Azure
@dougschaefer/azurev2026.07.24.3
01README
Azure infrastructure management via az CLI — 43 model types covering compute, networking, data, security, RBAC, Azure Policy, Defender for Cloud, Entra directory, monitoring, DNS, DevOps, Azure AI Foundry (accounts, model deployments, projects, quota), AI Search, Cosmos DB, PostgreSQL Flexible Server, Static Web Apps, Service Bus, Event Grid, Recovery Services, Log Analytics, subscription-wide topology with Mermaid diagrams and cost estimation, actual-spend cost analysis and waste auditing via Cost Management/Resource Graph/Advisor, and the Azure AI Vision Face REST API for identity-aware room services.
02Release Notes
2026.07.24.3 — add azure-network-watcher.setFlowLog: create or converge a flow log on a VNet, subnet, or NIC with optional Traffic Analytics, deriving the CLI target flag from the resource ID. Target virtual networks rather than NSGs; Azure blocked creation of new NSG flow logs on 2025-06-30 ahead of their 2027-09-30 retirement, and VNet flow logs supersede them with broader coverage.
03Models
@dougschaefer/azure-ad-app-registrationv2026.07.24.3azure/ad_app_registration.ts
fn list(filter?: string)
List app registrations. Optionally narrow with displayName or an OData $filter.
| Argument | Type | Description |
|---|---|---|
| filter? | string | OData filter |
fn get(id: string)
Get a single app registration by appId or object id.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn sync(id: string)
Refresh the stored state of an app registration without making changes.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn listCredentials(id: string)
List an app's credential metadata for expiry auditing. Secret values are never returned.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn listOwners(id: string)
List the owners of an app registration.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
Resources
application(infinite)— Entra ID application registration
credential(infinite)— Application password or certificate credential
owner(infinite)— Owner of an application registration
@dougschaefer/azure-ad-groupv2026.07.24.3azure/ad_group.ts
fn list()
List groups in the directory. Optionally narrow with an OData $filter.
fn get(group: string)
Get a single group by object id or display name.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
fn sync(group: string)
Refresh the stored state of a group without making changes.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
fn listMembers(group: string)
List the member principals of a group.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
fn addMember(group: string)
Add a principal (user, group, or SP) to a group.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
fn removeMember(group: string, memberId: string)
Remove a principal from a group.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
| memberId | string | Object id of the principal to remove |
fn create(displayName: string, mailNickname: string, description?: string)
Create a new Entra ID group.
| Argument | Type | Description |
|---|---|---|
| displayName | string | Group display name |
| mailNickname | string | Mail nickname (alias) |
| description? | string | Group description |
fn delete(group: string)
Delete a group by object id or display name.
| Argument | Type | Description |
|---|---|---|
| group | string | Group object id or display name |
Resources
group(infinite)— Entra ID group
member(infinite)— Member principal of a group
@dougschaefer/azure-ad-service-principalv2026.07.24.3azure/ad_service_principal.ts
fn list(filter?: string, spn?: string)
List service principals. Provide one of all/displayName/filter/spn to bound the query.
| Argument | Type | Description |
|---|---|---|
| filter? | string | OData filter |
| spn? | string | Service principal name |
fn get(id: string)
Get a single service principal by appId or object id.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn sync(id: string)
Refresh the stored state of a service principal without making changes.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn listCredentials(id: string)
List a service principal's credential metadata for expiry auditing. Secret values are never returned.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn listOwners(id: string)
List the owners of a service principal.
| Argument | Type | Description |
|---|---|---|
| id | string | Application (client) id or object id |
fn listAppRoleAssignments(id: string)
List principals (users/groups) assigned an app role on this service principal — the source of truth for who actually has access.
| Argument | Type | Description |
|---|---|---|
| id | string | Service principal object id |
fn listSynchronizationJobs(id: string)
List SCIM provisioning synchronization jobs configured on this service principal.
