Azure.Admin.Console

Azure, Microsoft 365 and Azure DevOps - assessed, reported and explained from PowerShell. Plain REST. No Az or Microsoft.Graph modules. Read-only by default.

How to use it · What's new · Architecture design · Commands · Full guide · Contribute · Contact

---

Azure doesn't stop at the subscription. Every identity is governed in Microsoft 365, and every change ships through Azure DevOps. Assess one without the others and you're reading a third of the story - Azure.Admin.Console reads all three.

Who it's for

You are	You get
Azure administrator	Health, inventory, locks, diagnostics and errors - one command each
Platform / cloud engineer	Assessments for AKS, networks, storage, Cosmos DB, Service Bus, Log Analytics, WAF and ALZ
Security and compliance	Defender, Azure Policy, attack paths, access reviews, legacy authentication, NSGs
FinOps	Costs, anomalies, unused and under-used resources, Advisor savings
Solution architect	A guided design - patterns, components, policy checks, draw.io and Mermaid diagrams, decision records - before anything is deployed
Microsoft 365 / Entra admin	Tenant assessment, nested group membership, application permissions
DevOps team	An Azure DevOps assessment: pipelines, tools, SBOM, security, DORA - and a plan to move to GitHub
Consultant	Hand-over-ready HTML, PDF and CSV reports from a read-only sign-in

What's new in 0.15.0

Click a tab to open it.

🧭 Plan a service before you deploy it  ·  New-AACServiceBlueprint

Any service in Azure's list, planned in one command: names that follow your naming rules, the Azure Policy that would apply, PSRule for Azure on the planned configuration, and the alerts and resiliency recommendations it should have. You get a console view, an HTML map, an editable draw.io file and a PDF. Function App, storage, Event Hubs and Event Grid work without signing in.

New-AACServiceBlueprint -Service FunctionApp, StorageAccount, 'Virtual Network' -SubscriptionId $sub -Workload orders -Environment prod -OutputFormat DrawIo, Html -Path .\out

🏗️ Landing zone checklist and resiliency, checked  ·  Invoke-AACLandingZoneAssessment · Invoke-AACResiliencyAssessment

The Azure Landing Zone checklist and the Azure Proactive Resiliency Library, run against your estate with Resource Graph. Each check's status says what its evidence can bear. Checks a query can't answer are listed as Manual, never counted as a pass, so neither command gives a score.

Invoke-AACLandingZoneAssessment -ManagementGroupId 'mg-landingzones' -HtmlPath .\landing-zone.html
Invoke-AACResiliencyAssessment -SubscriptionId $sub -Impact High -Status Fail

☸️ Inside your AKS clusters  ·  Invoke-AACAksAssessment -IncludeWorkload

49 checks on what runs in each cluster, read with AKS run command: failing and restarting pods, requests, probes, disruption budgets, privileged and host access, RBAC, public services. It also says whether the workloads could move to AKS Automatic. Secrets and ConfigMaps are never read. The assessment itself has about 20 more checks, so scores can drop from 0.14.9.

Invoke-AACAksAssessment -Name 'aks-prod-weu' -IncludeWorkload -HtmlPath .\aks.html

✅ Accepted findings, and what changed  ·  -SuppressionFile · -PreviousPath

Mark findings you have accepted, with a reason and an expiry date, and they leave the counts but stay visible in the report. Compare with last month's run to see what is new, still open or resolved. Available in the AKS, Microsoft 365, Azure DevOps, landing zone and resiliency assessments.

Invoke-AACM365Assessment -CsvPath .\m365-november -PreviousPath .\m365-october -SuppressionFile .\accepted.json

➕ And more  ·  quota, Conditional Access, pipeline minutes, baseline alerts

• Test-AACAzureLimit -IncludeQuota: each region's compute, network and storage quota.
• Invoke-AACM365Assessment: four more Conditional Access findings, such as Global Administrators left out of an MFA policy.
• Invoke-AACADOAssessment: pipeline minutes per project, pipelines getting slower, and widely shared service connections.
• Get-AACAlertBaseline and Get-AACResiliencyRecommendation: the baseline alerts and resiliency recommendations for a resource type, offline.

Everything is in the changelog, with 0.14.9 and earlier releases.

