Azure.Admin.Console 0.14.5

A Well-Architected assessment with a go-live gate, insights for Key Vault, storage accounts, Application Gateways and the hybrid network, a network topology diagram, workbook-style heat maps in every report, and clearer Entra ID group membership.

New

• Well-Architected assessment across the five pillars, scored by pillar, design principle and check, from one Resource Graph batch:

  • Invoke-AACWafAssessment: Reliability, Security, Cost Optimization, Operational Excellence and Performance Efficiency. Scores are 0-100, with checks weighted by severity, each pillar's maturity, and heat maps by subscription, resource group or resource type. It checks about 60 catalogue items plus Advisor and Defender for Cloud, counting a finding once when Advisor or Defender repeat a catalogue check (-KeepDuplicates counts both). -AttestationPath scores the team's questionnaire answers, and -HistoryPath keeps the trend.
  • Test-AACGoLiveReadiness: a go-live gate. It checks pillar scores against -MinimumScore or -PillarMinimum, high-severity findings, -RequiredCheck, and principles covered. The verdict is Ready or Not ready, with the blockers listed. -FailOnGap fails a pipeline.
  • Export-AACWafQuestionnaire: one question per design principle (24), for what no API can test.
  • Get-AACWafCheck: the check catalogue, and how each principle is covered.

• Get-AACKeyVaultInsight: what Azure Monitor's Key Vault workbook shows (availability, transactions, latency, failures by status code, operations from the audit logs), plus:

  • saturation (SaturationShoebox);
  • posture: soft delete, purge protection, RBAC, network, private endpoints, Defender, audit logs;
  • callers denied or throttled, from both AzureDiagnostics and AZKVAuditLogs, with -IncludeOperations;
  • secrets, keys and certificates expired, expiring or never expiring (metadata only), with -IncludeObjects;
  • findings and a vault-by-signal heat map.

• Show-AACApplicationGatewayMap: Application Gateways as their connection flow, opened in your browser. It shows frontend IPs, listeners, rules, path rules and redirects, backend settings and probes, pools and targets (resolved to VMs and App Services), and WAF policies, inside their network and subnet.

  • Health: from metrics, or the live backend health check with -IncludeHealth (each target's state and the probe's reason).
  • At the prompt: the flows and findings: v1 SKU, WAF off or in Detection, old TLS policy, HTTP not redirected, certificates expired, expiring or uploaded, missing or mismatched probes, empty or unhealthy pools, and unused parts.

• Get-AACNetworkHealth: the Azure Network Monitoring workbook's signals with % of capacity, thresholds, findings and Resource Health, for:

  • ExpressRoute circuits: BGP and ARP availability per peering and link, link utilisation, traffic on one link, QoS drops, provisioning;
  • ExpressRoute gateways: CPU, packets per second, routes advertised and learned against their limits;
  • VPN and point-to-site gateways: bandwidth, BGP peers, point-to-site users, active-active;
  • connections and tunnels: connected or not, drops;
  • Azure Firewall: health, SNAT, throughput, latency;
  • NAT gateways: data path, drops, SNAT.

  Every finding says when it happened (the peak, the first and last time it was seen, or since when), and each report gives the period covered.

• Invoke-AACStorageAccountAssessment: what Azure Monitor's Storage accounts workbook shows - its Overview tab (transactions, end-to-end and server latency, errors by response type) and Capacity tab (used, blob, file, queue and table capacity, with blob, container and share counts) - plus:

  • health: availability, throttling, server, authorization and network errors, slow responses, time lost between client and service;
  • security: HTTPS, TLS, anonymous blob access, network access, shared keys and their age, key and SAS expiry policies, cross-tenant replication, blob logs, Defender for Storage;
  • data protection: redundancy, blob, container and file share soft delete, versioning;
  • cost: legacy account kinds, lifecycle rules, idle accounts, hot tier with little activity;
  • findings and an account-by-signal heat map; the reports' tabs follow the workbook.

• Heat maps in the console, PDF and HTML reports of any command (the report engine's new HeatMaps). The HTML is workbook style: a cell's colour is its score, and clicking it lists its findings.