| Argument | Type | Description |
|---|---|---|
| id | string | Service principal object id |
Resources
servicePrincipal(infinite)— Entra ID service principal
credential(infinite)— Service principal password or certificate credential
owner(infinite)— Owner of a service principal
appRoleAssignment(infinite)— Principal (user or group) assigned an app role on a service principal
synchronizationJob(infinite)— SCIM provisioning synchronization job on a service principal
@dougschaefer/azure-ad-userv2026.07.24.3azure/ad_user.ts
fn list()
List users in the directory. Optionally narrow with an OData $filter.
fn get(id: string)
Get a single user by UPN or object id.
| Argument | Type | Description |
|---|---|---|
| id | string | User principal name or object id |
fn sync(id: string)
Refresh the stored state of a user without making changes.
| Argument | Type | Description |
|---|---|---|
| id | string | User principal name or object id |
fn getMemberGroups(id: string)
List the groups a user is a member of (for access review).
| Argument | Type | Description |
|---|---|---|
| id | string | User principal name or object id |
fn provision(displayName: string, jobTitle?: string, department?: string)
Create a directory user from non-secret profile fields via Microsoft Graph (POST /v1.0/users). A single-use temp password is generated in-process and placed in the request body (never in process arguments), the account is created with force-change-on-next-sign-in, and the password is then discarded — never an input, returned, logged, persisted, or vaulted. The method persists nothing.
| Argument | Type | Description |
|---|---|---|
| displayName | string | User display name |
| jobTitle? | string | Job title |
| department? | string | Department |
Resources
user(infinite)— Entra ID user
membership(infinite)— Group a user is a member of
@dougschaefer/azure-ai-foundryv2026.07.24.3azure/ai_foundry.ts
fn listAccounts()
List AI Services / Cognitive Services accounts in the subscription or a resource group, optionally filtered by kind (e.g. AIServices, OpenAI, Face).
fn getAccount(name: string, resourceGroup?: string)
Get a single AI Services account.
| Argument | Type | Description |
|---|---|---|
| name | string | Account name |
| resourceGroup? | string | Resource group name |
fn syncAccount(name: string, resourceGroup?: string)
Refresh the stored state of an AI Services account without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Account name |
| resourceGroup? | string | Resource group name |
fn listDeployments()
List model deployments. Name one account, or omit accountName to fan out across every AI Services account in the subscription/resource group in a single run.
fn createDeployment(accountName: string, resourceGroup?: string, deploymentName: string, modelName: string)
Deploy a model onto an AI Services account (e.g. gpt-4o on a Standard or GlobalStandard SKU). Idempotent — an existing deployment of the same name is returned instead.
| Argument | Type | Description |
|---|---|---|
| accountName | string | AI Services account name |
| resourceGroup? | string | Resource group name |
| deploymentName | string | Deployment name |
| modelName | string | Model name, e.g. gpt-4o |
fn deleteDeployment(accountName: string, resourceGroup?: string, deploymentName: string)
Delete a model deployment from an AI Services account. Idempotent — an already-absent deployment is not an error.
| Argument | Type | Description |
|---|---|---|
| accountName | string | AI Services account name |
| resourceGroup? | string | Resource group name |
| deploymentName | string | Deployment name to delete |
fn listProjects(accountName: string, resourceGroup?: string)
List Azure AI Foundry projects on an account (ARM child resource — only AIServices-kind accounts host projects).
| Argument | Type | Description |
|---|---|---|
| accountName | string | AI Services account name |
| resourceGroup? | string | Resource group name |
fn listConnections(accountName: string, resourceGroup?: string)
List Azure AI Foundry connections on an account (ARM child resource). Connection secrets are never fetched — ARM returns metadata only.
| Argument | Type | Description |
|---|---|---|
| accountName | string | AI Services account name |
| resourceGroup? | string | Resource group name |
fn listModels()
Snapshot the deployable model catalog for a region (name, version, format, SKUs, capacities) as one modelCatalog resource.
fn listUsage()
Snapshot AI Services quota usage for a region (current value vs. limit per model/SKU) as one usage resource.
