AzureScout

2.4.0

AzureScout — discover, inventory, and assess everything in your Azure environment from one command. Run Invoke-AzureScout with no parameters for a guided wizard, or drive it with switches: by default it inventories Azure resources, Entra ID, and identity objects (Excel, JSON, Markdown, AsciiDoc); add -Assessment and it runs a read-only CAF/WAF landing-zone assessment,
AzureScout — discover, inventory, and assess everything in your Azure environment from one command. Run Invoke-AzureScout with no parameters for a guided wizard, or drive it with switches: by default it inventories Azure resources, Entra ID, and identity objects (Excel, JSON, Markdown, AsciiDoc); add -Assessment and it runs a read-only CAF/WAF landing-zone assessment, scoring the tenant against Cloud Adoption Framework design areas and Well-Architected pillars and producing Power BI, self-contained HTML, executive PowerPoint, and JSON/Excel evidence. See everything. Own your cloud. (Requires PowerShell 7 on PowerShell Core.)
Show more

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name AzureScout -RequiredVersion 2.4.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name AzureScout -Version 2.4.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Hybrid Cloud Solutions. All rights reserved.

Package Details

Author(s)

  • Kristopher Turner

Tags

Azure AzureScout Discovery Inventory Assessment CAF WAF WellArchitected CloudAdoptionFramework LandingZone Governance AZSC EntraID Resources ARM Graph Reporting Excel PowerBI

Functions

Start-AZSCAdvisoryJob Start-AZSCPolicyJob Start-AZSCSecCenterJob Start-AZSCSubscriptionJob Wait-AZSCJob Build-AZSCDiagramSubnet Set-AZSCDiagramFile Start-AZSCDiagramJob Start-AZSCDiagramNetwork Start-AZSCDiagramOrganization Start-AZSCDiagramSubscription Start-AZSCDrawIODiagram Invoke-AzureScout Test-AZSCPermissions Start-AZSCWizard Invoke-ScoutAssessment Test-ScoutPermission Invoke-ScoutPipeline Get-ScoutInventoryDrift Get-ScoutCostAnomaly Get-ScoutIacGap Import-ScoutConfig Export-ScoutConfig

