Things I built because they were missing.

Finds forgotten Entra ID app registrations: expired secrets, unused service principals, orphaned owners.

Typical output

Lists every Azure VM whose NIC or subnet has no network security group attached — the gap nobody notices until an audit.

Typical output

Inventories the operating systems actually running on your VMs, including the ones nobody remembers deploying.

Typical output

One Bicep deployment stands up the whole image platform: Compute Gallery, image definitions, Image Builder templates and the recurring build schedule. Azure Image Builder does the build — this adds the scheduling, scoped RBAC and gallery management it does not ship with.

monthly schedule · no Packer, no build agents

Each VM carries its own schedule as a tag — AutoShutdown = 8-18. An hourly runbook scans every subscription the identity can see and decides per VM whether to start or stop it. No action parameter, no separate morning and evening schedules.

per-VM time zone · weekday, date and temporary skip rules

A user shuts a VM down from inside the OS — which leaves it stopped, still billing. An Activity Log alert catches exactly that event and a Logic App finishes the job by deallocating it. Users keep their habits, the charges stop.

filtered on UserInitiated · managed identity, no credentials

A web form where someone picks VM or AVD, OS, domain join and Entra login. A Logic App validates the UPN and drops the request on a queue, a Function App picks it up and deploys a nested ARM template. Nobody needs portal access to get a machine.

managed identities throughout · secrets in Key Vault