Resources
account(infinite)— Azure AI Services / Cognitive Services account
deployment(infinite)— Model deployment on an AI Services account
project(infinite)— Azure AI Foundry project (ARM child resource)
connection(infinite)— Azure AI Foundry connection (ARM child resource)
modelCatalog(infinite)— Per-region snapshot of deployable models
usage(infinite)— Per-region quota/usage snapshot
@dougschaefer/azure-ai-searchv2026.07.24.3azure/ai_search.ts
fn list()
List AI Search services in a resource group, or subscription-wide via ARM when no resource group is given.
fn get(name: string, resourceGroup?: string)
Get a single AI Search service.
| Argument | Type | Description |
|---|---|---|
| name | string | Search service name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of an AI Search service without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Search service name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create an AI Search service. Idempotent — an existing service of the same name is returned instead. Note the free SKU allows one service per subscription.
| Argument | Type | Description |
|---|---|---|
| name | string | Search service name (globally unique) |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete an AI Search service and all its indexes. Idempotent — an already-absent service is not an error. Verify with get first.
| Argument | Type | Description |
|---|---|---|
| name | string | Search service name to delete |
| resourceGroup? | string | Resource group name |
Resources
service(infinite)— Azure AI Search service
@dougschaefer/azure-application-gatewayv2026.07.24.3azure/application_gateway.ts
fn list()
List all application gateways in a resource group (or subscription).
fn get(name: string, resourceGroup?: string)
Get a single application gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | Application gateway name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of an application gateway without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Application gateway name |
| resourceGroup? | string | Resource group name |
fn delete(name: string, resourceGroup?: string)
Delete an application gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | Application gateway name |
| resourceGroup? | string | Resource group name |
Resources
appGateway(infinite)— Azure Application Gateway (L7 load balancer)
@dougschaefer/azure-bastionv2026.07.24.3azure/bastion.ts
fn list()
List all Bastion hosts in the subscription.
fn get(name: string, resourceGroup?: string)
Get a single Bastion host.
| Argument | Type | Description |
|---|---|---|
| name | string | Bastion host name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a Bastion host without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Bastion host name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a Bastion host. Requires a VNet with an AzureBastionSubnet.
| Argument | Type | Description |
|---|---|---|
| name | string | Bastion host name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
fn delete(name: string, resourceGroup?: string)
Delete a Bastion host.
| Argument | Type | Description |
|---|---|---|
| name | string | Bastion host name |
| resourceGroup? | string | Resource group name |
Resources
bastion(infinite)— Azure Bastion host for secure VM access
@dougschaefer/azure-cosmosv2026.07.24.3azure/cosmos.ts
fn list()
List Cosmos DB database accounts in a resource group (or subscription).
fn get(name: string, resourceGroup?: string)
Get a single Cosmos DB database account.
| Argument | Type | Description |
|---|---|---|
| name | string | Cosmos DB account name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a Cosmos DB account without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Cosmos DB account name |
| resourceGroup? | string | Resource group name |
fn listDatabases(accountName: string, resourceGroup?: string)
List the SQL API databases under a Cosmos DB account.
| Argument | Type | Description |
|---|---|---|
| accountName | string | Cosmos DB account name |
| resourceGroup? | string | Resource group name |
fn listContainers(accountName: string, databaseName: string, resourceGroup?: string)
List the SQL API containers under a Cosmos DB SQL database.
| Argument | Type | Description |
|---|---|---|
| accountName | string | Cosmos DB account name |
| databaseName | string | SQL API database name |
| resourceGroup? | string | Resource group name |
Resources
account(infinite)— Azure Cosmos DB database account
database(infinite)— Azure Cosmos DB SQL API database
container(infinite)— Azure Cosmos DB SQL API container
@dougschaefer/azure-costv2026.07.24.3azure/cost.ts
fn queryCosts()
Query actual billed cost from Cost Management, sliced by a dimension. Group by Meter to expose silent rate changes (an added scale unit or connection unit) that a ServiceName rollup hides. Amounts are actual cost, not estimates or forecasts.
fn vmUtilization()
Measure CPU and network utilization for every VM in the subscription and classify each as idle, oversized, or right-sized. Fans out across all VMs in one execution. Network counters matter as much as CPU — a capacity-sized appliance such as a media or conferencing node sits near-idle on CPU by design, and only the traffic counters reveal whether it is actually carrying load.
