AzGovViz - Azure Governance Visualizer

Do you want to get granular insights on your technical Azure Governance implementation? - document it in CSV, HTML, Markdown and JSON?
AzGovViz is a PowerShell script that iterates your Azure Tenant´s Management Group hierarchy down to Subscription level. It captures most relevant Azure governance information such as Azure Policy, RBAC and Blueprints and a lot more. From the collected data AzGovViz provides visibility on your HierarchyMap, creates a TenantSummary, creates DefinitionInsights and builds granular ScopeInsights on Management Groups and Subscriptions. The technical requirements are minimal.

This version is a fork from version 6 of the original code by Julian Heyward. This fork was initially created to remove links loading graphics and HTML files from a third party website and remove default statistics collection.

Additional changes in this fork:

• Creation of a default output folder with subdirectories created by date_time added.
• Set statistics collection to disabled by default.
• Removed code that connected to Application Insights when the option not to collect statistics was selected.

You can run the script either for your Tenant Root Group or any other Management Group.

AzGovViz @ Microsoft CAF & WAF

Microsoft Cloud Adoption Framework (CAF)

Listed as tool for the Govern discipline in the Microsoft Cloud Adoption Framework

Included in the Microsoft Cloud Adoption Framework´s Strategy-Plan-Ready-Gov Azure DevOps Demo Generator template

Microsoft Well Architected Framework (WAF)

Listed as security monitoring tool in the Microsoft Well Architected Framework

Content

• Release history
• Demo
• Features
• Screenshots
• Outputs
• AzGovViz Setup Guide
• Technical documentation
  • Permissions overview
  • Required permissions in Azure
  • Required permissions in Azure Active Directory
  • PowerShell
  • Parameters
• Integrate with AzOps
• Stats
• Security
• Known issues
• Final note

Release history

Changes (2021-Dec-31)

• removed all links to https://www.azadvertizer.net from the code to remove information leak security risk.
• Added a default output folder with subdirectories created by date_time added.
• Set statistics collection to disabled by default.
• Removed code that collected statistics on whether statistics collection was possible when user chose the option to NOT collect statistics.

Forked (2021-Dec-30)

Changes (2021-Dec-10 / Minor)

• deprecation of parameter -AzureDevOpsWikiAsCode / Based on environment variables the script will detect the code run platform
• changed throttlelimit default from 5 to 10

Changes (2021-Dec-09 / Minor)

• [Run AzGovViz in GitHub Codespaces] - thanks! Carlos Mendible (Microsoft Cloud Solution Architect - Spain)
• JSON output update -> filenames will indicate if Role assignment is PIM (Priviliged Identity Management) based

Passed tests: Powershell Core 7.2.0 on Windows
Passed tests: Powershell Core 7.2.0 Azure DevOps hosted agent ubuntu-18.04
Passed tests: Powershell Core 7.2.0 GitHub Codespaces mcr.microsoft.com/powershell:latest

