Azure Estate Report

Quarterly estate review · Contoso Ltd

Snapshot dced93ea-6655-418a-ac15-a87608cee6ab · collected 2026-09-15T17:34:04.175996+00:00 · tenant fixture-tenant · status complete · golden fixture

2subscriptions

3resource groups

18resources

13findings

50%tag coverage

Operational and compliance evidence

Microsoft service evidence recorded during collection. Results cover only the accessible scope; an empty dataset is not proof of zero cost, compliance, protection or service enablement. Detailed records remain in the snapshot database and data exports.

Azure Advisor cost opportunities

Collection: Recorded evidence

Estimates from Azure Advisor, grouped by currency and reported period. Annual estimates are separate. Missing amounts or periods remain unknown. Recommendations can overlap; totals are not guaranteed savings or billed costs.

Currency	Period	Items	Savings	Annual savings
GBP	Month	1	125.50	Unknown

Azure Policy evaluation states

Collection: Recorded evidence

Counts are policy evaluations, not distinct resources. Recorded states stay separate; missing evaluations never imply compliance. Full assignment and initiative IDs identify each group. A missing initiative may indicate a standalone policy or missing evidence.

Sub. ID	Assignment	Initiative ID	State	Results
sub-prod	/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/baseline	/providers/microsoft.authorization/policysetdefinitions/security-baseline	Exempt	1

Azure Policy exemptions

Collection: Recorded evidence

Expiry is assessed at collection time. Review expired exemptions and those due within 90 days with their owners. No expiry specified does not mean permanent approval; assignment scope and justification remain in the stored evidence.

Category	Expiry at collection	Exemptions
Waiver	Due after 90 days	1

Defender regulatory standards

Collection: Recorded evidence

Standard states across accessible subscriptions. Detailed control counts remain in the stored evidence. Missing or unsupported coverage does not establish compliance or certification.

Standard	State	Standard records
Azure-Security-Benchmark	Failed	1

Defender regulatory controls

Collection: Recorded evidence

Control states across accessible subscriptions, grouped by standard. Skipped, unsupported and unknown states remain distinct from passes. Full control IDs remain in the stored evidence.

Standard	State	Control records
Azure-Security-Benchmark	Unsupported	1

Defender regulatory assessments

Collection: Recorded evidence

Passed, failed and skipped counts are resource occurrences across assessments; resources can be counted more than once. Missing counts remain unknown. These assessments do not establish certification or compliance of unassessed resources.

Standard	State	Checks	Passed	Failed	Skipped
Azure-Security-Benchmark	Failed	1	12	2	Unknown

Policy assignment inventory

Collection: Recorded evidence

Assignment inventory includes the requested inherited scope. Enforcement mode and excluded scopes affect interpretation; an assignment does not establish a passing evaluation.

Enforcement	Assignments
Default	1
DoNotEnforce	1

Patch assessments

Collection: Recorded evidence

Counts describe pending updates at the recorded assessment time and may overlap across classifications. Missing counts remain unknown. ARG assessment history is limited to seven days.

OS	State	Checks	Security updates	Critical updates
Linux	Succeeded	1	2	Unknown

Backup and restore outcomes

Collection: Recorded evidence

Backup and restore jobs retain the provider status, including warnings. ARG exposes up to 14 days of jobs; an empty result does not prove successful backups.

Operation	State	Jobs
Backup	CompletedWithWarnings	1
Restore	Failed	1

Recent ARM changes

Collection: Recorded evidence

Recorded ARM changes can include actor, client and changed properties. ARG retains 14 days; this is not a complete activity or data-plane audit log.

Type	Actor type	Events
Update	Application	1

Policy evaluation coverage

Collection: Recorded evidence

Assignments are matched to stored policy states using full normalised ARM IDs. No observed evaluation is kept separate from compliance and from unavailable state collection.

Assignment	Name	State	Results
/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/baseline	Production baseline	Evaluation observed	1
/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/not-evaluated	Pending initiative	No evaluation observed	0

Machine assessment coverage

Collection: Recorded evidence

Counts use the collected VM and Arc inventory, deduplicated by full ARM ID. No observed assessment may indicate missing service configuration, access or expired evidence; it is not a passed patch check.

Type	State	Resources
microsoft.compute/virtualmachines	Evaluation observed	1

Evidence age at collection

Collection: Recorded evidence

Ages are evaluated at the snapshot timestamp using the threshold recorded with each query. Future, invalid and missing dates stay separate. Review thresholds are configurable and are not Microsoft retention guarantees.

