AzureScout

3.3.0

AzureScout — discover, inventory, and assess everything in your Azure environment from one command. Run Invoke-AzureScout with no parameters for a guided wizard, or drive it with switches: by default it inventories Azure resources, Entra ID, and identity objects (Excel, JSON, Markdown, AsciiDoc); add -Assessment and it runs a read-only CAF/WAF landing-zone assessment, scoring the tenant against Cloud Adoption Framework design areas and Well-Architected pillars and producing Power BI, self-contained HTML, executive PowerPoint, and JSON/Excel evidence. See everything. Own your cloud. (Requires PowerShell 7 on PowerShell Core.)

Minimum PowerShell version

7.0

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name AzureScout -RequiredVersion 3.3.0

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name AzureScout -Version 3.3.0

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

countrycloudboy

Copyright

Package Details

Author(s)

Kristopher Turner

Functions

Start-AZSCAdvisoryJob Start-AZSCPolicyJob Start-AZSCSecCenterJob Start-AZSCSubscriptionJob Wait-AZSCJob Build-AZSCDiagramSubnet Set-AZSCDiagramFile Start-AZSCDiagramJob Start-AZSCDiagramNetwork Start-AZSCDiagramOrganization Start-AZSCDiagramSubscription Start-AZSCDrawIODiagram Invoke-AzureScout Test-AZSCPermissions Start-AZSCWizard Test-ScoutPermission Invoke-ScoutPipeline Get-ScoutInventoryDrift Get-ScoutCostAnomaly Get-ScoutIacGap Import-ScoutConfig Export-ScoutConfig

PSEditions

Core

Dependencies

This module has no dependencies.