Release history

Features

• Hierarchy of Management Groups
  • Builds a visual hierarchy of your Management Group setup including counts on linked Subscriptions, Policy assignments, scoped Policy/Set definitions and Role assignments per Management Group
• Azure Policy
  • Custom Policy definitions
    • Scope information
    • Policy effect
    • If Policy effect is DeployIfNotExists (DINE) will show the specified RBAC Role
    • List of assignments
    • Usage in custom PolicySet definitions
    • System metadata 'createdOn, createdBy, updatedOn, updatedBy' ('createdBy', 'updatedBy' identity is fully resolved)
  • Orphaned custom Policy definitions
    • List of custom Policy definitions that matches the following criteria:
      • Policy definition is not used in any custom PolicySet definition
      • No Policy assignment exists for the Policy definition
  • Custom PolicySet definitions
    • Scope information
    • List unique assignments
    • List of Policy definitions used
  • Orphaned custom PolicySet definitions
    • Criteria: no Policy assignment exists for the PolicySet definition
  • Custom PolicySet definitions using deprecated built-in Policy definitions
  • Policy assignments of deprecated built-in Policy definition
  • Policy Exemptions
    • Lists all Exemptions (scopes: Management Groups, Subscriptions, ResourceGroups, Resources)
    • Enrich information on Exemption scope
    • Summary on expired Exemptions
  • Policy assignments throughout the entirety of scopes (Management Groups, Subscriptions and Resource Groups)
    • Core information on Policy assignments
      • NonCompliance Message on Policy assignment for a PolicySet will only show the default non-compliance message
    • Advanced/enriched information on Policy assignments
      • Policy assignment scope (at scope/inheritance)
      • Indicates if scope is excluded from Policy assignment
      • Indicates if Exemption applies for scope
      • Policy/Resource Compliance (Policy: NonCompliant, Compliant; Resource: NonCompliant, Compliant, Conflicting)
      • Related RBAC Role assignments (if Policy effect is DeployIfNotExists (DINE) or Modify)
      • Resolved Managed Identity (if Policy effect is DeployIfNotExists (DINE) or Modify)
      • System metadata 'createdOn, createdBy, updatedOn, updatedBy' ('createdBy', 'updatedBy' identity is fully resolved)
      • Parameters used
• Role-Based Access Control (RBAC)
  • Custom Role definitions
    • List assignable scopes
    • System metadata 'createdOn, createdBy, updatedOn, updatedBy' ('createdBy', 'updatedBy' identity is fully resolved)
  • Orphaned custom Role definitions
    • List of custom Role definitions that matches the following criteria:
      • Role definition is not used in any Role assignment
      • Role is not used in a Policy definition´s rule (roleDefinitionIds)
  • Orphaned Role assignments
    • List of Role assignments that matches the following criteria:
      • Role definition was deleted although and assignment existed
      • Role assignmet's target identity (User, Group, ServicePrincipal) was deleted
  • Role assignments throughout the entirety of scopes (Management Groups, Subscriptions, Resource Groups and Resources)
    • Core information on Role assignments
    • Advanced information on Role assignments
      • Role assignment scope (at scope / inheritance)
      • For Role Assignments on Groups the AAD Group members are fully resolved. With this capability AzGovViz can ultimately provide holistic insights on permissions granted
      • For Role Assignments on Groups the AAD Group members count (transitive) will be reported
      • For identity-type == 'ServicePrincipal' the type (Application (internal/external) / ManagedIdentity (System assigned/User assigned)) will be revealed
      • For identity-type == 'User' the userType (Member/Guest) will be revealed
      • Related Policy assignments (Policy assignment that leverages the DeployIfNotExists (DINE) or Modify effect)
      • System metadata 'createdOn, createdBy' ('createdBy' identity is fully resolved)
      • Determine if the Role assignment is 'standing' or PIM (Privileged Identity Management) managed
  • Security & Best practice analysis
    • Existence of custom Role definition that reflect 'Owner' permissions
    • Role assignments for 'Owner' permissions on identity-type == 'ServicePrincipal'
    • Role assignments for 'Owner' permissions on identity-type != 'Group'
    • Role assignments for 'User Access Administrator' permissions on identity-type != 'Group'
    • High priviledge Role assignments for 'Guest Users' (Owner & User Access Administrator)
• Blueprints
  • Blueprint scopes and assignments
  • Orphaned Blueprints
• Management Groups
  • Management Group count, level/depth, MG children, Sub children
  • Hierarchy Settings | Default Management Group Id
  • Hierarchy Settings | Require authorization for Management Group creation
• Subscriptions, Resources & Defender
  • Subscription insights
    • QuotaId, State, Tags, Microsoft Defender for Cloud Secure Score, Cost, Management Group path
  • Tag Name usage
    • Insights on usage of Tag Names on Subscriptions, ResourceGroups and Resources
  • Resources
    • Resource Types
      • ResourceType count per location
      • Resource Provider
        • Resource Provider state aggregation throughout all Subscriptions
        • Explicit Resource Provider state per Subscription
      • Resource Locks
        • Aggregated insights for Lock and respective Lock-type usage on Subscriptions, ResourceGroups and Resources
  • Microsoft Defender for Cloud
    • Summary of Microsoft Defender for Cloud coverage by plan (count of Subscription per plan/tier)
    • Summary of Microsoft Defender for Cloud plans coverage by Subscription (plan/tier)
• Diagnostics
  • Management Groups Diagnostic settings report
    • Management Group, Diagnostic setting name, target type (LA, SA, EH), target Id, Log Category status
  • Subscriptions Diagnostic settings report
    • Subscription, Diagnostic setting name, target type (LA, SA, EH), target Id, Log Category status
  • Resources Diagnostic capabilty report (1st party Resource types only)
    • ResourceType capability for Resource Diagnostics including
      • ResourceType count and information if capable for logs including list of available og categories
      • ResourceType count and information if capable for metrics
  • Lifecyle recommendations for existing Azure Policy definitions that configure Resource diagnostics of type=Log
    • Check if Policy definitions hold the latest set of applicable log categories
    • Recommendation to create Policy definition for ResourceType if supported
    • Lists all PolicyDefinitions that deploy Resource diagnostics of type=log, lists Policy assignments and PolicySet assignments if the Policy defintion is used in a PolicySet definition
• Limits
  • Tenant approaching ARM limits:
    • Custom Role definitions
    • PolicySet definitions
  • Management Groups approaching ARM limits:
    • Policy assignment limit
    • Policy / PolicySet definition scope limit
    • Role assignment limit
  • Subscriptions approaching ARM limits:
    • ResourceGroup limit
    • Subscription Tags limit
    • Policy assignment limit
    • Policy / PolicySet definition scope limit
    • Role assignment limit
• Azure Active Directory (AAD)
  • Insights on those Service Principals where a Role assignment exists (scopes: Management Group, Subscription, ResourceGroup, Resource):
    • Type=ManagedIdentity
      • Core information on the Service Principal such as related Ids and use case information
    • Type=Application
      • Secrets and Certificates expiry information & warning
      • Report on external Service Principals
• Consumption
  • Aggregated consumption insights throughout the entirety of scopes (Management Groups, Subscriptions)
• Change tracking
  • Policy
    • Created/Updated Policy and PolicySet definitions (system metadata 'createdOn, createdBy, updatedOn, updatedBy')
    • Created/Updated Policy assignments (system metadata 'createdOn, createdBy, updatedOn, updatedBy')
  • RBAC
    • Created/Updated Role definitions (system metadata 'createdOn, createdBy, updatedOn, updatedBy')
    • Created Role assignments (system metadata 'createdOn, createdBy)
  • Resources
    • Aggregated insights on Created/Changed Resources

