en-US/about_AzureUtils.help.txt
|
TOPIC about_AzureUtils SHORT DESCRIPTION Practical utility cmdlets for Azure administration, governance, inventory, security posture and operational automation. AzureUtils complements (does not replace) the Az modules with simple, automation-ready commands. LONG DESCRIPTION AzureUtils is a PowerShell 7+ module (CompatiblePSEditions = Core). It is installed from the PowerShell Gallery and pulls in its required modules automatically: Install-Module AzureUtils -Scope CurrentUser Requirements (declared as RequiredModules, so they are installed for you): Az.Accounts resolves the Azure context (Connect-AzAccount) and powers the Microsoft Graph / ARM REST calls Az.ResourceGraph powers the inventory and Find-* queries (multi-scope, paginated) Az.Resources applies tags back to resources (Update-AzTag) ImportExcel reads/writes the .xlsx workbook Most Find-*/Get-*/Test-* commands return objects (also shown as a colored console table); the tag-inventory export writes an Excel workbook and a console report; the Set-* commands change Azure and support -WhatIf / -Confirm. All commands emit messages in en-US. SCOPE Every Find-*/Get-*/Test-* command (and the tag-inventory export) takes -SubscriptionId (default: all enabled subscriptions in the context) or -ManagementGroupId; the two are mutually exclusive. PERMISSIONS Connect with Connect-AzAccount first. Reader on the target scope is enough for the read commands. Find-AzureUtilsStaleRoleAssignment additionally resolves principals against Microsoft Graph (via Invoke-AzRestMethod) and needs a directory-read permission (e.g. Directory.Read.All); the Set-* commands need permission to write tags. CMDLETS TAG INVENTORY AND GOVERNANCE Export-AzureUtilsTagInventory Reads every resource in scope via Azure Resource Graph and exports a tag inventory to Excel: fixed identity columns (resourceId, Resource Name, Sub Name, Resource Group Name, Resource Type, Region) plus one TAG_<name> column per tag. -FilterTags limits the columns; -IncludeSubscription / -IncludeResourceGroup add the containers themselves; -IncludeTagUnsupported keeps types that don't support tags; -OutputPath, -TableStyle and -Quiet tune output. Set-AzureUtilsTagInventory Reads an inventory .xlsx and merges the TAG_<name> values back onto each resource (Update-AzTag -Operation Merge): tags absent from the file are kept, empty cells are ignored, a new TAG_<name> column creates the tag. Supports -WhatIf / -Confirm. Set-AzureUtilsTagFromResourceGroup Inherits each resource group's tags down onto the resources inside it (Update-AzTag -Operation Merge). Adds missing keys by default; -Overwrite also replaces differing values; -Tag limits the keys. Supports -WhatIf / -Confirm. Test-AzureUtilsTagCompliance Lists resources missing one or more required tag keys (-RequiredTag), with a MissingTags list and a Reason. THE TAG ROUND TRIP Export-AzureUtilsTagInventory -> edit the workbook (change tag values, add TAG_<new> columns) -> Set-AzureUtilsTagInventory to apply. INVENTORY AND COST HYGIENE Get-AzureUtilsResourceInventory The object-emitting sibling of Export-AzureUtilsTagInventory: same backend and scope filters (-ResourceGroupName, -NameContains, -ResourceType, -First) but streams normalized objects to the pipeline instead of a file. Find-AzureUtilsOrphanResource Finds orphaned resources (unattached disks, NICs without a VM/private endpoint, public IPs without an IP config/NAT gateway, NSGs / route tables with no associations). -Type narrows the categories. Find-AzureUtilsEmptyResourceGroup Lists resource groups that contain no resources. Find-AzureUtilsIdleResource Finds resources that are allocated but idle: VMs stopped or deallocated, fixed-tier App Service Plans with no apps, stopped AKS clusters. -Type narrows the categories. Find-AzureUtilsDuplicateResource Finds resources sharing the same name and type (likely accidental duplicates), with the group size in a Count column. SECURITY AND COMPLIANCE Find-AzureUtilsPublicResource Surfaces resources exposed to the public internet (associated public IPs, publicNetworkAccess = Enabled, open/anonymous storage, NSG inbound rules from the Internet), explained in an Exposure column. -Type narrows the categories. Find-AzureUtilsInsecureConfig Surfaces configuration-hardening gaps (storage allowing non-HTTPS, weak minimum TLS, web apps not enforcing HTTPS-only, key vaults without purge protection), explained in a Finding column. -Type narrows the checks. Find-AzureUtilsPolicyNonCompliant Lists resources whose Azure Policy compliance state is NonCompliant, naming the offending assignment and definition. Find-AzureUtilsStaleRoleAssignment Finds RBAC role assignments whose principal no longer exists in Entra ID (orphaned / "Identity not found"), by resolving each principal against Microsoft Graph. Requires a directory-read permission. EXAMPLES # Export every enabled subscription in the current context Export-AzureUtilsTagInventory -OutputPath '.\inventory.xlsx' # Preview, then apply tag edits back to Azure Set-AzureUtilsTagInventory -InputPath '.\inventory.xlsx' -WhatIf Set-AzureUtilsTagInventory '.\inventory.xlsx' # Inherit resource-group tags onto their resources (preview first) Set-AzureUtilsTagFromResourceGroup -WhatIf Set-AzureUtilsTagFromResourceGroup -Tag costCenter, environment # Governance / cost / security sweeps (objects for the pipeline) Test-AzureUtilsTagCompliance -RequiredTag costCenter, environment Find-AzureUtilsIdleResource Find-AzureUtilsInsecureConfig -ManagementGroupId 'PLAT' Find-AzureUtilsPolicyNonCompliant | Group-Object PolicyAssignment Find-AzureUtilsStaleRoleAssignment | Export-Csv .\stale-rbac.csv -NoTypeInformation # Ad-hoc inventory Get-AzureUtilsResourceInventory -ResourceType 'microsoft.compute/virtualmachines' NOTE Connect with Connect-AzAccount before running any command. Get a command's full help with: Get-Help Find-AzureUtilsIdleResource -Full SEE ALSO Export-AzureUtilsTagInventory Set-AzureUtilsTagInventory Set-AzureUtilsTagFromResourceGroup Test-AzureUtilsTagCompliance Get-AzureUtilsResourceInventory Find-AzureUtilsOrphanResource Find-AzureUtilsEmptyResourceGroup Find-AzureUtilsIdleResource Find-AzureUtilsDuplicateResource Find-AzureUtilsPublicResource Find-AzureUtilsInsecureConfig Find-AzureUtilsPolicyNonCompliant Find-AzureUtilsStaleRoleAssignment https://github.com/hendersonandrade/powershell-module-azureUtils Connect-AzAccount Update-AzTag KEYWORDS Azure Governance Inventory Tags ResourceGraph FinOps Security Compliance Excel |