Query	Review age (hours)	State	Items
patch_assessments	72	Missing or invalid timestamp	1

Findings

2 high 1 medium 9 low 1 info

Severity	Title	Category	Check	Resource
high	nsg-app: rule allow-ssh allows Internet -> port 22	security	`nsg_open_to_internet`	`/subscriptions/sub-prod/resourcegroups/rg-network/providers/microsoft.network/networksecuritygroups/nsg-app`
high	stprodapp01 allows public blob access	security	`storage_public_blob_access`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.storage/storageaccounts/stprodapp01`
medium	web-dev does not enforce HTTPS-only traffic	security	`web_app_https_only_disabled`	`/subscriptions/sub-dev/resourcegroups/rg-dev/providers/microsoft.web/sites/web-dev`
low	asp-dev is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-dev/resourcegroups/rg-dev/providers/microsoft.web/serverfarms/asp-dev`
low	id-web-dev is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-dev/resourcegroups/rg-dev/providers/microsoft.managedidentity/userassignedidentities/id-web-dev`
low	pe-sql is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.network/privateendpoints/pe-sql`
low	pe-sql.nic.4f2a is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.network/networkinterfaces/pe-sql.nic.4f2a`
low	stprodapp01 is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.storage/storageaccounts/stprodapp01`
low	vm-app-01-nic is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.network/networkinterfaces/vm-app-01-nic`
low	vm-app-01-os is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.compute/disks/vm-app-01-os`
low	vm-app-01-pip is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.network/publicipaddresses/vm-app-01-pip`
low	web-dev is missing tags: env	governance	`missing_required_tags`	`/subscriptions/sub-dev/resourcegroups/rg-dev/providers/microsoft.web/sites/web-dev`
info	nsg-unused is not associated with any subnet or NIC	security	`unassociated_nsgs`	`/subscriptions/sub-prod/resourcegroups/rg-network/providers/microsoft.network/networksecuritygroups/nsg-unused`

Governance

50%tag coverage

1distinct keys

9non-compliant

Tag key	Resources	Share of 9 tagged
`env`	9	100%

Subscription	Tag coverage	Status
Development	0%	below threshold
Production	60%	healthy

9 resources are missing at least one required tag, recorded by the missing_required_tags audit.

Resource group	Subscription	Resources	Non-compliant	Missed tags
rg-app	Production	12	6	`env`
rg-dev	Development	3	3	`env`

Resources by type

Type	Azure type	Count
Network Interface	`microsoft.network/networkinterfaces`	2
Network Security Group	`microsoft.network/networksecuritygroups`	2
Virtual Network	`microsoft.network/virtualnetworks`	2
Managed Disk	`microsoft.compute/disks`	1
Virtual Machine	`microsoft.compute/virtualmachines`	1
AVD Host Pool	`microsoft.desktopvirtualization/hostpools`	1
Managed Identity	`microsoft.managedidentity/userassignedidentities`	1
Private Endpoint	`microsoft.network/privateendpoints`	1
Public IP Address	`microsoft.network/publicipaddresses`	1
Log Analytics Workspace	`microsoft.operationalinsights/workspaces`	1
SQL Server	`microsoft.sql/servers`	1
SQL Database	`microsoft.sql/servers/databases`	1
Storage Account	`microsoft.storage/storageaccounts`	1
App Service Plan	`microsoft.web/serverfarms`	1
App Service / Function App	`microsoft.web/sites`	1

Query provenance

The executed query and request scope are preserved with this snapshot. Source review dates are not upstream release dates.

backup_jobs

KQL SHA-256	cb61f0676de911c80ba3e531f5ec6f6ef259cf75db1161ecaec5c106b88ee742
Authorization scope	AtScopeAndBelow
Requested subscriptions	sub-prod
Sources	https://learn.microsoft.com/en-us/azure/backup/query-backups-using-azure-resource-graph
Source reviewed	2026-09-13

// ARG retains up to 14 days of jobs. No jobs is not evidence of successful backups; target IDs may be unavailable on some job types.
recoveryservicesresources
| where type in~ ('microsoft.recoveryservices/vaults/backupjobs', 'microsoft.dataprotection/backupvaults/backupjobs')
| project id, name, type, subscriptionId, resourceGroup,
          resourceId = coalesce(tostring(properties.dataSourceId), tostring(properties.sourceResourceId)),
          friendlyName = coalesce(tostring(properties.entityFriendlyName), tostring(properties.dataSourceName)),
          operation = coalesce(tostring(properties.operation), tostring(properties.operationCategory)),
          status = tostring(properties.status), startedAt = properties.startTime, endedAt = properties.endTime,
          duration = properties.duration, backupInstanceId = tostring(properties.backupInstanceId), properties
| order by id asc

patch_assessments

KQL SHA-256	8ef4dc6295f4389a1836e534969793c389f3cf6a721839b1dc4f8c1185716b37
Authorization scope	AtScopeAndBelow
Requested subscriptions	sub-prod
Sources	https://learn.microsoft.com/en-us/azure/update-manager/query-logs
Source reviewed	2026-09-13

