I built an open-source tool for running ARG governance checks on a schedule and tracking findings
Most of the Azure governance work I have done over the last ten years ended the same way. Someone writes a sharp Resource Graph query, it finds something real, it gets pasted into a chat, and then it lives in that person's terminal history until they move on. The failure that costs more is quieter. A check that stops running does not turn red. It stays green, and the estate keeps drifting behind a number that nobody has any reason to distrust. Disclosure before I name anything: I built the tool below and I maintain it. RuleBeat runs the governance checks your team writes for Azure on a schedule, tracks every finding over time, and never holds write access. A check is a rule you author against Azure Resource Graph or Microsoft Graph, in a visual builder or as raw KQL. It ships 158 checks out of the box, 15 built-in rules plus the 143-rule APRL pack. Findings keep their lifecycle across scans, so they move through new, active and fixed and reopen on their own, and a suppression needs a reason and can carry an expiry date. The trade-offs, so nobody has to discover them after installing: - Read-only, permanently. It never holds write credentials and never creates its own service principal. You create the credential, so you can see in Azure RBAC exactly what it was granted. The cost is real: there is no one-click fix. Remediation stays your action under your own identity. - Self-hosted, one container, SQLite inside. Nothing about your tenant leaves your deployment and there is no telemetry. The cost is that you run it. Demo mode runs the real UI over a generated database with no Azure credential, if you would rather look before wiring anything up. - Honest numbers. A rule that has never run, or whose last run failed, is reported as unknown rather than passing. The posture number is uglier for it, and that is the point. On where this does and does not belong next to the native stack: Azure Policy is for enforcing a standard, and it does that better than anything I would write. Defender for Cloud covers its own scope well. If your assignments are enforcing, your Workbook answers the question you actually ask, and one person owns the whole loop, you do not need this. Where I kept running out of road was the organization-specific check that no built-in standard covers, and the question of who owns a flagged row once more than one person has to care about it. It is open source under Apache-2.0 and free, and it is v0.2, early on purpose. I build it with AI assistance from Claude, which the public commit history shows in the co-author trailers, and every change is human-reviewed and gated by the test suite in CI before it ships. Repo: https://github.com/rulebeat/rulebeat Docs: https://docs.rulebeat.com The question I would rather ask than answer: for those of you running recurring governance checks today, what do you do with a finding that is accepted on purpose? Every version of this I have seen was a tag, a wiki page, or a spreadsheet, and all three drift away from the query that produced them. I would like to know what has actually held up for you.
Deploying access packages as code
I know Microsoft graph can be used to automatically create access packages in Azure AD however it would be useful if a Terraform registry would eventually become available to deploy access packages using Terraform so you can manage your access packages in code. #AzureAD #IAC #accesspackages
Azure Resource Graph query to get subscription properties
I am very new to ARG queries. I am struggling to figure out how to get a list of our Azure Subscriptions using ARG, including some of the properties you see on the properties pane when using the azure portal. In particular, I want the property visually labelled "ACCOUNT ADMIN". Can anyone point me in the right direction? resourcecontainers | where type == 'microsoft.resources/subscriptions' | project subscriptionId, name, owner = ???
Microsoft's inconsistent implementation of tagging in Azure
We revamped our Azure resource tagging strategy several years ago and rely on them heavily for #Governance and #FinOps. We not only enforce #tags via #AzurePolicy, we also enforce tag values based on a set of permissible values for each tag. Even with that in place we experience some drift due to exclusions required in the policy definition or exemptions in the policy assignments. I won't get into why this flexibility is needed here, that's a whole separate discussion. Establishing a sound tag hygiene process becomes a vital component of your overall governance and FinOps strategies. One method we employ for tag hygiene is to surface the non-compliant resources in a #PowerBi report using an #AzureResourceGraph (ARG) query. Yes, you can do this in the Compliance section of Azure Policy as well however it lacks ease of use. For example, flipping back and forth between policies, filtering by subscriptions, surfacing other linked metadata is a cumbersome experience in the Azure Policy blade. Now onto my frustrations with how Microsoft has implemented tagging across Azure. 1. Inconsistent application of Tag case-sensitivity across tools - In Azure Policy and in the Azure portal, tag names are case-insensitive whereas tag values are case-sensitive. - In Azure Resource Graph Explorer, both tag names and tag values are case-sensitive. - Why is there inconsistency with case-sensitivity of tag names? 2. Inconsistent Tag validation across Resource Types - When deploying a Storage Account, Azure validates my tag policy before I am able to hit the create button (before it's submitted to ARM) whereas when deploying a resource like a Public IP Address, that validation only occurs after you hit the create button. This likely happens with other resource types as well. By the way, my tagging policy specifies "Indexed" for mode, so in effect it should apply to any and all resources that support tagging in Azure. - Why is does the evaluation of the tag policy differ based on the resource being deployed? 3. Inconsistent Tag UX across Resource Types - When deploying a Storage Account, the tags input is a drop-down list. However, when deploying an Azure Virtual Machine, the tags input is a textbox. Although the latter makes use of predictive text, it's still clearly a different experience. This inconsistency is found across multiple Azure resources. - Why is the tag UX different between resource types? I realize some of this is addressed or is less of a concern when using IaC but that may not be for everyone, or work in all scenarios. It would be great if Microsoft could standardize their implementation of tagging resources uniformly across the entire Azure estate. In my opinion I don't think that's a huge ask.