fn auditNetworkSpend()
Audit whether expensive network plumbing is earning its cost. Checks that a secured-hub firewall is actually in the data path (routing intent present and data being processed), detects broad allow rules that shadow narrower rules in later-evaluated rule collection groups, compares VPN gateway scale units against observed tunnel throughput, and flags VPN links that have never carried a byte. Network transit is typically the largest and least-scrutinized line on a hub subscription.
fn findOrphans()
Sweep the subscription for resources that bill without serving anything — unattached managed disks, public IPs associated with nothing, network interfaces with no owner, and stale snapshots. Uses Resource Graph so the whole sweep is a single query rather than a per-resource-group walk.
fn advisorCostRecommendations()
Collect Azure Advisor cost recommendations and Consumption reservation recommendations. Advisor reads idle CPU without knowing workload intent, so treat its resize advice as evidence rather than instruction — and settle right-sizing before committing to any reservation, since a reservation bought against a SKU you are about to change is wasted.
Resources
costQuery(infinite)— Billed cost for a subscription, sliced by a dimension
utilization(infinite)— Observed CPU and network utilization for a virtual machine
audit(infinite)— Cost optimization findings with estimated savings
advisor(infinite)— Azure Advisor cost and reservation recommendations
@dougschaefer/azure-defenderv2026.07.24.3azure/defender.ts
fn listPricing()
List Defender for Cloud plans (Free/Standard) per resource type.
fn setPricing()
Set a Defender plan's tier (Free or Standard) for a resource type.
fn listSecureScores()
List Defender for Cloud secure scores.
fn listSecureScoreControls()
List the per-control breakdown behind the secure score.
fn listAssessments()
List Defender for Cloud security assessments (recommendations).
fn listAlerts()
List active Defender for Cloud security alerts.
Resources
pricing(infinite)— Defender for Cloud plan (pricing tier) per resource type
secureScore(infinite)— Defender for Cloud secure score
assessment(infinite)— Defender for Cloud security assessment (recommendation)
alert(infinite)— Defender for Cloud security alert (detection)
@dougschaefer/azure-devopsv2026.07.24.3azure/devops.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| organization | string | Azure DevOps organization URL. Use: ${{ vault.get('azure-devops', 'ORG_URL') }} |
fn listProjects()
List all projects in the organization.
fn getProject(project: string)
Get a single project by name.
| Argument | Type | Description |
|---|---|---|
| project | string | Project name |
fn listRepos(project?: string)
List Git repositories in a project.
| Argument | Type | Description |
|---|---|---|
| project? | string | Project name (overrides global) |
fn getRepo(repository: string, project?: string)
Get a single repository by name or ID.
| Argument | Type | Description |
|---|---|---|
| repository | string | Repository name or ID |
| project? | string | Project name (overrides global) |
fn createRepo(name: string, project?: string)
Create a new Git repository.
| Argument | Type | Description |
|---|---|---|
| name | string | Repository name |
| project? | string | Project name (overrides global) |
fn deleteRepo(id: string, project?: string)
Delete a Git repository by ID.
| Argument | Type | Description |
|---|---|---|
| id | string | Repository ID |
| project? | string | Project name (overrides global) |
fn listPipelines(project?: string)
List pipelines in a project.
| Argument | Type | Description |
|---|---|---|
| project? | string | Project name (overrides global) |
fn getPipeline(id: number, project?: string)
Get a single pipeline by ID.
| Argument | Type | Description |
|---|---|---|
| id | number | Pipeline ID |
| project? | string | Project name (overrides global) |
fn runPipeline(id: number, branch?: string, project?: string)
Trigger a pipeline run.
| Argument | Type | Description |
|---|---|---|
| id | number | Pipeline ID |
| branch? | string | Source branch to build |
| project? | string | Project name (overrides global) |
fn listBuilds(top?: number, project?: string)
List recent pipeline builds.
| Argument | Type | Description |
|---|---|---|
| top? | number | Number of builds to return (default 20) |
| project? | string | Project name (overrides global) |
fn getBuild(id: number, project?: string)
Get a single build by ID.
