Assessment Prerequisites
These prerequisites are specific to the CAF/WAF assessment platform (Invoke-AzureScout -Assessment, Test-ScoutPermission). They are additional to — not a replacement for — the inventory-mode prerequisites in Prerequisites & Required Modules.
PowerShell 7 is a hard requirement
Every assessment script starts with #Requires -Version 7.0, and the module manifest declares PowerShellVersion = '7.0' with CompatiblePSEditions = @('Core') — so Windows PowerShell 5.1 cannot import AzureScout at all, in either mode. Invoke-AzureScout also throws on Desktop as a second guard. Run everything in pwsh.
System requirements
| Requirement | Details |
|---|---|
| PowerShell | 7.0.3+ (source: pmo/plans/master-plan.md §10) |
| Operating System | Windows, Linux, or macOS — the platform is pure PowerShell/.NET |
| .NET SDK | Not required for live outputs. The held PowerPoint renderer's implementation uses it; see below |
git | Required only if you opt an assessment into the legacy AzGovViz ingestor instead of the native Governance default (see Auth & permissions) — used to shallow-clone the Azure Governance Visualizer tool at first use. Not needed by any assessment out of the box. |
Required PowerShell modules
Optional dependencies are not declared as core requirements
AzureScout's manifest (AzureScout.psd1) declares ImportExcel, Az.Accounts, Az.ResourceGraph, Az.Storage, Az.Compute, Az.Resources, powershell-yaml, and Az.Advisor. PowerShellGet resolves them when AzureScout is installed from the Gallery. Importing a local clone does not install them. Optional integrations such as cost collection and the legacy Azure Governance Visualizer still have separate dependencies; install those only when you enable the corresponding feature.
| Module | Purpose | Required for | Declared by AzureScout.psd1? |
|---|---|---|---|
Az.Accounts | Authentication / token acquisition | All | Yes |
Az.ResourceGraph | The Collect layer's Resource Graph queries | All | Yes |
Az.Resources | Role assignment reads (permission pre-flight) | All | Yes |
powershell-yaml | Parses the caf.*/waf.* rule YAML files (Get-RuleSet) | All scoring (any assessment with Rules) | Yes |
Az.Advisor | Get-AzAdvisorRecommendation, used by the AdvisorScores ingest | Assessments whose Ingest includes AdvisorScores (CAF: Azure Landing Zone, Management, Security, Compute, Scout: Cost Optimization) | Yes |
ImportExcel | Package dependency retained for the held Excel renderer and legacy workbook tests | No live output format | Yes |
AzAPICall | Dependency of the third-party Azure Governance Visualizer | Assessments whose Ingest includes AzGovViz | No — Import-AzGovViz.ps1 installs it itself at first use (Install-Module AzAPICall -Scope CurrentUser -Force) if not already present |
Az.Security is documented, not yet wired up
pmo/plans/master-plan.md §10 and src/README.md list Az.Security as a dependency, but no current assessment code calls an Az.Security cmdlet — Security-category rules read collect.security.defenderPlans, which the Collect layer (Invoke-Collect.ps1) currently always returns empty (@()). Installing it does no harm, but it is not load-bearing for any assessment today.
Held PowerPoint renderer — .NET SDK, not Python
The Pptx renderer is on hold and does not emit an executive deck in a live run. Its retained implementation uses the OpenXML SDK (DocumentFormat.OpenXml), not python-pptx and not PowerPoint COM automation—see the accepted decision record, PPTX executive-deck renderer.
No Python required
Earlier design drafts specced a python3 + python-pptx shell-out for the PPTX tier. That was superseded — src/report/renderers/Export-Pptx.ps1 is pure PowerShell/.NET today. You do not need Python installed anywhere in the pipeline for any output format.
What the retained Export-Pptx.ps1 implementation needs when its internal tests exercise it:
- On first use, it checks for a cached copy of
DocumentFormat.OpenXml3.0.2 (and its transitive dependencies) underoutput/.tools/openxml/3.0.2/. - If not cached, it requires the
dotnetCLI onPATH— it shells out todotnet buildagainst a throwaway class-library project that references the NuGet package, which resolves and downloads the assembly graph via NuGet/MSBuild, then caches the three resulting DLLs. - Every later run (same machine) loads the cached DLLs via
Add-Type -Path— no network access, nodotnetneeded once the cache is warm. - If
dotnetis not onPATHand nothing is cached, the held renderer's direct/internal use throws a clear error.
# Only needed when developing or directly testing the held Pptx renderer
dotnet --versionsrc/README.md is stale
src/README.md's Dependencies table still lists python3 + python-pptx for the PPTX tier. That reflects an earlier prototype (src/report/renderers/Export-Pptx.ps1 pre-AB#5044) and does not match the accepted, implemented renderer described above and in the decision record. Trust this page and the decision record, not src/README.md, for the PPTX tier.
What the Estate assessment does NOT need
The Estate assessment (-Assessment Estate) is inventory-only — it has no Rules, so it never calls Get-RuleSet and therefore never needs powershell-yaml. It still runs under PowerShell 7 through the same Invoke-AzureScout entry point, so the PS7 requirement above still applies even though it doesn't score anything.