Screenshots

HTML file

HierarchyMap

TenantSummary

DefinitionInsights
ScopeInsights

*IDs from screenshot are randomized

markdown in Azure DevOps Wiki as Code

*IDs from screenshot are randomized

Note: there is some fixing ongoing at the mermaid project to optimize the graphical experience:
mermaid-js/mermaid#1177

Outputs

• CSV file
• HTML file
  • the HTML file uses Java Script and CSS files which are hosted on various CDNs (Content Delivery Network). For details review the BuildHTML region in the PowerShell script file.
  • Browsers tested: Edge, new Edge and Chrome
• MD (Markdown) file
  • for use with Azure DevOps Wiki leveraging the Mermaid plugin
• JSON folder containing
  • all Policy and Role assignments (Scopes: Tenant, Management Groups and Subscriptions)
  • all BuiltIn and Custom Policy/Set definitions (Scopes: Management Groups and Subscriptions)
  • all BuiltIn and Custom Role definitions
  • JSON file of ManagementGroup Hierarchy including all Custom Policy/Set and RBAC definitions, Policy and Role assignments and some more relevant information
  • Tenant tree including all Policy and Role assignments AND all Custom Policy/Set and Role definitions
    

AzGovViz Setup Guide

💡 Although 30 minutes of troubleshooting can save you 5 minutes reading the documentation :) ..
Check the detailed Setup Guide

Technical documentation

Permissions overview

Required permissions in Azure

This permission is mandatory in each and every scenario!

