azqr

Azure Quick Review

Azure Quick Review (azqr) is a powerful command-line interface (CLI) tool that specializes in analyzing Azure resources to ensure compliance with Azure's best practices and recommendations. Its main objective is to offer users a comprehensive overview of their Azure resources, allowing them to easily identify any non-compliant configurations or areas for improvement.

Azure Quick Review Recommendations

Azure Quick Review (azqr) scans your resources with 2 types of recommendations:

• Azure Resource Graph (ARG) queries provided by the Azure Proactive Resiliency Library v2 (APRL) and the Azure Orphaned Resources (https://github.com/dolevshor/azure-orphan-resources) projects
• Azure Resource Manager (ARM) rules built with the Azure Golang SDK

To learn more about the recommendations used by Azure Quick Review (azqr), you can refer to the documentation available here.

Scan Results

The output generated by Azure Quick Review (azqr) is written by default to an Excel file, which contains the following sheets:

Core Sheets (always generated)

• Recommendations: Action plan listing all recommendations with the count of impacted resources.
• ImpactedResources: Resources that have issues to address.
• ResourceTypes: Summary of impacted resource types.
• Inventory: All scanned resources with details (SKU, Tier, Kind, calculated SLA).
• OutOfScope: Resources that were not scanned.

Optional Sheets (enabled by default)

• Advisor: Recommendations from Azure Advisor. Disable with --stages -advisor.
• Defender: Microsoft Defender for Cloud plans and tiers. Disable with --stages -defender.

Optional Sheets (disabled by default)

• DefenderRecommendations: Defender for Cloud recommendations. Enable with --stages defender-recommendations.
• Azure Policy: Non-compliant resources based on Azure Policy. Enable with --stages policy.
• Arc SQL: Azure Arc-enabled SQL Server instances. Enable with --stages arc.
• Costs: Cost data for the last calendar month. Enable with --stages cost.

By default, Azure Quick Review (azqr) obfuscates the Subscription Ids in the output to ensure the protection of sensitive information and maintain data privacy and security. If you want to display the Subscription Ids without obfuscation, you can use the --mask=false flag when executing the tool.

Azure Quick Review can also generate an csv files with the same information as the excel. To generate the csv files, you can use the --csv flag when running the tool.

Supported Azure Services

Click to expand supported services (70+ resource types)

For the full list of resource type abbreviations used in filters, see the Overview documentation.

Installation

Linux / Azure Cloud Shell

bash -c "$(curl -fsSL https://raw.githubusercontent.com/azure/azqr/main/scripts/install.sh)"

To install the latest preview (pre-release) version:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/azure/azqr/main/scripts/install.sh)" -- --preview

Windows

winget install azqr

Or via PowerShell:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/azure/azqr/main/scripts/install.ps1'))

To install the latest preview (pre-release) version via PowerShell:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex "& { $(iwr -useb 'https://raw.githubusercontent.com/azure/azqr/main/scripts/install.ps1') } -Preview"

macOS

brew install azqr

Or download the latest release from the releases page.

Quick Start

# 1. Login to Azure
az login

# 2. Run a scan (scans all accessible subscriptions)
azqr scan

The scan generates an Excel report with recommendations, impacted resources, and an action plan.

Usage

Authentication

Azure Quick Review (azqr) supports the following authentication methods:

• Service Principal. You'll need to set the following environment variables:
  • AZURE_CLIENT_ID
  • AZURE_CLIENT_SECRET
  • AZURE_TENANT_ID
• Azure Managed Identity
• Azure CLI (Using this type of authentication will make scans run slower)

Security recommendation: AZURE_CLIENT_SECRET is a credential and must not be stored in plaintext (e.g. committed to source control, hardcoded in scripts, or set directly in shared configuration files). Store it in a secure secret store, such as GitHub Actions secrets, Azure DevOps secret variables/variable groups, or Azure Key Vault, and inject it into the environment at runtime. Where possible, prefer Managed Identity or Workload Identity Federation (OIDC) over a service principal secret to avoid storing long-lived credentials altogether.

Credential Chain Configuration

Azure Quick Review (azqr) uses the Azure SDK's DefaultAzureCredential which automatically selects the most appropriate credential based on your environment. By default, it tries credentials in order: environment variables, workload identity, managed identity, Azure CLI, and Azure Developer CLI.

You can customize this behavior by setting the AZURE_TOKEN_CREDENTIALS environment variable:

• dev - Prioritize Azure CLI (az) or Azure Developer CLI (azd) credentials (recommended for local development)
• prod - Prioritize environment variables, workload identity, or managed identity (recommended for CI/CD and production)

Authorization

Azure Quick Review (azqr) requires the following permissions:

• Reader over Subscription or Management Group scope (required for all scans)

Cloud Configuration

Azure Quick Review (azqr) supports scanning resources in different Azure cloud environments including Azure Public Cloud, Azure Government, Azure China, and custom cloud configurations.

You can configure the target cloud using environment variables such as AZURE_CLOUD, AZURE_AUTHORITY_HOST, AZURE_RESOURCE_MANAGER_ENDPOINT, and AZURE_RESOURCE_MANAGER_AUDIENCE.

For detailed cloud configuration options and examples, see the Usage section in the documentation.

Running Scans

To find your subscription ID, run az account list --output table.

# Scan all accessible subscriptions
azqr scan

# Scan a specific subscription
azqr scan --subscription-id 

# Scan a management group
azqr scan --management-group-id 

# Scan specific resource group(s)
azqr scan --subscription-id  --resource-group 

# Scan multiple subscriptions
azqr scan --subscription-id  --subscription-id 

# Custom output filename
azqr scan --output-name my-report

# Output as JSON or CSV
azqr scan --json
azqr scan --csv

Run azqr -h for all available commands and options.

Controlling Scan Stages

Azure Quick Review allows you to control which scan stages are executed. By default, diagnostics, advisor, and defender stages are enabled.

Available Stages

• advisor: Azure Advisor recommendations
• defender: Microsoft Defender for Cloud status
• defender-recommendations: Micros