Azure Governance Visualizer (AzGovViz)

Azure Governance Visualizer (AzGovViz) is a PowerShell-based tool designed to provide granular insights into technical Azure Governance implementations. It iterates through the Azure Tenant's Management Group hierarchy—from the root Management Group down to Subscriptions, Resource Groups, and individual Resources—collecting data via Azure ARM, Microsoft Graph, and Storage APIs.

Key Capabilities:

• Hierarchy Visualization: Generates an HTML output containing a HierarchyMap and TenantSummary.
• Governance Insights: Provides DefinitionInsights and granular ScopeInsights for Management Groups and Subscriptions, specifically covering Azure Policy and RBAC.
• Data Export: Produces enriched CSV files for capability-specific data and detailed JSON files documenting Management Groups, Subscriptions, Azure RBAC (definitions and assignments), and Azure Policy (definitions and assignments).
• Use Cases: Ideal for change tracking, tenant migration (redeployment of configuration), and creating governance backups.

AzGovViz provides operational and cost-optimization insights for your Azure environment.

Key capabilities include:

• Subscription Insights: Tracks state, quotas, role assignment limits, tags, Microsoft Defender for Cloud secure scores, and cost.
• Resource Management:
  • Fluctuation Tracking: Reports on resources added or removed since the previous execution (available in HTML and CSV).
  • Lock Analysis: Aggregates insights on resource locks and provides detailed CSV exports of locks applied at specific scopes.
  • Tagging: Provides insights into tag name usage across subscriptions and resources.
• Cost Optimization: When running with the -DoAzureConsumption parameter, the tool identifies orphaned/unused resources with an intent of cost savings. It specifically flags virtual machines that are stopped but not deallocated, as these still incur compute costs.
• Microsoft Defender for Cloud: Summarizes coverage by plan/tier and highlights the usage of deprecated Defender plans (e.g., Container Registry & Kubernetes).

Azure Governance Visualizer (AzGovViz) provides deep visibility into Azure Policy configurations and compliance states across Management Groups, subscriptions, and resource groups.

Key capabilities include:

• Policy Definition Analysis: Identifies custom policy definitions, their scope, effects (including DINE/Modify), and usage in PolicySets. It also identifies orphaned custom policy definitions (those not used in any PolicySet or assignment).
• Exemption Tracking: Lists all policy exemptions, enriches scope information, and summarizes expired exemptions.
• Assignment Monitoring: Detects orphaned policy assignments (where the underlying definition no longer exists) and provides enriched data on assignment scope, inheritance, and compliance status (Compliant, NonCompliant, or Conflicting).
• ALZ Alignment: Includes an Azure Landing Zone (ALZ) policy version checker and policy assignment checker. It clones the ALZ GitHub repository to compare your tenant's policies/assignments against the official ALZ definitions, providing lifecycle management recommendations and a *_ALZPolicyVersionChecker.csv export.
• Remediation: Lists all remediable policies with necessary assignment and definition data.

AzGovViz provides holistic insights into Role-Based Access Control (RBAC) and Microsoft Entra ID identities.

Key capabilities include:

• Role Definition & Assignment Analysis: Identifies custom role definitions, their assignable scopes, and orphaned custom role definitions (unused in assignments or policy rules). It also detects orphaned role assignments (where the role or target identity was deleted).
• Identity Resolution: For group assignments, it fully resolves Microsoft Entra group members and reports transitive member counts. For Service Principals, it reveals the specific type (Application vs. ManagedIdentity). For Users, it reveals the userType (Member vs. Guest).
• PIM (Privileged Identity Management): Generates reports on PIM-eligible role assignments for Management Groups and subscriptions.
  • 💡 Note: This requires executing as a service principal with the Application API permission PrivilegedAccess.Read.AzureResources.
• Security Best Practices: Analyzes high-privilege risks, such as 'Owner' permissions on Service Principals, 'User Access Administrator' permissions on non-group identities, and high-privilege roles assigned to Guest Users.
• Managed Identity Insights: Summarizes user-assigned managed identities, their resource assignments, and identifies orphaned managed identities related to non-existent policy assignments.