// Only summary records: per-patch rows would duplicate the machine totals. ARG assessment history is limited to seven days.
patchassessmentresources
| where type in~ ('microsoft.compute/virtualmachines/patchassessmentresults', 'microsoft.hybridcompute/machines/patchassessmentresults')
| project id, name, subscriptionId, resourceGroup,
          resourceId = tostring(split(tolower(id), '/patchassessmentresults/')[0]),
          assessedAt = properties.lastModifiedDateTime, osType = tostring(properties.osType),
          status = tostring(properties.status), rebootPending = tobool(properties.rebootPending),
          securityUpdates = toint(properties.availablePatchCountByClassification.security),
          criticalUpdates = toint(properties.availablePatchCountByClassification.critical),
          classifications = properties.availablePatchCountByClassification, errorDetails = properties.errorDetails
| order by id asc

policy_assignments

KQL SHA-256	b0d05b23d5aa6b47f7dfdd8fff0de86a88a02f0f4252a0c7f0d288a4f5b0dabd
Authorization scope	AtScopeAboveAndBelow
Requested subscriptions	sub-prod
Sources	https://learn.microsoft.com/en-us/azure/governance/policy/samples/resource-graph-samples
Source reviewed	2026-09-13

// Assignments without state rows are still evidence. Do not infer a passed evaluation from this inventory.
policyresources
| where type =~ 'microsoft.authorization/policyassignments'
| project id, name, subscriptionId, scope = tostring(properties.scope), policyDefinitionId = tostring(properties.policyDefinitionId),
          displayName = tostring(properties.displayName), enforcementMode = tostring(properties.enforcementMode),
          notScopes = properties.notScopes, parameters = properties.parameters, metadata = properties.metadata
| order by id asc

resource_changes

KQL SHA-256	53f687e9350c4e3bb469c14d3eb0439573fcda49215f91481d4c8d3369fabfaa
Authorization scope	AtScopeAndBelow
Requested subscriptions	sub-prod
Sources	https://learn.microsoft.com/en-us/azure/governance/resource-graph/changes/get-resource-changes
Source reviewed	2026-09-13

// ARG change history lasts 14 days and does not represent a complete activity/data-plane log. Missing actor information stays unknown.
resourcechanges
| project id, name, subscriptionId, resourceGroup, resourceId = tostring(properties.targetResourceId),
          changeType = tostring(properties.changeType), changedAt = properties.changeAttributes.timestamp,
          changedBy = tostring(properties.changeAttributes.changedBy), changedByType = tostring(properties.changeAttributes.changedByType),
          clientType = tostring(properties.changeAttributes.clientType), correlationId = tostring(properties.changeAttributes.correlationId),
          changes = properties.changes
| order by id asc

Avd

avd_host_pools (1)

Azure Virtual Desktop host pools with type, load balancing, and session limits

id	name	location	resourceGroup	subscriptionId	hostPoolType	loadBalancerType	maxSessionLimit	preferredAppGroupType
/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.desktopvirtualization/hostpools/hp-prod	hp-prod	uksouth	rg-app	sub-prod	Pooled	BreadthFirst	10	Desktop

Compliance

defender_compliance_assessments (1)

Defender regulatory assessments with passed, failed, and skipped resource counts

id	subscriptionId	complianceStandard	complianceControl	state	passedResources	failedResources	skippedResources
/defender/assessment-1	sub-prod	Azure-Security-Benchmark	NS-1	Failed	12	2

defender_compliance_controls (1)

Defender regulatory controls with standard, state, and description

id	subscriptionId	complianceStandard	complianceControl	state
/defender/control-1	sub-prod	Azure-Security-Benchmark	NS-1	Unsupported

defender_compliance_standards (1)

Defender regulatory standards with observed state and control counts

id	subscriptionId	complianceStandard	state	passedControls	failedControls	skippedControls	unsupportedControls
/defender/standard-1	sub-prod	Azure-Security-Benchmark	Failed	12	2	1	3

Cost

advisor_cost_recommendations (1)

Azure Advisor cost recommendations with reported savings, currency, period, and affected resource

id	subscriptionId	resourceId	solution	currency	savingsPeriod	savingsAmount	annualSavingsAmount
/advisor/cost-1	sub-prod	/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.compute/virtualmachines/vm-web	Review VM sizing	GBP	Month	125.5