• Show-AACNetworkTopology: the network topology of the tenant, management groups, subscriptions or regions, as an interactive diagram in your browser. Read-only, with Resource Graph.

  • What it reads: networks, subnets and peerings (across subscriptions, and to networks you can't see); VPN and ExpressRoute gateways, connections and circuits; Virtual WAN hubs; Azure Firewalls and network virtual appliances (VMs whose NIC forwards IP traffic); NSGs, route tables, NAT, Bastion, load balancers and Application Gateways; VMs, scale sets and private endpoints in their subnets, with the PaaS resources the endpoints serve. -NetworkOnly leaves out the workloads.
  • Roles: each network is a hub, a spoke of a hub, peered or standalone.
  • Two layouts, switched on the page: Hub & spoke puts each hub at the centre with its spokes in rings around it. Hierarchy nests boxes: tenant, management group, subscription, region, resource group, network, subnet (-GroupBy for fewer levels). Subnets are drawn in rows, sized by their prefix.
  • Lines: peerings with their state (red when not Connected), private endpoints to their PaaS, routes to the firewall or appliance that inspects them.
  • Findings: peerings not connected, routes to unknown next hops, spoke subnets whose internet traffic isn't inspected, peerings to networks you can't see, standalone networks.

• Get-AACDiagnosticSetting -Status: only the resources with these statuses (Exported, Partial, Not to workspace, No setting, No logs, Unknown). The view, objects, CSV, HTML and PDF, and the misconfigurations, then cover only those resources, while the coverage tiles still describe the whole scope. -Status 'No setting' lists the resources that support diagnostic logs but have no diagnostic setting at all.

• Get-AACEntraGroupMembership shows each group's owners (users and service principals, Name (UPN)), when it was created (UTC) and its membership type (Assigned, Dynamic, or Dynamic (paused)), next to its type and source. You'll find them in the console (groups table and each group's heading), on every row (MembershipType, GroupCreated, GroupOwners), in the HTML and PDF groups tables, and in the CSV, as three columns after Export-EntraGroupMemberShip.ps1's five (Owners, CreatedDateTime, MembershipType). Owners are read only for the groups asked for, not for the groups nested in them.

• Get-AACEntraGroupMembership reports are easier to read: each group is laid out the way admins read it, with its details first, then its direct members, then each nested group's members.

  • Console: each group has its own heading, then its details (type, source, membership type, created, owners, and counts with guests and disabled accounts), a Direct members table, and a Nested group table for each nested group. A nested group in a table says its members are listed below, or that it's a loop already listed above.
  • HTML: the overview opens on a tree of the groups. Each group opens to its owners and direct members, and each nested group opens to its own members, with GUEST and DISABLED flags and search. A report of a few groups opens fully. New Members tab: everyone in each group once, marked Direct, Nested or Direct and nested, with the nested groups they come through. A "groups without owners" tile.
  • PDF: a page per group with its details, its direct members, and each nested group's members.

Fixed

• Show-AACResourceMap drew false VNet peerings, with no state, between a hub's VPN gateway and its spokes. A spoke peering's remoteGateways and a gateway's remoteVirtualNetworkPeerings were read as peerings. Only a network's link to its remote network is a peering now.
• The map page (Show-AACResourceMap, Show-AACNetworkTopology) showed the hub-and-spoke layout buttons on every map: a CSS rule overrode their hidden attribute.
• Get-AACEntraGroupMembership left service principals out of every group, and so a nested group whose members were service principals looked empty, in the console view, the objects and every export. Microsoft Graph v1.0 leaves service principals out of /groups/{id}/members unless the request is an advanced query. The members are now read with $count=true and ConsistencyLevel: eventual, which returns them. Sign-in is unchanged: the Connect-AAC session.
• Nested group members are now shown expanded, not hidden under their group:
  • CSV (one row per group, Export-EntraGroupMemberShip.ps1's five columns): Members is everyone in the group, flattened. It holds the direct members and the members of every nested group at any depth, each once, with no name (Group) entries. NestedGroupMembers follows every depth and names each group by its path (grp-a: x, y; grp-a > grp-b: z), listing each group once.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.5