Well Architected Review

Well-Architected Review

Purpose

Perform a structured assessment of Azure resources against the five pillars of the Microsoft Azure Well-Architected Framework. Produce a scored report with prioritized recommendations.

When to use this skill

• User asks "are we following best practices?"
• User asks for a WAF or Well-Architected review
• User wants to assess architecture quality before a launch or audit
• Periodic (quarterly) architecture health check

Pillars and checks

1. Reliability

Run the following checks and report findings:

1. Availability design: Check if critical workloads use availability zones or availability sets

``bash az vm list --query "[].{name:name, zones:zones, availabilitySet:availabilitySet.id}" -o table az appservice plan list --query "[].{name:name, zoneRedundant:zoneRedundant, sku:sku.name}" -o table ``

1. Backup coverage: Verify Recovery Services vaults and backup policies exist for VMs, databases, and file shares

``bash az backup vault list -o table ` Then for each vault: `bash az backup item list --vault-name --resource-group --backup-management-type AzureIaasVM -o table ``

1. Disaster recovery: Check for paired regions, ASR replication, or geo-redundant storage
2. Health probes: Verify App Service health checks, load balancer probes, and Container Apps health endpoints
3. Auto-healing: Check if App Service auto-heal rules or AKS pod disruption budgets are configured

2. Security

1. Identity: Check for managed identities vs. stored credentials

``bash az webapp identity show --name --resource-group az ad app list --query "[].{name:displayName, passwordCredentials:passwordCredentials}" -o table ``

1. Network isolation: Check for private endpoints, NSGs, and service endpoints

``bash az network private-endpoint list -o table az network nsg list -o table ``

1. Encryption: Verify encryption at rest (storage, databases) and in transit (TLS)
2. Key management: Check Key Vault usage and key/secret expiration dates

``bash az keyvault list -o table az keyvault secret list --vault-name --query "[].{name:name, expires:attributes.expires}" -o table ``

1. Defender for Cloud: Check Secure Score and outstanding recommendations

3. Cost Optimization

1. Rightsizing: Identify underutilized VMs (CPU -o table

```

1. Deployment practices: Check for deployment slots, blue-green, or canary configurations
2. Automation: Check for runbooks, Logic Apps, or scheduled tasks for routine operations

5. Performance Efficiency

1. Autoscaling: Verify autoscale rules exist for App Service plans, VMSS, and Container Apps

``bash az monitor autoscale list --resource-group -o table ` Note: az monitor autoscale list requires --resource-group. Iterate over relevant resource groups, or use Azure Resource Graph: `bash az graph query -q "resources | where type == 'microsoft.insights/autoscalesettings'" -o table ``

1. Caching: Check for Redis Cache or CDN usage on high-traffic workloads
2. Database performance: Check DTU/vCore utilization, index recommendations
3. Content delivery: Verify static assets use CDN or Front Door
4. Connection pooling: Check for connection string patterns suggesting missing pooling

Scoring model

For each check, assign one of:

• ✅ Pass — follows best practice
• ⚠️ Needs attention — partially implemented or at risk
• ❌ Fail — not implemented, risk exposure

Expected output

Report header (mandatory — use this exact format)

Well-Architected Review Report

| Field | Value | |-------|-------| | Subscription | (name + ID) | | Assessment Date | YYYY-MM-DD | | Overall Score | XX% |

Summary

A table with pillar scores:

| Pillar | Pass | Needs Attention | Fail | Score | |--------|------|----------------|------|-------| | Reliability | X | Y | Z | X/(X+Y+Z) % | | Security | ... | ... | ... | ... | | Cost Optimization | ... | ... | ... | ... | | Operational Excellence | ... | ... | ... | ... | | Performance Efficiency | ... | ... | ... | ... | | Overall | | | | avg % |

Detailed findings

For each pillar, list every check with:

• Status (pass/attention/fail)
• Evidence (command output or observation)
• Recommendation (specific action to take)
• Priority (Critical / High / Medium / Low)
• Reference link to WAF documentation

Top 5 recommendations

Ordered by impact, with estimated effort (hours/days) for each.

Remediation guidance

For each ❌ or ⚠️ finding, include in the output:

1. The specific az CLI command to remediate (suggest only — do not execute)
2. Use GetAzCliHelp to validate the command syntax before suggesting
3. The official Microsoft Learn documentation link for the remediation

References

• WAF Overview: https://learn.microsoft.com/en-us/azure/well-architected/
• Reliability: https://learn.microsoft.com/en-us/azure/well-architected/reliability/
• Security: https://learn.microsoft.com/en-us/azure/well-architected/security/
• Cost Optimization: https://learn.microsoft.com/en-us/azure/well-architected/cost-optimization/
• Operational Excellence: https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/
• Performance Efficiency: https://learn.microsoft.com/en-us/azure/well-architected/performance-efficiency/

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: ricmmartins
• Source: ricmmartins/azure-sre-agent-skills
• License: MIT

Install and usage instructions live in the source repository linked above.