each on its own, so one failing doesn't stop the rest. -Section reads only what is asked for. Console view, an AAC.LogAnalyticsWorkspaceAssessment object, CSV (the tables) and HTML (every section).
• Get-AACTerraformPlan - a Terraform plan in JSON (terraform show -json tfplan > plan.json), read whole and flattened: one row per resource change (AAC.TerraformChange) with the action (Create, Update, Replace, Delete, Read, Import, Move, Forget), why, the Azure name, resource group, location and ID, and the attributes that force a replacement; -ExpandAttribute for one row per changed attribute (AAC.TerraformAttributeChange) with its before and after value, flattened to a path (tags["cost.centre"], security_rule[name=ssh].access, policy_rule{json}.then.effect inside a JSON-encoded string). Blocks in a list are paired by content, then by name, then in order; a list in another order is reported as reordered. Outputs and the changes made outside Terraform (resource_drift, -IncludeDrift) are read too. Sensitive values, which the plan JSON holds in clear text, are never shown, returned or written. Offline: no sign-in. -Action, -Address, -ResourceType (wildcards); a binary plan, Terraform state or other JSON is refused with what to run; UTF-16 files are read. Console view (Terraform's summary line, a table per action with +, -, ~ attribute lines and # forces replacement), objects, CSV and HTML.

Changed

• HTML reports can group their tables. A table with a section is drawn under its heading, and the sections are listed in a Contents block above the tables - for reports with many tables, such as Invoke-AACAssessment's.
• The resource map draws management groups as boxes, for the assessment's organization diagram.
• Collapsible tables in every HTML report. Each table now starts collapsed, with a header showing its title, row count and note; click it (or press Enter or Space) to show or hide the table, or use Expand all tables / Collapse all tables. A tile, chart bar or tree link that filters a table opens it first. Printing shows every table. One change to the shared page (Private\DataReport.html), so every command's report has it.
• Bookmarks in every PDF report. A PDF can't hide tables in most viewers, so each report now opens with its bookmarks panel showing: one bookmark per section and table, nested by level and collapsed. Where a report skipped a heading level, the bookmark tree used to get untitled entries; they are gone (Set-AACPdfOutline).

Fixed

• -WhatIf and hashtables. Under -WhatIf, ForEach-Object <Name> on a hashtable treats reading the key as an operation and returns nothing - silently. Commands that run under -WhatIf turn it off while they only read, and the new code reads keys with script blocks. A module test also catches any variable that is a parameter under another case ($current and -Current are one variable).
• Resource Graph errors said only "Please provide below info when asking for support". The real reason (an invalid query, and where) is in the error's details, which weren't read. Every command now shows it, with the support line (timestamp, correlation ID) at the end.
• The live progress display hid a command's own variables. Its script block runs inside Invoke-AACProgress, whose locals ($action, $description, $progress...) shadowed any caller variable of the same name: Get-AACTerraformPlan -Action read the display's callback instead, so at a terminal it filtered out every change. The helper's locals are now prefixed aac.
• Objects lost their format view after the console view. Select-Object -First adds a Selected. type name to the very objects it passes on, so rows shown in a view and then returned with -PassThru lost their AAC.* type. The new commands' views use Select-AACFirst, which passes them on untouched.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.0