Azure Quick Review

Azure Quick Review (azqr) is a powerful command-line interface (CLI) tool that specializes in analyzing Azure resources to ensure compliance with Azure's best practices and recommendations. Its main objective is to offer users a comprehensive overview of their Azure resources, allowing them to easily identify any non-compliant configurations or areas for improvement.

Azure Quick Review Recommendations

Azure Quick Review (azqr) scans your resources with 2 types of recommendations:

• Azure Resource Graph (ARG) queries provided by the Azure Proactive Resiliency Library v2 (APRL) and the Azure Orphaned Resources (https://github.com/dolevshor/azure-orphan-resources) projects
• Azure Resource Manager (ARM) rules built with the Azure Golang SDK

To learn more about the recommendations used by Azure Quick Review (azqr), you can refer to the documentation available here.

Scan Results

The output generated by Azure Quick Review (azqr) is written by default to an Excel file, which contains the following sheets:

Core Sheets (always generated)

• Recommendations: Action plan listing all recommendations with the count of impacted resources.
• ImpactedResources: Resources that have issues to address.
• ResourceTypes: Summary of impacted resource types.
• Inventory: All scanned resources with details (SKU, Tier, Kind, calculated SLA).
• OutOfScope: Resources that were not scanned.

Optional Sheets (enabled by default)

• Advisor: Recommendations from Azure Advisor. Disable with --stages -advisor.
• Defender: Microsoft Defender for Cloud plans and tiers. Disable with --stages -defender.

Optional Sheets (disabled by default)

• DefenderRecommendations: Defender for Cloud recommendations. Enable with --stages defender-recommendations.
• Azure Policy: Non-compliant resources based on Azure Policy. Enable with --stages policy.
• Arc SQL: Azure Arc-enabled SQL Server instances. Enable with --stages arc.
• Costs: Cost data for the last calendar month. Enable with --stages cost.

By default, Azure Quick Review (azqr) obfuscates the Subscription Ids in the output to ensure the protection of sensitive information and maintain data privacy and security. If you want to display the Subscription Ids without obfuscation, you can use the --mask=false flag when executing the tool.

Azure Quick Review can also generate an csv files with the same information as the excel. To generate the csv files, you can use the --csv flag when running the tool.

Supported Azure Services

Click to expand supported services (70+ resource types)

For the full list of resource type abbreviations used in filters, see the Overview documentation.

Installation

Linux / Azure Cloud Shell

bash -c "$(curl -fsSL https://raw.githubusercontent.com/azure/azqr/main/scripts/install.sh)"

Windows

winget install azqr

Or via PowerShell:

Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/azure/azqr/main/scripts/install.ps1'))

macOS

brew install azqr

Or download the latest release from the releases page.

Quick Start

# 1. Login to Azure
az login

# 2. Run a scan (scans all accessible subscriptions)
azqr scan

# 3. View results in interactive dashboard
azqr show -f azqr_action_plan_*.xlsx --open

The scan generates an Excel report with recommendations, impacted resources, and an action plan.

Usage

Authentication

Azure Quick Review (azqr) supports the following authentication methods:

• Service Principal. You'll need to set the following environment variables:
• AZURE_CLIENT_ID
• AZURE_CLIENT_SECRET
• AZURE_TENANT_ID
• Azure Managed Identity
• Azure CLI (Using this type of authentication will make scans run slower)

Credential Chain Configuration

Azure Quick Review (azqr) uses the Azure SDK's DefaultAzureCredential which automatically selects the most appropriate credential based on your environment. By default, it tries credentials in order: environment variables, workload identity, managed identity, Azure CLI, and Azure Developer CLI.

You can customize this behavior by setting the AZURE_TOKEN_CREDENTIALS environment variable:

• dev - Prioritize Azure CLI (az) or Azure Developer CLI (azd) credentials (recommended for local development)
• prod - Prioritize environment variables, workload identity, or managed identity (recommended for CI/CD and production)

Authorization

Azure Quick Review (azqr) requires the following permissions:

• Reader over Subscription or Management Group scope (required for all scans)

Cloud Configuration

Azure Quick Review (azqr) supports scanning resources in different Azure cloud environments including Azure Public Cloud, Azure Government, Azure China, and custom cloud configurations.

You can configure the target cloud using environment variables such as AZURE_CLOUD, AZURE_AUTHORITY_HOST, AZURE_RESOURCE_MANAGER_ENDPOINT, and AZURE_RESOURCE_MANAGER_AUDIENCE.

For detailed cloud configuration options and examples, see the Usage section in the documentation.

Running Scans

To find your subscription ID, run az account list --output table.

# Scan all accessible subscriptions
azqr scan

# Scan a specific subscription
azqr scan --subscription-id <subscription_id>

# Scan a management group
azqr scan --management-group-id <management_group_id>

# Scan specific resource group(s)
azqr scan --subscription-id <sub_id> --resource-group <rg_name>

# Scan multiple subscriptions
azqr scan --subscription-id <sub_1> --subscription-id <sub_2>

# Custom output filename
azqr scan --output-name my-report

# Output as JSON or CSV
azqr scan --json
azqr scan --csv

Run azqr -h for all available commands and options.

Interactive Dashboard (show command)

You can explore your scan results with a lightweight embedded web UI using the show command. The dashboard supports both Excel and JSON report formats:

1. Generate a report (Excel or JSON):

# Excel format (default)
azqr scan --subscription-id <subscription_id> --output-name report

# JSON format
azqr scan --subscription-id <subscription_id> --output-name report --json

1. Launch the dashboard:

# With Excel file
azqr show -f report.xlsx --open

# With JSON file
azqr show -f report.json --open

Controlling Scan Stages

Azure Quick Review allows you to control which scan stages are executed. By default, diagnostics, advisor, and defender stages are enabled.

Available Stages

• advisor: Azure Advisor recommendations
• defender: Microsoft Defender for Cloud status
• defender-recommendations: Microsoft Defender for Cloud recommendations
• arc: Azure Arc-enabled SQL Server instances
• policy: Azure Policy compliance states
• cost: Cost analysis for the last 3 months
• diagnostics: Diagnostic settings scan

Stage Control Examples

# Enable specific stages (replaces defaults)
azqr scan --stages cost --stages policy

# Disable specific stages (keeps other defaults)
azqr scan --stages -diagnostics

# Enable all stages
azqr scan --stages advisor --stages defender --stages defender-recommendations --stages arc --stages policy --stages cost --stages diagnostics

# Disable cost stage only (if you lack permissions)
azqr scan --stages -cost

Advanced Features

Azure Quick Review includes optional internal plugins that provide advanced analytics beyond standard recommendations. Plugins can be run as standalone commands for faster execution or integrated with full scans.

OpenAI Throttling Monitor

Monitors Azure OpenAI and Cognitive Services accounts for throttling (HTTP 429 errors) to identify capacity constraints.

• Tracks throttling by hour, model, and deployment
• Analyzes spillover configuration effectiveness
• Reports request counts by status code

Use Cases: Capacity