Architecture design

Design it before you deploy it, and draw it the way you'll deploy it. Architecture reviews usually start from a whiteboard sketch that nobody keeps up to date, then find out at deployment that a policy denies it. The Architecture commands turn the conversation into a design: they ask the questions an Azure architect would ask, pick the cloud design patterns that fit, lay out the components, check them against the Well-Architected Framework and your landing zone's Azure Policy, and draw the result. The diagram, the findings and the decision records all come from the same model, so they agree.

Step	Command	What you get
1	New-AACArchitectureBrief	About 20 probe questions - business, reliability, security, performance, data, cost, operations. Answer them at the prompt, from a hashtable or a file; whatever isn't answered is listed as an assumption
2	Get-AACArchitecturePattern	15 patterns ranked for the brief (Cache-Aside, Queue-Based Load Leveling, Deployment Stamps, Geode...), each with why it fits and its trade-offs
3	New-AACArchitectureDesign	The components and their settings: SKUs, zone redundancy, private endpoints, identity, hub and spoke, a second region when the RTO or SLA needs one. Signed in, it reads the landing zone's inherited policy and allowed locations
4	Test-AACArchitectureDesign	Findings by pillar and severity, each mapped to its Azure Policy definition and PSRule for Azure rule; Blocking when the landing zone would deny it. -FailOnGap fails a pipeline
5	New-AACArchitectureDiagram	Mermaid, Markdown and a multi-page draw.io diagram with Azure icons
6	Export-AACArchitectureDecision	Architecture decision records: the topology, each pattern, each accepted risk with its owner and review date

$brief  = New-AACArchitectureBrief -Name 'contoso-orders'                    # asks the questions
$design = Get-AACArchitecturePattern -Brief $brief -RecommendedOnly |
          New-AACArchitectureDesign -Brief $brief -LandingZone 'mg-corp' -OutPath .\contoso-orders.design.json
Test-AACArchitectureDesign -Design $design -HtmlPath .\validation.html
New-AACArchitectureDiagram -Design $design -Path .\diagrams                   # .mmd, .md, .drawio
Export-AACArchitectureDecision -Design $design -Path .\adr -Owner 'Orders team'

The diagram. New-AACArchitectureDiagram writes a draw.io file you can open in the desktop app, app.diagrams.net or VS Code, and keep editing. It isn't a picture:

• Azure icons inside real containers: landing zone, region, hub and spoke virtual networks, data tier, operations, delivery pipeline. Move a box and what's in it moves too.
• A status dot on every component for its worst open finding: green, amber or red.
• Shape data on every component (Edit > Edit Data): service, SKU, region, zone redundancy, private endpoint, identity, open findings.
• Layers you can turn on and off: WAF badges, Azure Policy, guardrail zones, the PSRule gate, Advisor and Defender recommendations.
• Five pages: a cover, the architecture, policy and compliance, the findings, and a legend.

Architecture - two regions in a landing zone, Azure icons, finding dots, policy chips, guardrail zones
Cover - facts, open findings, pillar scores	Policy and compliance - its own tab
Validation report - Test-AACArchitectureDesign -HtmlPath

_{Snapshots from a fictional design (contoso-orders) in a fictional landing zone.}

Everything except reading the landing zone runs offline, so a design can be reviewed before there is a subscription for it. The walkthrough is in the guide.

What's inside

98 commands. Every one gives a console view, objects, and CSV, HTML and PDF reports.

