AzureScout

2.5.2

AzureScout — discover, inventory, and assess everything in your Azure environment from one command. Run Invoke-AzureScout with no parameters for a guided wizard, or drive it with switches: by default it inventories Azure resources, Entra ID, and identity objects (Excel, JSON, Markdown, AsciiDoc); add -Assessment and it runs a read-only CAF/WAF landing-zone assessment,
AzureScout — discover, inventory, and assess everything in your Azure environment from one command. Run Invoke-AzureScout with no parameters for a guided wizard, or drive it with switches: by default it inventories Azure resources, Entra ID, and identity objects (Excel, JSON, Markdown, AsciiDoc); add -Assessment and it runs a read-only CAF/WAF landing-zone assessment, scoring the tenant against Cloud Adoption Framework design areas and Well-Architected pillars and producing Power BI, self-contained HTML, executive PowerPoint, and JSON/Excel evidence. See everything. Own your cloud. (Requires PowerShell 7 on PowerShell Core.)
Show more

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name AzureScout -RequiredVersion 2.5.2

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name AzureScout -Version 2.5.2

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 Hybrid Cloud Solutions. All rights reserved.

Package Details

Author(s)

  • Kristopher Turner

Tags

Azure AzureScout Discovery Inventory Assessment CAF WAF WellArchitected CloudAdoptionFramework LandingZone Governance AZSC EntraID Resources ARM Graph Reporting Excel PowerBI

Functions

Start-AZSCAdvisoryJob Start-AZSCPolicyJob Start-AZSCSecCenterJob Start-AZSCSubscriptionJob Wait-AZSCJob Build-AZSCDiagramSubnet Set-AZSCDiagramFile Start-AZSCDiagramJob Start-AZSCDiagramNetwork Start-AZSCDiagramOrganization Start-AZSCDiagramSubscription Start-AZSCDrawIODiagram Invoke-AzureScout Test-AZSCPermissions Start-AZSCWizard Invoke-ScoutAssessment Test-ScoutPermission Invoke-ScoutPipeline Get-ScoutInventoryDrift Get-ScoutCostAnomaly Get-ScoutIacGap Import-ScoutConfig Export-ScoutConfig

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

v2.5.2 -- A whole report category could silently vanish from a run (AB#5629). Inventory output was non-deterministic: ReportCache/Compute.json came back 5,158 bytes on one run and 470 on the next, same tenant and scope, with every Compute module reporting zero rows while the hashtable keys were still present. The cause was a race, not throttling: Wait-AZSCJob looped only while a job was Running, but Start-Job is asynchronous and a job created moments earlier sits in NotStarted, a state that satisfied neither the wait loop nor the caller job-selection filter, so it was never waited on and Build-AZSCCacheFiles then ran Receive-Job followed by Remove-Job, destroying it before it produced anything. Both now treat every non-terminal state as pending. The inner wait While ($Job.Runspace.IsCompleted -contains $false) was additionally a no-op because those handles are PowerShellAsyncResult and have no Runspace property; it now reads $Job.IsCompleted. Build-AZSCCacheFiles now warns when a job is harvested in a non-Completed state or a category returns no data, naming the category, instead of reporting an empty estate in silence. Also, Build-AZSCExcelComObject surfaced a raw 0x80040154 REGDB_E_CLASSNOTREG through Write-Error on every machine without Excel installed; the report is already complete and saved at that point, so the missing ProgID is now detected up front and explained in one line. Verified by three consecutive live runs against the same tenant, byte-identical: 227 Azure resources, 994 Excel rows, 40 Power BI files / 1013 rows, 166 Azure DevOps resources, 0 empty-category warnings and 0 raw COM errors. Full suite 1697 passed, 0 failed, 3 skipped. v2.5.1 -- Seven fixes that let a full inventory run complete against a real tenant. Every one was found by running the product end to end against live Azure; the 1692-test suite passed throughout because nothing drove the extraction, processing and reporting chain against real collector output. Extraction: $MGContainerExtension was consumed unconditionally by the resourcecontainers query but only assigned in the -ManagementGroup branch, so a run without that switch died on an unset variable (AB#5547). Processing: 41 .IsPresent reads on parameters not declared [switch] -- $null when the caller omits them -- replaced with a null-safe [bool] coercion (AB#5547). Reporting (AB#5567): ImportExcel throws on a -Style range or -TableName over a worksheet with zero data rows, so both are now supplied only when there is at least one row; the cost and update-manager worksheets read $vm.Name/$vm.Size/OS SKU against a collector that emits VM Name/VM Size/OS Version, so those sheets had never carried VM rows; 29 worksheet dereferences threw whenever the estate produced no such sheet (no public IPs, no disks, no VMs) and now resolve through a Worksheets lookup; 10 pivot titles were read before assignment; and the Markdown export died on a trailing italic underscore parsed as part of the identifier. Verified live: 227 Azure resources, 994 Excel rows, 40 Power BI CSVs, plus JSON, Markdown and the draw.io diagram, with Azure DevOps extraction returning 166 resources across 74 projects -- the first live-tenant verification of the -IncludeDevOps collectors. Known limitation: Build-AZSCExcelComObject emits a non-fatal error when Excel is not installed; the run completes regardless. Full suite 1692 passed, 0 failed, 3 skipped. v2.5.0 -- One collection pass. A combined inventory + assessment run now queries Azure once instead of twice (AB#5543). The inventory pass already projects the full properties bag from resources, networkresources and resourcecontainers, a superset of what the assessment typed queries were re-fetching, so the assessment shapes its scalars from those in-memory rows via ConvertFrom-ScoutInventory instead of issuing its own Resource Graph pack. Exactly one query still reaches Resource Graph in a combined run: sqlDefenderPricing reads the SecurityResources table, which inventory only touches under -SecurityCenter. The assessment-only path is unchanged and the KQL remains the reference implementation. v2.4.0 -- One command, and a guided wizard. Inventory and assessment are modes of a single Invoke-AzureScout rather than two cmdlets: Invoke-AzureScout -Assessment runs the CAF/WAF assessment, and without -Assessment the command behaves as before. -CollectOnly and -FromCollect moved onto Invoke-AzureScout, and assessment mode now honours the inventory sign-in parameters. -OutputFormat widened to [string[]] so one run can request several renderers. DEPRECATED: Invoke-ScoutAssessment still works but will be removed in v3.0.0. NEW: running Invoke-AzureScout with no parameters in an interactive session opens a guided wizard; it never fires in a non-interactive host, and -NoWizard forces that path. Full history for every earlier release is in CHANGELOG.md: https://github.com/thisismydemo/azure-scout/blob/main/CHANGELOG.md

FileList

Version History

Version Downloads Last updated
2.11.0 8 7/26/2026
2.10.0 5 7/26/2026
2.9.0 6 7/26/2026
2.8.0 5 7/26/2026
2.7.0 5 7/26/2026
2.6.0 5 7/26/2026
2.5.3 4 7/25/2026
2.5.2 (current version) 6 7/25/2026
2.5.1 4 7/25/2026
2.5.0 5 7/25/2026
2.4.0 4 7/25/2026
2.3.0 6 7/25/2026
2.2.0 4 7/24/2026
2.1.0 5 7/24/2026
2.0.1 5 7/23/2026
2.0.0 3 7/23/2026
1.0.0 48 2/25/2026
Show less