Azure Sweep

Skill: azure-sweep

Runs the full 8-layer Azure governance sweep using the Azure Sweeper agent.

Description

Executes a prioritised compliance sweep across WAF, CAF, Landing Zone, Policy, Org Rules, Resource Graph, Telemetry, and Remediation layers. Outputs a structured findings report with Bicep, Terraform, and CLI remediation code.

When to Use

• Before a production deployment
• After an environment is provisioned
• During quarterly compliance reviews
• When Advisor or Defender alerts spike
• When onboarding an existing subscription into CAF governance

Prerequisites

| Requirement | Check | |-------------|-------| | Azure CLI authenticated | az account show | | Correct subscription selected | az account set --subscription | | Resource Graph extension installed | az extension add --name resource-graph | | Instruction files present | presets/azure-iac/.github/instructions/ | | Org rules initialised (optional) | .github/instructions/org-rules.instructions.md |

Steps

Step 0 — Scope & Setup

Confirm scope before running:

# Set scope variables
$subscriptionId = (az account show --query id -o tsv)
$rg = ""   # or "ALL" for subscription-wide

Write-Host "Sweeping subscription: $subscriptionId"
Write-Host "Resource group scope: $rg"

---

Step 1 — WAF Layer

# Fetch Azure Advisor WAF recommendations
az advisor recommendation list `
  --filter "Category eq 'HighAvailability' or Category eq 'Security' or Category eq 'Cost' or Category eq 'OperationalExcellence' or Category eq 'Performance'" `
  --output json | ConvertFrom-Json | `
  Select-Object category, impact, shortDescription, resourceMetadata

Pass gate: No CRITICAL Advisor items in Reliability or Security pillars.

---

Step 2 — CAF Layer

# Management group placement
az account management-group list --output table

# Tag compliance per resource group
az group list --query "[].{RG:name, Tags:tags}" --output json | ConvertFrom-Json | `
  Where-Object { -not $_.Tags.Environment -or -not $_.Tags.Owner -or -not $_.Tags.CostCenter }

Pass gate: All resource groups have mandatory tags. Subscription is in correct MG tier.

---

Step 3 — Landing Zone Layer

# Standing privileged assignments
az role assignment list `
  --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='Contributor' || roleDefinitionName=='User Access Administrator']" `
  --subscription $subscriptionId `
  --output table

# Subnets without NSG
az network vnet list `
  --query "[].subnets[?networkSecurityGroup==null].{Name:name, VNet:id}" `
  --output table

# Defender tiers
az security pricing list `
  --query "[?pricingTier=='Free'].name" `
  --output tsv

Pass gate: No standing Owner/Contributor. All subnets have NSG. Key Defender plans on Standard.

---

Step 4 — Policy Layer

# Non-compliance count
$nonCompliantCount = az policy state list `
  --subscription $subscriptionId `
  --filter "complianceState eq 'NonCompliant'" `
  --query "length(@)" `
  --output tsv

# Per-policy breakdown
az policy state list `
  --subscription $subscriptionId `
  --filter "complianceState eq 'NonCompliant'" `
  --query "[].{Resource:resourceId, Policy:policyAssignmentName}" `
  --output table

Write-Host "Non-compliant resources: $nonCompliantCount"

Pass gate: Non-compliant count 30 days.

---

Step 8 — Remediation Code Generation

After collecting all findings, the Azure Sweeper agent generates:

1. Prioritised finding list — ordered CRITICAL → LOW
2. Remediation code for each HIGH/CRITICAL finding in Bicep, Terraform, and/or CLI
3. Impact statement — security, cost, compliance impact per fix

---

Output

Temper Guards

| Shortcut | Why It Breaks | |----------|--------------| | "Advisor recommendations are just suggestions" | Advisor findings reflect real configuration risks. Dismissing them without review means accepting unknown exposure. | | "Policy non-compliance is an IT problem" | Policy violations block deployments and trigger audit findings. Engineering owns compliance for their resources. | | "The secure score is close enough" | Each point of secure score represents a concrete hardening action. "Close enough" means known vulnerabilities remain open. | | "Orphaned resources don't cost much" | Orphaned disks, IPs, and NICs accumulate cost and expand attack surface. Clean them up or document the exception. |

Warning Signs

• Sweep layers skipped — not all 7+ layers were evaluated (WAF, CAF, Landing Zone, Policy, Org, Resource Graph, Telemetry)
• Critical findings downgraded — HIGH/CRITICAL findings reclassified without justification
• Remediation code not generated — findings reported but no fix provided (Bicep/Terraform/CLI)
• Sweep run on wrong subscription — results don't match the target environment
• Pass/fail thresholds overridden — thresholds changed to force a passing result

Exit Proof

After completing this skill, confirm:

• [ ] All sweep layers executed (WAF, CAF, Landing Zone, Policy, Org Rules, Resource Graph, Telemetry)
• [ ] Every CRITICAL/HIGH finding has remediation code or documented exception
• [ ] Sweep report generated — azure-sweep-report--.md
• [ ] Secure Score reviewed and meets threshold (≥ 70%)
• [ ] Overall pass/fail status documented with justification

Persistent Memory (if OpenBrain is configured)

• Before sweeping: search_thoughts("azure sweep findings", project: "", created_by: "copilot-vscode", type: "convention") — load prior sweep findings, accepted risks, and remediation patterns
• After sweep completes: capture_thought("Azure sweep: ", project: "", created_by: "copilot-vscode", source: "skill-azure-sweep") — persist sweep results for trend tracking across runs

The skill produces a markdown sweep report:

azure-sweep-report--.md

Stored at the workspace root or specified output path.

---

Pass/Fail Summary

| Layer | Pass Condition | |-------|---------------| | WAF | No CRITICAL Adviser items in Reliability/Security | | CAF | All RGs tagged; subscription in correct MG tier | | Landing Zone | No standing access; NSGs on all subnets; Defender Standard on key services | | Policy | Non-compliant < 5%; no CRITICAL policy violations | | Org Rules | All resources comply with org-rules.instructions.md | | Resource Graph | No orphaned disks; no public storage; no stray public IPs | | Telemetry | Secure Score ≥ 70%; no undismissed Critical alerts |

Overall PASS: All 7 layers pass. Overall WARN: 1-2 layers have medium findings only. Overall FAIL: Any CRITICAL/HIGH finding unresolved.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: srnichols
• Source: srnichols/plan-forge
• License: MIT

Install and usage instructions live in the source repository linked above.