Scenario	Permissions
ANY Console or AzureDevOps Pipeline	Reader Role assignment on Management Group

Required permissions in Azure Active Directory

Scenario	Permissions
A Console | Member user account	No AAD permissions required
B Console | Guest user account	If the tenant is hardened (AAD External Identities / Guest user access = most restrictive) then Guest User must be assigned the AAD Role 'Directory readers' 💡 Compare member and guest default permissions 💡 Restrict Guest permissions
C Console | Service Principal | Managed Identity	Capability API Permissions Get AAD Users Service Principal's App registration grant with Microsoft Graph permissions: Application permissions / User / User.Read.All 💡 Get user Get AAD Groups Service Principal's App registration grant with Microsoft Graph permissions: Application permissions / Group / Group.Read.All 💡 Get group Get AAD SP/App Service Principal's App registration grant with Microsoft Graph permissions: Application permissions / Application / Application.Read.All 💡 Get servicePrincipal, Get application Optional: AAD Role 'Directory readers' could be used instead of API permissions (more read than required)
D Azure DevOps Pipeline | ServicePrincipal (Service Connection)	Capability API Permissions Get AAD Users Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / User / User.Read.All 💡 Get user Get AAD Groups Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / Group / Group.Read.All 💡 Get group Get AAD SP/App Azure DevOps Service Connection's App registration grant with Microsoft Graph permissions: Application permissions / Application / Application.Read.All 💡 Get servicePrincipal, Get application Optional: AAD Role 'Directory readers' could be used instead of API permissions (more read than required)

Screenshot Azure Portal

PowerShell

• Requires PowerShell 7 (minimum supported version 7.0.3)
  • Get PowerShell
  • Installing PowerShell on Windows
  • Installing PowerShell on Linux
• Requires PowerShell Az Modules
  • Az.Accounts
  • Install the Azure Az PowerShell module
• Usage/command
  • .\AzGovVizParallel.ps1 -ManagementGroupId <your-Management-Group-Id>

Parameters

• -ManagementGroupId Management Group Id (Root Management Group Id equals your Tenant Id)
• -CsvDelimiter - The world is split into two kinds of delimiters - comma and semicolon - choose yours (default is semicolon ';')
• -OutputPath - Defaults to subdirectories by date in the "pwsh/output" directory.
• -DoNotShowRoleAssignmentsUserData - Scrub personally identifiable information (PII)
• -LimitCriticalPercentage - Limit warning level, default is 80%
• -HierarchyMapOnly - Output only the HierarchyMap for Management Groups including linked Subscriptions
• -SubscriptionQuotaIdWhitelist - Process only Subscriptions with defined QuotaId(s). Example: .\AzGovVizParallel.ps1 -SubscriptionQuotaIdWhitelist MSDN_,Enterprise_
• -NoResourceProvidersDetailed - Disables output for ResourceProvider states for all Subscriptions in the TenantSummary section, in large Tenants this can become time consuming
• -NoMDfCSecureScore - Disables Microsoft Defender for Cloud Secure Score request for Subscriptions and Management Groups.
• -NoPolicyComplianceStates - Will not query policy compliance states. You may want to use this parameter to accellerate script execution or when receiving error 'ResponseTooLarge'.
• -NoResourceDiagnosticsPolicyLifecycle - Disables Resource Diagnostics Policy Lifecycle recommendations
• -NoAADGroupsResolveMembers - Disables resolving Azure Active Directory Group memberships
• -AADServicePrincipalExpiryWarningDays - Define warning period for Service Principal secret and certificate expiry; default is 14 days
• -NoAzureConsumption - Azure Consumption data should not be collected/reported. By default Azure Consumption data should be collected/reported.
• -AzureConsumptionPeriod - Define for which time period Azure Consumption data should be gathered; default is 1 day
• -NoAzureConsumptionReportExportToCSV - Azure Consumption data should not be exported (CSV)
• -NoScopeInsights - Q: Why would you want to do this? A: In larger tenants the ScopeInsights section blows up the html file (up to unusable due to html file size). Use -LargeTenant to further reduce the output.
• -ThrottleLimit - leveraging PowerShell´s parallel capability you can define the ThrottleLimit (default=5)
• -DoTranscript - Log the console output
• -SubscriptionId4AzContext - Define the Subscription Id to use for AzContext (default is to use a random Subscription Id)
• -PolicyAtScopeOnly - Removing 'inherited' lines in the HTML file for 'Policy Assignments'; use this parameter if you run against a larger tenants. Note using parameter -LargeTenant will set -PolicyAtScopeOnly $true
• -RBACAtScopeOnly - Removing 'inherited' lines in the HTML file for 'Role Assignments'; use this parameter if you run against a larger tenants. Note using parameter -LargeTenant will set -RBACAtScopeOnly $true
• -NoCsvExport - Do not export enriched data for 'Role assignments', 'Policy assignments' data and 'all resources' (subscriptionId, managementGroup path, resourceType, id, name, location, tags, createdTime, changedTime)
• -DoNotIncludeResourceGroupsOnPolicy - Do not include Policy assignments on ResourceGroups
• -DoNotIncludeResourceGroupsAndResourcesOnRBAC - Do not include Role assignments on ResourceGroups and Resources
• -ChangeTrackingDays - Define the period for Change tracking on newly created and updated custom Policy, PolicySet and RBAC Role definitions and Policy/RBAC Role assignments (default is '14')
• -FileTimeStampFormat- Define the time format for the output files (default is yyyyMMdd_HHmmss)
• -NoJsonExport - Do not enable export of ManagementGroup Hierarchy including all MG/Sub Policy/RBAC definitions, Policy/RBAC assignments and some more relevant information to JSON
• -JsonExportExcludeResourceGroups - JSON Export will not include ResourceGroups (Policy & Role assignments)
• -JsonExportExcludeResources- JSON Export will not include Resources (Role assignments)
• -LargeTenant - A large tenant is a tenant with more than ~500 Subscriptions - the HTML output for large tenants simply becomes too big. Using this parameter the following parameters will be set: -PolicyAtScopeOnly $true, -RBACAtScopeOnly $true, -NoResourceProvidersDetailed $true, -NoScopeInsights $true
• -HtmlTableRowsLimit - Although the parameter -LargeTenant was introduced recently, still the html output may become too large to be processed properly. The new parameter defines the limit of rows - if for the html processing part the limit is reached then the html table will not be created (csv and json output will still be created). Default rows limit is 20.000
• -AADGroupMembersLimit - Defines the limit (default=500) of AAD Group members; For AAD Groups that have more members than the defined limit Group members will not be resolved
• -NoResources - Will speed up the processing time but information like Resource diagnostics capability and resource type statistic (featured for large tenants)
• -StatsOptOut - Opt out sending stats DEPRECATED in forked version 2021-Dec-31 which made "no statistics collection" the default, and REALLY no statistics collection.
• -NoSingleSubscriptionOutput - Single Scope Insights output per Subscription should not be created

