Governance Reporting¶
Four read-only tools take regular snapshots of the tenant's governance state: its hierarchy, policy, access and privileged roles. They change nothing. Their job is to make drift, unwanted access and unenforced controls visible so someone can act on them.
Status: in place
The tools¶
| Tool | What it produces | How it runs | Audience |
|---|---|---|---|
AzGovViz (azure-governance-azgovviz) |
A full snapshot of the management group hierarchy, policy and compliance, RBAC, resources, diagnostics and cost, as HTML, CSV and JSON | Scheduled GitLab pipeline, intended daily. Output is kept as pipeline artefacts. | Platform and governance engineers |
AzGovViz Analyzer (azure-governance-azgovviz-analyzer) |
Plain-language risk reports built from AzGovViz exports, grouped into pillars (identity and access, policy, network, security posture, secure score). Published as a versioned MkDocs site. | Weekly, with AI-assisted analysis in VS Code | Platform lead, security, management |
RBAC extract (azure-rbac-extract) |
Every role assignment in the tenant, flagged against CAF identity guidance | Run by hand from a workstation (rbac-audit.ps1) |
Engineers doing an access review |
Entra role governance reports (entra-role-governance-reports) |
Members of privileged Entra roles and PAG eligibility, as JSON, CSV and Markdown, published to GitLab Pages | Scheduled daily | Security and access reviewers |
What the RBAC extract flags¶
| Flag | Meaning |
|---|---|
DIRECT_USER_ASSIGNMENT |
A role is assigned to a user, not a group |
ORPHANED_PRINCIPAL |
The assignee no longer exists in Entra ID |
OWNER_AT_SUBSCRIPTION_SCOPE |
Owner is assigned at subscription scope instead of management group scope |
ASSIGNMENT_AT_TENANT_ROOT |
Anything assigned at /. Outside break-glass, this should be empty. |
SP_OWNER_BELOW_MG |
A service principal has Owner at subscription scope or below |
Using the output¶
- Weekly: read the analyzer report. Treat any new red finding as a task.
- Before an access review: run the RBAC extract and use the Entra role reports as the list of who holds what.
- After a platform change: compare the next AzGovViz run with the previous one to confirm the change had only the intended effect.
Known limitations¶
- No history for Entra role reports. Each run replaces the previous one. For trends, keep your own copies or use the analyzer's versioned reports.
- Results depend on scope. Every tool sees only what its identity can read. If a reporting identity loses access to part of the tenant, results change without any change to the tenant. See why the Secure Score jumps.
- Findings are only as good as the follow-up. Nothing turns report findings into tickets automatically.