AzureScoutSee everything. Own your cloud.

One PowerShell command that inventories your entire Azure estate — and scores it against CAF and WAF. Read-only, offline-capable, no agents.

Get started

What it assesses

View on GitHub

Two modes, one command

Run bare for a wide inventory of everything in the tenant. Add -Assessment for a scored CAF/WAF review. Run with no parameters at all and a guided wizard walks you through it.

How the modes differ

245 collectors, 18 categories

Every one of Microsoft's eighteen published service categories, from AI and Analytics through to Storage and Web — plus Entra ID identity objects via Microsoft Graph.

Browse the collectors

46 assessments

CAF design areas, WAF pillars, workload reviews, FinOps, DevOps and compliance — each backed by declarative rule files with published automated-versus-manual counts.

Browse the assessments

Read-only, always

Scout never creates, modifies or deletes anything in your tenant. Reader at the root management group is enough, and a pre-flight audit tells you exactly what you can and cannot collect before you run.

Permissions required

One report, and it is the deliverable

The self-contained React/HTML report — inventory, every assessment, evidence and the remediation plan on one page, exporting to Markdown, JSON, CSV and PDF from the page itself. React, Json and JsonEvidence are the only live output formats in every run mode. All legacy renderers are on hold while they are rebuilt to generate from React.

Report tiers and what is on hold

Unattended by design

Azure Automation runbooks, GitHub Actions, or Azure DevOps pipelines. Managed identity or service principal, writing straight to blob storage.

Automation options

Quick start

powershell

# Install from the PowerShell Gallery
Install-Module -Name AzureScout

# Guided wizard — no parameters needed
Invoke-AzureScout

# Full inventory, ARM + Entra ID
Invoke-AzureScout -Scope All

# Scored CAF/WAF assessment
Invoke-AzureScout -Assessment 'CAF: Azure Landing Zone'

# Check what you have access to, before running anything
Invoke-AzureScout -PermissionAudit

Already signed in with Connect-AzAccount? Scout uses that session — no extra flags.

Where to go next

If you want to…	Start here
Understand the two modes and pick one	Overview
Install and run it for the first time	Guide
Know what it can assess	Assessment Catalogue
Know what it collects	ARM Modules
Work out which permissions to request	Permissions
Run it on a schedule	Automation
Add a collector or contribute	Contributing