Integrate with AzOps

Did you know you can run AzOps from Azure DevOps? Check AzOps Accellerator.
You can integrate AzGovViz (same project as AzOps).

  pipelines:
    - pipeline: 'Push'
      source: 'AzOps - Push'
      trigger:
        branches:
          include:
            - master

Stats

Statistics collection disabled by default and code that collected statistics on whether statistics could be collected is no longer run when statistics are specifically set to disabled. (Fork update 2021-Dec-31)

~~If you do not want to contribute to stats for AzGovViz then you can use the parameter:
-StatsOptOut ~~ This parameter was not completely honored by the original version of this script.

Security

AzGovViz creates very detailed information about your Azure Governance setup. In your organization's best interest the outputs should be protected from not authorized access!

Known issues

Working with Git and Windows cloning from your AzDO repository you may experience the following error:

fatal: cannot create directory at 'output/JSON_...': Filename too long

To work around that issue you may want to enable longpaths support.
Note the caveats!

git config --system core.longpaths true

Facts

Disabled Subscriptions and Subscriptions where Quota Id starts with with "AAD_" are being skipped, all others are queried. More information on Subscription Quota Id / Offer numbers: Supported Microsoft Azure offers.

ARM Limits are not acquired programmatically, these are hardcoded. The links used to check related limits are commented in the param section of the script.

AzAdvertizer

Many links loading graphics and pages from www.azadvertizer.net were removed in the update after this version was forked. These links loaded pages for specific Azure Policies (possibly leaking usage) and providing a log of systems where the script was being run to the azadvertizer.net website.

Final Note

AzGovViz, including this fork, is a community driven project, with no implicit or explicit obligations or guarantees of fitness for a particular purpose. It is provided 'as is' with no warranties and confers no rights.