Azure.Admin.Console 0.14.9

The Activity Log, made readable and assessed over a year; the Azure Policy that applies to a resource, before and after it is deployed; Service Bus entities as an entity-scoped role sees them - and the Key Vault assessment renamed to match the others.

Breaking changes

• Get-AACKeyVaultInsight is now Invoke-AACKeyVaultAssessment, alongside the other Invoke-AAC<Thing>Assessment commands: it reads metrics, settings and the audit logs, scores each vault in a heat map and raises findings. The old name is gone (no alias). The per-vault row's type is AAC.KeyVaultAssessment (was AAC.KeyVaultInsight); AAC.KeyVaultOperation, AAC.KeyVaultObject and AAC.KeyVaultFinding are unchanged. The parameters are unchanged; the reports' default title is "Key Vault assessment". In scripts, replace Get-AACKeyVaultInsight with Invoke-AACKeyVaultAssessment, and AAC.KeyVaultInsight with AAC.KeyVaultAssessment anywhere you test the type.

New

• Service Bus entities, as you can see them. Show-AACServiceBusEntity -NamespaceId <id> -EntityName <names> shows queues and topics as the signed-in user can read them - with a role on the namespace, or only on the entities (Azure Service Bus Data Sender or Receiver) - and says which. Live state for everyone: active, dead-lettered, scheduled and transfer messages, size against the maximum, status, each topic subscription and every setting. With namespace access, also wildcards or every entity, and Azure Monitor metrics per queue or topic over -TimeRange (messages in and out, completed and abandoned, requests, errors, throttling, backlog, size, send latency, Premium CPU and memory) with a trend. Without it, -Sample reads the live counts a few times for a backlog trend. Findings (dead-letters, filling up, throttling, a growing backlog, no role, not found), a "What you can see" tab with the role that would show more, and the usual console view, objects (-View Entity, Subscription, Metric, Sample, Finding, Access) and CSV, HTML and PDF reports.
• Activity Log events, readable. Show-AACActivityLogEvent flattens each Activity Log event into one row and a card. A row covers when, what, the result (HTTP status, and for a failure the innermost error code, message and target from the status message, the kind of failure, what to do and a docs link), who (caller kind, app and object ID, sign-in method, home or external tenant, directory roles, token times, caller IP), where (subscription, resource group, type, name, location, tags, portal link) and the IDs to trace it. Events come from a JSON file saved from the portal (no sign-in needed), from -CorrelationId (Activity Log, or -WorkspaceId for Log Analytics), or from the pipeline: events, JSON text, or rows with a correlation ID. Opaque token claims are hidden unless -IncludeClaims. Views: Event, Detail, Error, Caller, Claim; console, CSV, HTML and PDF.
• Activity Log assessment. Invoke-AACActivityLogAssessment shows the Activity Log of every resource over 90, 180 or 365 days (-Days), with subscription, resource group, resource and tags on every row. Its Resources view gives each resource's state (Active, New, Quiet, Idle, Deleted, Gone), when it was last used and how many days it has been idle, and its operations, failures, changes by hand, callers, earliest write and deleter. Further views cover distinct activity, callers, findings (guests and people changing access, keys read by people, failure hotspots, changes by hand, idle resources, missing tags, coverage gaps) and coverage. It reads the fastest way each subscription allows: the Log Analytics workspace its Activity Log is exported to, found automatically from the diagnostic settings (or -WorkspaceId), with monthly queries summarised in the workspace and run in parallel. Otherwise it uses the REST API (90 days), cut into about 1,500 slices read side by side.
• The policy that applies to a resource. Show-AACEffectivePolicy -ResourceId <id> (or -SubscriptionId with -ResourceGroupName / -ResourceType, or piped resources) starts from the resource: every assignment on its path - management groups, subscription, resource group - and each initiative member, with a verdict (Applies, Exempt, Excluded by notScopes, Not selected by resource selectors, Not targeted by the rule, data-plane modes included), the effect in force after parameters and overrides and what it does there (Blocks, Blocks delete, Changes, Deploys, Audits, Reports only when not enforced), the compliance state and - from Policy Insights - why: the field, the value expected and the value found. Non-compliance messages, the assignment's managed identity, definition version and regulatory controls are on each row. Findings: non-compliant resources a deny will refuse at their next deployment, remediation that can't run (no identity) or hasn't, exemptions ending within 30 days or expired. With -Scope and -ResourceType (plus -Location, -Sku, -Tag, -Property) it checks a resource that doesn't exist yet with Azure Policy's checkPolicyRestrictions: what would refuse, audit or change it, and the values allowed.
• Templates checked against Azure Policy before they deploy. Test-AACPolicyDeployment -TemplatePath <main.json|main.bicep> -SubscriptionId <id> -ResourceGroupName <name> works out the template's resources offline (parameters, variables, most template functions, Bicep modules, child resources; what is only known at deployment is left out and named, never guessed), asks Azure Policy about each, and reports Blocked, Audited, Changed or Passes with the reason and allowed values - plus the policies that act only after the deployment. -ParameterPath, -Parameter, and -FailOn Deny or Audit for a pipeline gate.

Changed

• Invoke-AACActivityLogAssessment's Activity rows carry the latest operation's CorrelationId and SubscriptionId and, for failures, ErrorCode and ErrorMessage. The failure-hotspot finding names the error. Statuses read from Log Analytics (Failure, Success, Start) are normalised to the REST API's (Failed, Succeeded, Started), so workspace failures are counted.
• Get-AACResourceError, Invoke-AACActivityLogAssessment and Show-AACActivityLogEvent read a failed event's error with one shared reader. The "Not found" advice now mentions versions and the region.
• Deploy-AACStorageAccount's policy gate uses the same checkPolicyRestrictions helper as the new commands; what it reports is unchanged.
• The policy assignment read (shared by Get-AACAssignedPolicy and the tenant assessment) also reads resource selectors, non-compliance messages, definition version, managed identity type and definition mode.
• Read-AACMetric (internal) returns each call's HTTP status, so a 403 shows as "no permission" rather than a failure.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.9