Resource Graph RateLimiting
When running some resource graph queries inside a Function App I get RateLimiting error: error in resourceGraphFunction (RateLimiting) Please provide below info when asking for support: timestamp = 2024-01-02T16:10:29.7151093Z, correlationId = bf7ffdce-2c00-49f9-8171-0a682d3e6966. Code: RateLimiting Message: Please provide below info when asking for support: timestamp = 2024-01-02T16:10:29.7151093Z, correlationId = bf7ffdce-2c00-49f9-8171-0a682d3e6966. Exception Details: (RateLimiting) Client application has been throttled and should not attempt to repeat the request until an amount of time has elapsed. Please see Overview of Azure Resource Graph - Azure Resource Graph for help. Code: RateLimiting Message: Client application has been throttled and should not attempt to repeat the request until an amount of time has elapsed. Please see Overview of Azure Resource Graph - Azure Resource Graph for help. This error is not very frequent and not easily reproducible, I'm using the following python code to reproduce the issue. import azure.functions as func import azure.mgmt.resourcegraph as arg from azure.identity import DefaultAzureCredential import datetime def custom_res(pipeline_response, deserialized, *kwargs): resource = deserialized quota_remaining = None quota_resets_after = None try: headers = pipeline_response.http_response.internal_response.headers quota_remaining = headers._store['x-ms-user-quota-remaining'] quota_resets_after = headers._store['x-ms-user-quota-resets-after'] status_code = pipeline_response.http_response.status_code except AttributeError: pass setattr(resource, 'x-ms-user-quota-remaining', quota_remaining) setattr(resource, 'x-ms-user-quota-resets-after', quota_resets_after) setattr(resource, 'status_code', status_code) return resource def getPagedResources(sub_id, strQuery): subsList = [] if len(sub_id) > 0: subsList.append(sub_id) arg_result_arr = [] skip_num = 0 result_limit = 1000 while(True): argQueryOptions = arg.models.QueryRequestOptions(result_format="objectArray", top=result_limit, skip=skip_num) argQuery = arg.models.QueryRequest(subscriptions=subsList, query=strQuery, options=argQueryOptions) # Run query argResults = argClient.resources(argQuery, cls=custom_res) log.info(f"time: {datetime.datetime.now()}, remaining: {getattr(argResults, 'x-ms-user-quota-remaining', None)[1]}, status_code: {argResults.status_code}, reset_time: {getattr(argResults, 'x-ms-user-quota-resets-after', None)[1]}, skip_num: {skip_num}") if not argResults.data: break if not arg_result_arr: arg_result_arr = argResults.data else: arg_result_arr = arg_result_arr + argResults.data skip_num = skip_num + result_limit return arg_result_arr def main(req: func.HttpRequest) -> func.HttpResponse: qry = "resources" try: for i in range(20): res = getPagedResources('123-456-789-34343',qry) except Exception as err: log.error(f"error: {err}") Output: Even if the user-quota-remaining is 0, I don't get the RateLimit error that I sometimes get. Is there any way to reproduce the issue or any fix for it ?
Azure Resource Graph - get all functions of a function app
Hi, I'm new with Azure Resource Graph, and I'm trying to get all the functions from a function app. Firstly, I created a query to get the function apps : resources | where type == 'microsoft.web/sites' | where properties['kind'] == 'functionapp' Then I searched in the function app properties if functions were listed, but there are no information about it. So, I inspected the JSON definition of one function contained in a function app, and the type of the resource is "Microsoft.Web/sites/functions". But when I run a query using the type I get no results. How should I do to get the functions contained in a function app using Azure Resource Graph ? Thank you