Release Notes

v3.3.0 - Epic AB#6450: the reports become deliverables. Every report Scout produced was unfit to put in front of an executive, and 103 report work items on this board were already Closed - every one accepted on the existence of a file, none carrying an acceptance criterion naming a required section or a reader. This release fixes the output and the reason it stayed broken. docs/design/report-conformance.md is now normative with 40 numbered clauses, and tests/Report.Conformance.Tests.ps1 asserts every automatic clause against an emitted package read back off disk, so a renderer item can no longer close on the existence of a file. Word: the generated .docx contained three package parts and 0 of 1,803 paragraphs carried a style, which explains the missing navigation pane, the impossible table of contents, the absent cross-references and the un-rebrandable output all at once. It now carries real styles, chapter numbering, a theme, a header and footer with PAGE and NUMPAGES as real fields, a TOC field, a cover naming client and scan date and classification, a Document Information block stating provenance, chapters shaped scorecard then current state then findings then action items, and long tables deferred to an appendix. Figures are rasterised to PNG in managed code and embedded as image parts - the diagram pipeline previously emitted draw.io XML only, so no document could embed a figure at all; AzViz, Graphviz, D2, a headless browser and ImageMagick were each rejected because a report that silently loses its figures when a native binary is missing is worse than one that never promised them. Power BI output is now a PBIP project with a TMDL semantic model, four real relationships, eleven DAX measures, a date dimension and authored report pages, replacing four flat CSVs and a template whose authored layout was 2,190 bytes. The deck states what was not assessed and carries exactly one act-on-this-first slide naming a specific item, bounded at fifteen slides. The workbook gains a cover with per-tab record counts, the full ARM resource id on every evidence row, and a triage verdict seeded for review rather than guessed. Not assessed is honoured throughout: excluded from the compliance denominator, given its own scorecard column and figure segment, never rendered as a zero or a pass. Two defects that only a real multi-tenant run could surface are fixed: Export-Excel shared a name with the cmdlet exported by ImportExcel - which that renderer imports - so ImportExcel shadowed it and every per-assessment workbook silently failed, and Get-ScoutExcelProp threw on evidence rows that are not property bags. Both were live while the unit suite was green. KNOWN LIMITATION: the Power BI report pages render as placeholders - the model loads and the pages exist, but the visuals do not yet bind to it, so clause B-05 is not met and is not claimed. See CHANGELOG.md for the full history. v3.2.0 - Deep governance and compliance analytics (Epic AB#6454). Scout goes from one real assessment to roughly twenty-eight, and from one enumerated source framework to all fourteen. Added five WAF pillar assessments, eight CAF landing-zone design-area assessments, the WAF Maturity Model, the Microsoft Cloud Security Benchmark plus one assessment per regulatory initiative assigned in the scanned scope, Cloud Governance across CAF Govern''s seven risk categories with a 1-10 domain maturity report, and workload reviews for AI, Azure Virtual Desktop, Azure VMware Solution, AVS Landing Zone, CASA and Azure Local, plus the FinOps Review and DevOps Capability Assessment. Compliance is scored from policy state Scout already collected and no rule read, at no additional Azure call. Three-state reporting: NotAssessed is a first-class status excluded from every score denominator by construction, so a control nobody chose to evaluate never reads as a pass or a fail, and a rule whose data source was blocked reports Not assessed rather than a zero - a denied billing API no longer renders as zero spend. Two false-pass rules removed, and waf.storage.yaml retired for scoring a WAF pillar that WAF does not define; a gate now fails any rule file claiming a pillar, design area or framework axis that does not exist. Every rule file must record the framework version it was verified against or the engine refuses to load it, so no coverage figure can ship without naming its source version. Hybrid/ArcSites and Hybrid/VirtualMachines re-sourced off Resource Graph, which indexes neither type - verified live against real estates returning rows where Resource Graph returns none. Orphaned role assignments are resolved locally against already-collected Entra principals, keeping Graph-denied distinct from principal-deleted. v3.1.0 - Service coverage across all eighteen of Microsoft''s published service categories (Epic AB#6741). Scout modelled fifteen; Migration, General and DevOps now exist as first-class categories, Migration going from zero collectors to all five of its services. 62 collectors added across Migration, General, DevOps, Integration, Web, Storage, IoT and Security, taking measured service coverage from 41% to 66% of the 349 services the audit enumerates. Logic Apps were excluded from the Resource Graph query outright in every prior release and are now collected. Child resources are collected for the first time - Key Vault secret and key expiry, blob containers with their public-access level, file shares, lifecycle policies and Backup vault instances - all on the control plane, all within Reader, no secret value or blob content ever read. The rule engine can now express a condition spanning two collected datasets, declared as rule data, so "which VMs have no backup" is answerable; six cross-resource rules ship. The SMART migration-readiness assessment ships with its source framework enumerated and date-stamped. Also fixed: a golden collector suite that failed on any day but the one it was recorded on, and a guided wizard that resolved its assessment manifest outside the repository and so never listed more than one assessment.

FileList

Version History

Version	Downloads	Last updated
3.3.1	4	8/3/2026
3.3.0 (current version)	4	8/3/2026
3.1.0	8	7/31/2026
3.0.9	7	7/31/2026
3.0.8	4	7/30/2026
3.0.7	3	7/30/2026
3.0.6	7	7/30/2026
3.0.5	7	7/29/2026
3.0.4	4	7/29/2026
3.0.3	3	7/29/2026
3.0.2	5	7/29/2026
3.0.1	4	7/29/2026
3.0.0	7	7/28/2026
2.11.0	9	7/26/2026
2.10.0	5	7/26/2026
2.9.0	6	7/26/2026
2.8.0	5	7/26/2026
2.7.0	5	7/26/2026
2.6.0	5	7/26/2026
2.5.3	4	7/25/2026
2.5.2	6	7/25/2026
2.5.1	4	7/25/2026
2.5.0	5	7/25/2026
2.4.0	4	7/25/2026
2.3.0	6	7/25/2026
2.2.0	4	7/24/2026
2.1.0	5	7/24/2026
2.0.1	6	7/23/2026
2.0.0	4	7/23/2026
1.0.0	48	2/25/2026