Azure Estate Report

Quarterly estate review · Contoso Ltd

Snapshot 5953fbe4-34d1-47e1-a672-2d16aa17d753 · collected 2026-11-04T04:26:58.926329474+00:00 · tenant fixture-tenant · status complete · golden fixture

Diagrams

Operational and compliance evidence

Microsoft service evidence recorded during collection. Results cover only the accessible scope; an empty dataset is not proof of zero cost, compliance, protection or service enablement. Detailed records remain in the snapshot database and data exports.

Azure Advisor cost opportunities

Collection: Recorded evidence

Estimates from Azure Advisor, grouped by currency and reported period. Annual estimates are separate. Missing amounts or periods remain unknown. Recommendations can overlap; totals are not guaranteed savings or billed costs.

Azure Policy evaluation states

Collection: Recorded evidence

Counts are policy evaluations, not distinct resources. Recorded states stay separate; missing evaluations never imply compliance. Full assignment and initiative IDs identify each group. A missing initiative may indicate a standalone policy or missing evidence.

Azure Policy exemptions

Collection: Recorded evidence

Expiry is assessed at collection time. Review expired exemptions and those due within 90 days with their owners. No expiry specified does not mean permanent approval; assignment scope and justification remain in the stored evidence.

Defender regulatory standards

Collection: Recorded evidence

Standard states across accessible subscriptions. Detailed control counts remain in the stored evidence. Missing or unsupported coverage does not establish compliance or certification.

Defender regulatory controls

Collection: Recorded evidence

Control states across accessible subscriptions, grouped by standard. Skipped, unsupported and unknown states remain distinct from passes. Full control IDs remain in the stored evidence.

Defender regulatory assessments

Collection: Recorded evidence

Passed, failed and skipped counts are resource occurrences across assessments; resources can be counted more than once. Missing counts remain unknown. These assessments do not establish certification or compliance of unassessed resources.

Policy assignment inventory

Collection: Recorded evidence

Assignment inventory includes the requested inherited scope. Enforcement mode and excluded scopes affect interpretation; an assignment does not establish a passing evaluation.

Patch assessments

Collection: Recorded evidence

Counts describe pending updates at the recorded assessment time and may overlap across classifications. Missing counts remain unknown. ARG assessment history is limited to seven days.

Backup protection evidence

Collection: Evidence incomplete or collection status unverified

Protection state, backup status and recovery-point time are separate evidence. Missing fields remain unknown; the age threshold is a configurable review aid, not a workload RPO.

Backup and restore outcomes

Collection: Recorded evidence

Backup and restore jobs retain the provider status, including warnings. ARG exposes up to 14 days of jobs; an empty result does not prove successful backups.

Recent ARM changes

Collection: Recorded evidence

Recorded ARM changes can include actor, client and changed properties. ARG retains 14 days; this is not a complete activity or data-plane audit log.

Policy evaluation coverage

Collection: Recorded evidence

Assignments are matched to stored policy states using full normalised ARM IDs. No observed evaluation is kept separate from compliance and from unavailable state collection.

Machine assessment coverage

Collection: Recorded evidence

Counts use the collected VM and Arc inventory, deduplicated by full ARM ID. No observed assessment may indicate missing service configuration, access or expired evidence; it is not a passed patch check.

Evidence age at collection

Collection: Recorded evidence

Ages are evaluated at the snapshot timestamp using the threshold recorded with each query. Future, invalid and missing dates stay separate. Review thresholds are configurable and are not Microsoft retention guarantees.

Findings

5 high 8 medium 17 low 5 info

Governance

15 resources are missing at least one required tag, recorded by the missing_required_tags audit.

Resources by type

// ARG retains up to 14 days of jobs. No jobs is not evidence of successful backups; target IDs may be unavailable on some job types.
recoveryservicesresources
| where type in~ ('microsoft.recoveryservices/vaults/backupjobs', 'microsoft.dataprotection/backupvaults/backupjobs')
| project id, name, type, subscriptionId, resourceGroup,
          resourceId = coalesce(tostring(properties.dataSourceId), tostring(properties.sourceResourceId)),
          friendlyName = coalesce(tostring(properties.entityFriendlyName), tostring(properties.dataSourceName)),
          operation = coalesce(tostring(properties.operation), tostring(properties.operationCategory)),
          status = tostring(properties.status), startedAt = properties.startTime, endedAt = properties.endTime,
          duration = properties.duration, backupInstanceId = tostring(properties.backupInstanceId), properties
| order by id asc

// Only summary records: per-patch rows would duplicate the machine totals. ARG assessment history is limited to seven days.
patchassessmentresources
| where type in~ ('microsoft.compute/virtualmachines/patchassessmentresults', 'microsoft.hybridcompute/machines/patchassessmentresults')
| project id, name, subscriptionId, resourceGroup,
          resourceId = tostring(split(tolower(id), '/patchassessmentresults/')[0]),
          assessedAt = properties.lastModifiedDateTime, osType = tostring(properties.osType),
          status = tostring(properties.status), rebootPending = tobool(properties.rebootPending),
          securityUpdates = toint(properties.availablePatchCountByClassification.security),
          criticalUpdates = toint(properties.availablePatchCountByClassification.critical),
          classifications = properties.availablePatchCountByClassification, errorDetails = properties.errorDetails
| order by id asc

// Assignments without state rows are still evidence. Do not infer a passed evaluation from this inventory.
policyresources
| where type =~ 'microsoft.authorization/policyassignments'
| project id, name, subscriptionId, scope = tostring(properties.scope), policyDefinitionId = tostring(properties.policyDefinitionId),
          displayName = tostring(properties.displayName), enforcementMode = tostring(properties.enforcementMode),
          notScopes = properties.notScopes, parameters = properties.parameters, metadata = properties.metadata
| order by id asc

// ARG change history lasts 14 days and does not represent a complete activity/data-plane log. Missing actor information stays unknown.
resourcechanges
| project id, name, subscriptionId, resourceGroup, resourceId = tostring(properties.targetResourceId),
          changeType = tostring(properties.changeType), changedAt = properties.changeAttributes.timestamp,
          changedBy = tostring(properties.changeAttributes.changedBy), changedByType = tostring(properties.changeAttributes.changedByType),
          clientType = tostring(properties.changeAttributes.clientType), correlationId = tostring(properties.changeAttributes.correlationId),
          changes = properties.changes
| order by id asc

Avd

Compliance

Cost

Governance

Inventory

Monitoring

Networking

Operations

Resilience

Subscriptions

Development (sub-dev · 7 resources)

Production (sub-prod · 45 resources)

Generated by azdocs.