Governance

policy_assignments (2)

Policy assignments, including inherited scope and enforcement settings

id	displayName	enforcementMode
/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/baseline	Production baseline	Default
/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/not-evaluated	Pending initiative	DoNotEnforce

policy_exemptions (1)

Azure Policy exemptions including category, assignment, and expiry

id	name	displayName	subscriptionId	exemptionCategory	expiresOn
/policy/exemption-1	migration	Migration exception	sub-prod	Waiver	2099-01-01T00:00:00Z

policy_states (1)

Azure Policy evaluations with assignment, initiative, resource, state, and evaluation timestamp

id	subscriptionId	resourceId	policyAssignmentId	policyAssignmentName	policySetDefinitionId	complianceState	evaluatedAt
/policy/state-1	sub-prod	/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.storage/storageaccounts/stprodapp01	/subscriptions/sub-prod/providers/microsoft.authorization/policyassignments/baseline	baseline	/providers/microsoft.authorization/policysetdefinitions/security-baseline	Exempt	2026-09-01T12:00:00Z

Inventory

resource_type_counts (2)

Resource counts by type across the estate

type	resourceCount
microsoft.network/virtualnetworks	2
microsoft.compute/virtualmachines	1

Monitoring

log_analytics_workspaces (1)

Log Analytics workspaces with SKU, retention, quota, and network access

id	name	location	resourceGroup	subscriptionId	skuName	retentionInDays	publicNetworkAccessForIngestion	publicNetworkAccessForQuery
/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.operationalinsights/workspaces/law-prod	law-prod	uksouth	rg-app	sub-prod	PerGB2018	30	Enabled	Enabled

resource_changes (1)

Recent ARM control-plane changes with recorded actor, time and changed properties

id	changeType	changedByType	changedBy	clientType
/changes/change-1	Update	Application	fixture-deployment	Azure Resource Manager

Networking

virtual_networks (2)

Virtual networks with address spaces and DNS settings

id	name	location	resourceGroup	subscriptionId	addressPrefixes	dnsServers	subnetCount
/subscriptions/sub-prod/resourcegroups/rg-network/providers/microsoft.network/virtualnetworks/vnet-hub	vnet-hub	uksouth	rg-network	sub-prod	["10.0.0.0/16"]	[]	2
/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.network/virtualnetworks/vnet-app	vnet-app	uksouth	rg-app	sub-prod	["10.1.0.0/16"]	[]	1

Operations

patch_assessments (1)

VM and Arc patch assessments with pending updates, reboot status and observation time

id	resourceId	assessedAt	osType	status	securityUpdates	criticalUpdates
/patch/assessment-1	/subscriptions/sub-prod/resourcegroups/rg-app/providers/microsoft.compute/virtualmachines/vm-app-01		Linux	Succeeded	2

Resilience

backup_jobs (2)

Backup and restore job history with original status and provider details

id	operation	status
/backup/job-1	Backup	CompletedWithWarnings
/backup/job-2	Restore	Failed

Subscriptions

Development (sub-dev · 3 resources)

rg-dev — UK West (3)

Name	Type	Location
id-web-dev	Managed Identity	UK West
asp-dev	App Service Plan	UK West
web-dev	App Service / Function App	UK West

Production (sub-prod · 15 resources)

rg-app — UK South (12)

Name	Type	Location	Tags
vm-app-01-os	Managed Disk	UK South
vm-app-01	Virtual Machine	UK South	`{"env":"prod"}`
hp-prod	AVD Host Pool	UK South	`{"env":"prod"}`
pe-sql.nic.4f2a	Network Interface	UK South
vm-app-01-nic	Network Interface	UK South
pe-sql	Private Endpoint	UK South
vm-app-01-pip	Public IP Address	UK South
vnet-app	Virtual Network	UK South	`{"env":"prod"}`
law-prod	Log Analytics Workspace	UK South	`{"env":"prod"}`
sql-prod	SQL Server	UK South	`{"env":"prod"}`
app-db	SQL Database	UK South	`{"env":"prod"}`
stprodapp01	Storage Account	UK South

rg-network — UK South (3)

Name	Type	Location	Tags
nsg-app	Network Security Group	UK South	`{"env":"prod"}`
nsg-unused	Network Security Group	UK South	`{"env":"prod"}`
vnet-hub	Virtual Network	UK South	`{"env":"prod"}`

Website screenshots

Saved website views from this machine. Capture time is separate from the Azure audit time.

web-dev

https://web-dev.azurewebsites.net/ · Not captured

No screenshot saved

Generated by azdocs.