Azure.Admin.Console 0.14.8

Architecture design - from requirements to a validated design, diagrams (Mermaid and a multi-page draw.io with Azure icons) and decision records - plus a tenant assessment with a tab for each audience, SBOM in the Azure DevOps assessment and a tabbed Log Analytics workspace report.

Breaking changes

• Invoke-AACAssessment is now Invoke-AACTenantAssessment, alongside the other Invoke-AAC<Thing>Assessment commands: the old name is gone (no alias), and its result's type is AAC.TenantAssessment (was AAC.Assessment). Rename the command in scripts and runbooks; the sheet names are unchanged. The report's default title is now 'Azure tenant assessment', and its Cost tab is now FinOps.
• Invoke-AACTenantAssessment writes each report where you say, and nothing by default. -Output, -ReportDir, -ReportName and -SkipDiagram are gone, and so is the result's ReportFolder: give -HtmlPath and -PdfPath (files), -CsvPath (a folder, a CSV file per sheet) and -DiagramPath (a folder: TenantAssessment-Network.html, -Organization.html and -Resources.html) - any, all or none; without them the run shows its summary and returns the sheets. With -StorageAccount and no path, every report is written to a temporary folder and uploaded, now under TenantAssessment/<date>/ in the container (was AzureAssessment/).
• Get-AACADOInventory is now Invoke-AACADOAssessment (no alias). Its parameters, views and result types are unchanged, with additions (below); the report's default title is now 'Azure DevOps assessment'. Pipelines and Coverage gain an SBOM column, and -ToolRule takes the SBOM category.

New

• Architecture design, a new area. Six commands under src\Architecture take a workload from requirements to a validated design, offline: New-AACArchitectureBrief (about 20 probe questions on the business, reliability, security, performance, cost and operations, each tied to a Well-Architected pillar - asked at the prompt or from a file, with open decisions and assumptions), Get-AACArchitecturePattern (15 Azure Architecture Center cloud design patterns ranked against the brief, with why and their pillar trade-offs), New-AACArchitectureDesign (components, zones, settings and connections from the answers and the patterns; the landing zone's inherited Azure Policy and allowed locations read live; -Override), Test-AACArchitectureDesign (rules mapped to the Well-Architected pillars, built-in Azure Policy and PSRule for Azure, guardrails from a file, blocking findings for what Azure would deny, accepted risks, a score per pillar, -FailOnGap; tabbed HTML and PDF), New-AACArchitectureDiagram (Mermaid, Markdown and draw.io, with WAF, Azure Policy, guardrail, PSRule and Azure Recommendations layers) and Export-AACArchitectureDecision (ADRs for the topology, each pattern and each accepted risk, with the open decisions). The catalog is versioned and every artifact records the version it was made with.

• A detailed, multi-page draw.io for architecture designs. New-AACArchitectureDiagram now writes a five-page .drawio: a Cover (the designs facts, open findings by severity, pillar scores, links to each page), the Architecture (Azure icons inside landing zone, region, hub and spoke virtual network, data, operations and pipeline boxes; a status dot for each components worst finding; each components details as shape data; WAF, Azure Policy, Guardrails, PSRule and Recommendations as draw.io layers), Policy and compliance (the inherited assignments, allowed locations and every design rule for each component with its Azure Policy, PSRule for Azure rule and result), Findings (with open decisions and assumptions) and a Legend. The Azure icons are embedded, so it opens offline.

• A tabbed report and a PDF for the Log Analytics workspace assessment. Invoke-AACLogAnalyticsWorkspaceAssessment -HtmlPath now writes a tabbed report like the other assessments - a Summary tab (headline, tiles, charts), then a tab per section (Recommendations, Tables, Settings, Usage, Health, Agents, Query audit, Data collection rules, Change log) with hover cards on the recommendations, operations, slowest queries and data collection rules - and the new -PdfPath writes it as a PDF, each section a bookmarked heading.

• The tenant assessment has a tab for each audience. Invoke-AACTenantAssessment adds Identity and access (privileged role assignments at the root, management groups and subscriptions - permanent, time-bound, activated or eligible in Privileged Identity Management, with guests, service principals and deleted principals flagged; custom roles allowing *; classic administrators; Defender plans against what each subscription runs; Key Vault and app registration credentials expired or expiring within -ExpiryDays; SSH, RDP and WinRM open to the internet; PaaS public network access), Architecture (the management group hierarchy, subscriptions at the root and policy in force at each level; regions with zones and paired regions; zone redundancy, Azure Backup and Site Recovery of the critical resources; hub and spoke or Virtual WAN, address overlaps and private DNS zones), Operations (diagnostic settings coverage and workspaces; Service Health alerts per subscription and alert rules without an action group; Update Manager patch compliance and Arc servers; locks on production; the Activity Log over -ActivityDays and failed deployments; retired and retiring SKUs; naming against the Cloud Adoption Framework's abbreviations and owner tags) and Service delivery (subscription offers and support plans; reservation and savings plan use; quota headroom; the month-on-month cost trend; the ownership map). Every gap is a resource recommendation. New parameters: -SkipIdentity, -SkipKeyVault, -ActivityDays, -ExpiryDays, -OwnerTag, -ProductionPattern.