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

v2.4.0 -- One command, and a guided wizard. Inventory and assessment are now modes of a single Invoke-AzureScout rather than two separate cmdlets: Invoke-AzureScout -Assessment LandingZone runs the CAF/WAF assessment, and without -Assessment the command behaves exactly as before. -CollectOnly and -FromCollect moved onto Invoke-AzureScout too, and assessment mode now honours the inventory sign-in parameters (-TenantID, -DeviceLogin, -AppId/-Secret, certificate auth), which the standalone cmdlet never did -- it silently required a pre-existing Connect-AzAccount context. -OutputFormat widens from [string] to [string[]] so one run can request several renderers (-OutputFormat Html,Pptx); its ValidateSet grows from 8 to 15 values to span both modes, and asking for a format from the wrong mode now throws an error naming the switch you actually wanted instead of silently producing nothing. DEPRECATED: Invoke-ScoutAssessment still works and is still exported, but will be removed in v3.0.0 -- every parameter maps across unchanged except -OutputPath, which is -ReportDir on Invoke-AzureScout. NEW: running Invoke-AzureScout with no parameters in an interactive session opens a guided wizard -- it confirms or establishes the Azure sign-in, lets you pick the tenant when the account can see more than one, verifies the account holds the rights the run needs, then presents checklists for the run type, the resource categories or assessments, the report formats, and the report directory, with everything pre-selected so you uncheck what you do not want. The final step prints the equivalent one-line command. The wizard never fires in a non-interactive host -- CI runners, scheduled tasks, containers, and any session with redirected stdin fall straight through to the previous default full ARM inventory, so an existing bare Invoke-AzureScout in a pipeline cannot block on a prompt; -NoWizard forces that path at a terminal. Start-AZSCWizard is exported for on-demand use. FIXED: the documentation stated a PowerShell floor the module never had -- several pages claimed the inventory cmdlet ran on PowerShell 5.1+ and that only the assessment platform needed 7.0, when the manifest has always declared PowerShellVersion 7.0 with CompatiblePSEditions Core. KNOWN LIMITATION: inventory and assessment still collect their Azure data independently, so running both queries Azure twice. Full suite 1671 passed, 0 failed, 3 skipped. v2.3.0 — Collection hardening and external platform integrations. Run isolation (AB#331): every invocation gets its own run folder, so a rescan — or a scan of a second tenant — can no longer destroy the previous run's ReportCache, DiagramCache, or report. -RunName names the folder, -Force restores the old overwrite-in-place behaviour, and Clear-AZSCCacheFolder -OlderThan <days> prunes aged runs. Cross-subscription context restore (AB#368): all five Set-AzContext loops now capture the caller's context up front and restore it in a finally block, on both the normal and the error path. Post-login management group probe (AB#351): the visible count is reported at login, and an authorization failure names the exact role to assign instead of surfacing an hour later as a silently empty worksheet; the probe never aborts the run. Azure DevOps inventory (AB#327): -IncludeDevOps adds projects, pipelines, service connections, repositories, and agent pools across one or more organizations, in five new worksheets. Authentication reuses the current Azure sign-in by requesting an Entra token for the Azure DevOps resource, so no PAT is needed in the common case; -DevOpsPat covers a separate identity. The ADO Service Connections sheet cross-references every Azure Resource Manager connection against the subscriptions in scope, and flags connections still authenticating with a secret rather than workload identity federation. Every call is a GET — Azure Scout stays read-only. GitHub Action (AB#328): a composite action.yml ships at the repository root, so a workflow can generate an inventory with uses: thisismydemo/azure-scout@v2. Azure Automation Account (AB#343): the eight-step unattended setup guide that previously did not exist, plus two runbook fixes — blob uploads now pass -Force, without which the second scheduled run failed with "blob already exists", and the diagnostic log upload now tests $DebugPreference rather than $Debug.IsPresent, which is always null because -Debug is a common parameter. New documentation: Category Reference (every report section heading mapped to its category, aliases, collector folder, and module count), Validation Matrix (per-check automated vs live-tenant coverage for phases 5-21), Automation, GitHub Actions, and Azure DevOps. Full suite 1648 passed, 0 failed, 3 skipped. v2.2.0 — Report tiers, deeper analytics, hardened collectors. New report tiers: Word (.docx, Export-Word), an offline ECharts HTML dashboard (Export-EChartsDashboard), a dependency-free PDF (Export-Pdf), and a resources-only JSON evidence export (Export-JsonEvidence) -- all wired into Export-Report and Invoke-ScoutAssessment -OutputFormat. Excel gains visual dashboard tabs with pivot charts; the React report gains richer interactive visuals (topology, management-group hierarchy, KPI cards, a Governance section, drill-downs, search/filter, badges, tooltips) plus report.pbit generation. New offline analysis functions: Get-ScoutInventoryDrift (cross-run resource drift), Get-ScoutCostAnomaly (cost outlier detection), and Get-ScoutIacGap (Bicep/ARM-JSON coverage gaps) -- none of these call Azure. Collect layer gains IoT deep coverage (Device Provisioning Service + Digital Twins), tag-value aggregation, deeper Database/Analytics/IoT rule automation, and collector/pipeline resilience (per-subscription continue-on-error, management-group hints, an empty-data guard, and a HadErrors summary flag) plus live Write-ScoutProgress output. New Import-ScoutConfig/Export-ScoutConfig let you save and reload an assessment config (benchmark, rule patterns, rule overrides) as JSON, with a safe fallback to the built-in default. Also: a CI pipeline (ci.yml), a real (non-simulated) azure-inventory workflow, five v1 inventory bug fixes, draw.io merge/StrictMode repairs, and documented Entra Graph delegated scopes. v2.1.0 — Platform hardening. Native governance collector (Import-Governance) replaces the Azure Governance Visualizer dependency: management-group, policy-assignment, role-assignment, budget, and resource-lock data now come from Azure Resource Graph + ARM REST directly, so the ALZ benchmark needs only ARM Reader at the management-group root (no Microsoft Graph app permissions by default). New unattended one-command pipeline (Invoke-ScoutPipeline) for CI/cron with a machine-readable run summary and exit codes. New self-contained interactive React HTML report (-OutputFormat React) plus cross-run drift tracking (New/Resolved/Regressed deltas across runs). v2.0.1 — Point the Project Site link at the documentation site (thisismydemo.cloud/azure-scout). v2.0.0 — CAF/WAF Assessment Platform (major). Adds a read-only, three-layer assessment engine (collect.json -> findings.json -> report) on top of the v1 inventory tool: a declarative CAF/WAF rule engine (139 rules across 8 CAF design areas + 5 WAF pillars, dual scoring, prioritized gaps), an Azure Resource Graph collect layer, AzGovViz/Advisor/ARG ingest, an ALZ benchmark diff, and tiered reporting (Power BI, self-contained HTML, executive PowerPoint via the OpenXML SDK, plus Excel + JSON evidence). Per-domain analytics: every discovery category is an independently runnable, tagged assessment via Invoke-ScoutAssessment -Assessment <Category>. Runtime-verified offline (Pester) and against a live tenant. BREAKING: introduces the findings.json output contract and demotes Excel-first output to an evidence tier. Assessment features require PowerShell 7. Full inventory functionality from v1.0.0 is unchanged. See CHANGELOG.md for details.

FileList

Version History

Version Downloads Last updated
2.11.0 8 7/26/2026
2.10.0 5 7/26/2026
2.9.0 6 7/26/2026
2.8.0 5 7/26/2026
2.7.0 5 7/26/2026
2.6.0 5 7/26/2026
2.5.3 4 7/25/2026
2.5.2 6 7/25/2026
2.5.1 4 7/25/2026
2.5.0 5 7/25/2026
2.4.0 (current version) 4 7/25/2026
2.3.0 6 7/25/2026
2.2.0 4 7/24/2026
2.1.0 5 7/24/2026
2.0.1 5 7/23/2026
2.0.0 3 7/23/2026
1.0.0 48 2/25/2026
Show less