Area	Commands
Design	New-AACServiceBlueprint 🆕 · New-AACArchitectureBrief · Get-AACArchitecturePattern · New-AACArchitectureDesign · Test-AACArchitectureDesign · New-AACArchitectureDiagram · Export-AACArchitectureDecision
Assess	Invoke-AACTenantAssessment · Invoke-AACWafAssessment · Invoke-AACGovernanceAssessment · Invoke-AACPSRule · Test-AACGoLiveReadiness · Invoke-AACLandingZoneAssessment 🆕 · Invoke-AACResiliencyAssessment 🆕 · Invoke-AACAksAssessment · Invoke-AACFunctionAppAssessment and 12 more
See	Show-AACDashboard · Get-AACInventory · Show-AACResourceMap · Show-AACNetworkTopology · Get-AACDependencyGraph
Cost	Show-AACCost · Get-AACCostAnomaly · Get-AACUnusedResource · Get-AACResourceUtilization · Get-AACAdvisorRecommendation
Secure	Get-AACSecurityPosture · Get-AACAttackPath · Get-AACAccessReview · Get-AACNetworkSecurityGroup · Get-AACLegacyAuthentication
Plan IPs	Get-AACIPAMReport - your address plan, every IP address, overlaps and the next free ranges
Govern	Show-AACEffectivePolicy · Test-AACPolicyDeployment · Get-AACPolicyState · Get-AACComplianceGap · Get-AACConfigurationDrift · Get-AACResourceLock · Test-AACAzureLimit
Operate	Get-AACResourceHealth · Get-AACChangeHistory · Get-AACResourceError · Invoke-AACHealthCheck · Get-AACFailoverReadiness · Invoke-AACActivityLogAssessment · Show-AACActivityLogEvent · Show-AACServiceBusEntity · Get-AACAlertBaseline 🆕
Microsoft 365	Invoke-AACM365Assessment · Get-AACEntraGroupMembership · Get-AACApplicationPermission · New-AACApplicationPermission
Azure DevOps	Invoke-AACADOAssessment
Build	Export-AACTerraform · Get-AACTerraformPlan · Deploy-AACStorageAccount

Every command, with examples: the full guide and docs/.

How to use it

Install-PSResource -Name Azure.Admin.Console        # or: Install-Module Azure.Admin.Console -Scope CurrentUser
Connect-AAC                                         # sign in once, in your browser

Show-AACDashboard                                         # the estate on one screen
Invoke-AACTenantAssessment -HtmlPath .\tenant.html        # the whole environment, as a report
Invoke-AACADOAssessment -Organization contoso -UseAzureSignIn -HtmlPath .\ado.html

The same switches work everywhere:

Switch	What it does
-HtmlPath · -PdfPath · -CsvPath	Write a report
-NoDisplay	Return objects only, for scripts
-PassThru	Show the view and return the objects
Get-Help <command> -Full	The permissions it needs, and examples

PowerShell 7.2+ on Windows, Linux and macOS. PDF reports need Windows and PowerShell 7.4+. Only Deploy-AACStorageAccount and New-AACApplicationPermission change anything in Azure or Entra ID, and both support -WhatIf.

Watch the walkthrough on YouTube

Contributing

New commands, fixes, ideas and bug reports are all welcome - you don't need to be an expert to help. Open an issue to say what you'd like to work on, and we'll shape it together. The rules and steps, for people and AI coding agents, are in AGENTS.md.

How the project is laid out - and how to add a command

Azure.Admin.Console.psd1 / .psm1   the module: loads each area of src\, Core first
src\
  Core\     sign-in, REST helpers, console views, CSV / HTML / PDF reports
  Azure\    commands scoped to subscriptions and management groups
  M365\     commands for the Entra ID / Microsoft 365 tenant
  DevOps\   commands for Azure DevOps
  Architecture\  architecture design: brief, patterns, design, rules, diagrams, decisions
    <Area>\Public\    one exported command per file
    <Area>\Private\   its helpers
Tests\<Area>\         Pester tests, fully mocked - no Azure sign-in needed
Tests\Fixtures\       fake API answers the tests read

To add a command, copy a sibling:

1. src\<Area>\Public\Verb-AACThing.ps1 - the command, with comment-based help.
2. src\<Area>\Private\ - turn API rows into objects, then the view and reports.
3. Add it to FunctionsToExport in Azure.Admin.Console.psd1.
4. Tests\<Area>\Thing.Tests.ps1 with a fixture in Tests\Fixtures\.

House rules: REST through the Core helpers (no Az or Graph modules), read-only unless the command supports -WhatIf, and Set-StrictMode -Version Latest clean.

Invoke-Pester -Path ./Tests/Azure/Cost.Tests.ps1 -Output Detailed   # one test file while you work
./build.ps1 -Task Docs                                             # after changing help
./build.ps1                                                        # docs, every test, analyzer, package

Credits

With thanks to the people whose work and ideas shaped this module:

GitHub
Shashi Shetty

Built on Spectre.Console, PDFsharp and MigraDoc and PSRule for Azure, with alert and resiliency data from Azure Monitor Baseline Alerts and the Azure Proactive Resiliency Library (notices).

Contact

Chendrayan Venkatesan - Azure | DevSecOps | PowerShell

Questions and bugs: open an issue.

_{MIT licensed - see LICENSE.}