• SBOM in the Azure DevOps assessment. Invoke-AACADOAssessment has an SBOM tab: which build pipelines generate a software bill of materials - the Microsoft SBOM Tool (sbom-tool generate, the Manifest Generator task, GenerateSBOM=true), 1ES Pipeline Templates, Syft, CycloneDX, Trivy, Docker - and which validate one (sbom-tool validate); then the SBOM each one's latest successful run published, read from its artifacts (pipeline or build artifacts: the _manifest/spdx_2.2 or spdx_3.0 manifest.spdx.json, or any SPDX or CycloneDX JSON file) - format, the tool that made it, components, files, completeness against the NTIA minimum elements, licences by kind (permissive, weak or strong copyleft, unknown); every component with its version, ecosystem, supplier, licence and package URL (-View SbomComponent); licences per project (-View SbomLicense). Findings (area Supply chain): pipelines that deploy or publish with no SBOM, an SBOM generated but not published, incomplete SBOMs, strong copyleft licences, mostly unknown licences, SBOMs never validated. -Skip Sbom leaves the artifacts unread.

• The tenant assessment covers the Well-Architected Framework, FinOps and each resource's policy compliance. Invoke-AACTenantAssessment now also runs Invoke-AACWafAssessment's checks across the scope (unless -SkipWaf): WAF pillars (score and maturity), WAF design principles, WAF checks and WAF findings, on a Well-Architected tab. A FinOps tab: Savings opportunities by lever (waste - unattached disks, unused public IPs, VMs stopped but billed, empty plans, old snapshots; rightsizing and rate from Advisor; Azure Hybrid Benefit; old VM generations) with an estimated annual saving, Cost allocation (cost-allocation tags per subscription, -CostTag, and the untagged cost), Budgets (spent and forecast against each budget, its alerts, and the subscriptions with none) and, with -IncludeCost, Cost by service, Cost by resource group and Top cost resources (this month projected against last month). Every inventory sheet and All resources gain Policy (Non-compliant, Compliant, Exempt, Not evaluated), Non-compliant policies, Failing policies (by name), WAF gaps and, with -PSRule, PSRule failures. Resource recommendations add the Well-Architected gaps (not Advisor's or Defender's twice) and FinOps (budgets over or missing, untagged cost). New tiles and charts for the score, savings, tag coverage and budgets; -Full turns on -SecurityCenter, -IncludeCost, -IncludeTag, -PSRule and -QuotaUsage at once. The result adds WafScore, AnnualSavings and Recommendations.

• IP address management, with no server to run. Get-AACIPAMReport measures Azure's address space - read from Azure Resource Graph, nothing stored - against your address plan (-AddressPlan: spaces and blocks plus external ranges, from a .psd1, .json or .csv file or a hashtable; the private ranges when none is given). Spaces; blocks with the address space allocated (overlaps counted once), free space, the largest free range, the next free range and how many still fit, against -WarningPercent and -CriticalPercent; every network - virtual networks, Virtual WAN hubs, external ranges - as Managed, Partly managed or Unmanaged, with DNS servers, peerings and the Azure IPAM reservation tag; every subnet and every private IP address Azure counts in it (virtual machines, scale set instances, private endpoints, load balancers, firewalls, gateways, Bastion, application gateways, unattached network interfaces), so a subnet's count and its list agree; overlaps (High when peered, Medium with an external range or a hub); the next ranges of each -NextAvailable size (best fit and lowest address); -TestCidr checks; findings. A tabbed HTML report with the plan as a tree, a Space selector and hover cards; -Open opens it. Console view, objects (-View), CSV and PDF.

• Function App assessment. Invoke-AACFunctionAppAssessment assesses Function Apps (Windows, Linux, containers, Flex Consumption) end to end: hosting and plan (SKU, instances, burst, zone redundancy, CPU and memory); usage over -TimeRange - executions, GB-seconds, requests, 5xx and 4xx, error rate, response time, memory, an estimated Consumption cost, idle apps; every function with its trigger, auth level, schedule and bindings; the Functions runtime, language version against its end of support and the .NET in-process model; the configuration by area and the app settings by name and kind (never values; they need Website Contributor, -SkipSettings skips them); networking; the deployment center, recent deployments and slots; backups; Service Connector connections and the services named in settings with how each authenticates; the Activity Log over -ActivityDays (restarts, configuration changes, deployments, slot swaps, settings and keys read); about 30 Well-Architected checks scored per app and pillar; PSRule for Azure on the apps and plans; Advisor and Defender. A tabbed HTML report with a tab per audience (service summary, apps and plans, usage, functions, configuration, networking, deployment, backups and connections, Activity Log, Well-Architected, PSRule, recommendations, findings), an App selector and hover cards; console view, objects (-View), CSV and PDF.

• Hover cards in HTML reports. A table can name fields (Hover) shown in a card that follows the pointer over a row, and a column can take another field as its tooltip (Tip) - every report can use them.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.8