| Argument | Type | Description |
|---|---|---|
| id | number | Build ID |
| project? | string | Project name (overrides global) |
fn listWorkItems(wiql?: string, project?: string)
Query work items using WIQL. Defaults to recent items in the project.
| Argument | Type | Description |
|---|---|---|
| wiql? | string | WIQL query string |
| project? | string | Project name (overrides global) |
fn getWorkItem(id: number, project?: string)
Get a single work item by ID.
| Argument | Type | Description |
|---|---|---|
| id | number | Work item ID |
| project? | string | Project name (overrides global) |
fn createWorkItem(title: string, type: string, assignedTo?: string, areaPath?: string, description?: string, project?: string)
Create a new work item.
| Argument | Type | Description |
|---|---|---|
| title | string | Work item title |
| type | string | Work item type (e.g. Bug, Task, User Story) |
| assignedTo? | string | Assigned user |
| areaPath? | string | Area path |
| description? | string | Work item description |
| project? | string | Project name (overrides global) |
fn updateWorkItem(id: number, project?: string)
Update a work item by ID with field/value pairs.
| Argument | Type | Description |
|---|---|---|
| id | number | Work item ID |
| project? | string | Project name (overrides global) |
fn rollupParentStates(project?: string, todoState?: string, doingState?: string, doneState?: string)
Roll parent work-item state up from children in one sweep: a parent is Done when every child is Done, and in-progress as soon as any child has started. Azure Boards rules only act on the work item that triggered them and cannot write to a parent, so this fills that gap. Scans the whole project, computes desired states bottom-up (tasks feed issues, issues feed epics), and patches only the parents whose state actually differs. Set dryRun to preview.
| Argument | Type | Description |
|---|---|---|
| project? | string | Project name (overrides global) |
| todoState? | string | State meaning 'not started' (default 'To Do'; Agile uses 'New') |
| doingState? | string | State meaning 'in progress' (default 'Doing'; Agile uses 'Active') |
| doneState? | string | State meaning 'complete' (default 'Done'; Agile uses 'Closed') |
fn listServiceConnections(project?: string)
List service connections (service endpoints) in a project.
| Argument | Type | Description |
|---|---|---|
| project? | string | Project name (overrides global) |
fn getServiceConnection(id: string, project?: string)
Get a single service connection by id.
| Argument | Type | Description |
|---|---|---|
| id | string | Service endpoint id |
| project? | string | Project name (overrides global) |
fn listVariableGroups(top?: number, project?: string)
List pipeline variable groups in a project.
| Argument | Type | Description |
|---|---|---|
| top? | number | Maximum number to return |
| project? | string | Project name (overrides global) |
fn getVariableGroup(id: number, project?: string)
Get a single variable group by id.
| Argument | Type | Description |
|---|---|---|
| id | number | Variable group id |
| project? | string | Project name (overrides global) |
fn listPullRequests(repository?: string, sourceBranch?: string, targetBranch?: string, project?: string)
List pull requests across a project or a single repository.
| Argument | Type | Description |
|---|---|---|
| repository? | string | Repository name or id |
| sourceBranch? | string | Source branch filter |
| targetBranch? | string | Target branch filter |
| project? | string | Project name (overrides global) |
fn getPullRequest(id: number)
Get a single pull request by id.
| Argument | Type | Description |
|---|---|---|
| id | number | Pull request id |
fn listAgentPools(poolName?: string)
List the organization's agent pools (org-level, not project-scoped).
| Argument | Type | Description |
|---|---|---|
| poolName? | string | Filter by matching pool name |
Resources
project(infinite)— Azure DevOps project
repo(infinite)— Azure DevOps Git repository
pipeline(infinite)— Azure DevOps pipeline
build(infinite)— Azure DevOps pipeline build/run
workItem(infinite)— Azure DevOps work item
rollup(infinite)— Result of a parent-state rollup sweep: the computed state changes and whether they were applied
serviceConnection(infinite)— Azure DevOps service connection (service endpoint)
variableGroup(infinite)— Azure DevOps pipeline variable group
pullRequest(infinite)— Azure DevOps pull request
agentPool(infinite)— Azure DevOps organization agent pool
@dougschaefer/azure-diskv2026.07.24.3azure/disk.ts
fn list()
List all managed disks in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single managed disk.
| Argument | Type | Description |
|---|---|---|
| name | string | Disk name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a managed disk without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Disk name |
| resourceGroup? | string | Resource group name |
fn listOrphaned()
List managed disks that are not attached to any VM (diskState is Unattached).
fn create(name: string, resourceGroup?: string, location: string, sizeGb: number, zone?: string)
Create a managed disk.
| Argument | Type | Description |
|---|---|---|
| name | string | Disk name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
| sizeGb | number | Disk size in GB |
| zone? | string | Availability zone (1, 2, or 3) |
fn delete(name: string, resourceGroup?: string)
Delete a managed disk. Disk must be unattached.
| Argument | Type | Description |
|---|---|---|
| name | string | Disk name |
| resourceGroup? | string | Resource group name |
Resources
disk(infinite)— Azure managed disk
@dougschaefer/azure-dnsv2026.07.24.3azure/dns.ts
fn listZones()
List all DNS zones in a resource group (or all in the subscription if no resource group specified).
fn getZone(name: string, resourceGroup?: string)
Get a single DNS zone.
| Argument | Type | Description |
|---|---|---|
| name | string | DNS zone name |
| resourceGroup? | string | Resource group name |
fn createZone(name: string, resourceGroup?: string)
Create a DNS zone.
| Argument | Type | Description |
|---|---|---|
| name | string | DNS zone name, e.g. example.com |
| resourceGroup? | string | Resource group name |
fn deleteZone(name: string, resourceGroup?: string)
Delete a DNS zone.
| Argument | Type | Description |
|---|---|---|
| name | string | DNS zone name |
| resourceGroup? | string | Resource group name |
fn syncZone(name: string, resourceGroup?: string)
Refresh stored state for a DNS zone.
| Argument | Type | Description |
|---|---|---|
| name | string | DNS zone name |
| resourceGroup? | string | Resource group name |
fn listRecords(zoneName: string, resourceGroup?: string)
List all record sets in a DNS zone.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| resourceGroup? | string | Resource group name |
fn getRecord(zoneName: string, name: string, resourceGroup?: string)
Get a specific record set from a DNS zone.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| name | string | Record set name (e.g. 'www', '@' for apex) |
| resourceGroup? | string | Resource group name |
fn createRecord(zoneName: string, name: string, resourceGroup?: string)
Add a record to a record set in a DNS zone. Creates the record set if it does not exist.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| name | string | Record set name (e.g. 'www', '@' for apex) |
| resourceGroup? | string | Resource group name |
fn deleteRecord(zoneName: string, name: string, resourceGroup?: string)
Remove a single record from a record set in a DNS zone.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| name | string | Record set name |
| resourceGroup? | string | Resource group name |
fn deleteRecordSet(zoneName: string, name: string, resourceGroup?: string)
Delete an entire record set from a DNS zone.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| name | string | Record set name |
| resourceGroup? | string | Resource group name |
fn exportZone(zoneName: string, resourceGroup?: string)
Export a DNS zone as a zone file. Returns the zone file content as a string.
| Argument | Type | Description |
|---|---|---|
| zoneName | string | DNS zone name |
| resourceGroup? | string | Resource group name |
Resources
zone(infinite)— Azure DNS zone
recordSet(infinite)— DNS record set within a zone
@dougschaefer/azure-eventgridv2026.07.24.3azure/eventgrid.ts
fn listTopics()
List Event Grid custom topics in a resource group (or subscription).
fn getTopic(name: string, resourceGroup?: string)
Get a single Event Grid custom topic.
| Argument | Type | Description |
|---|---|---|
| name | string | Topic name |
| resourceGroup? | string | Resource group name |
fn syncTopic(name: string, resourceGroup?: string)
Refresh the stored state of an Event Grid custom topic without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Topic name |
| resourceGroup? | string | Resource group name |
fn listSystemTopics()
List Event Grid system topics in a resource group (or subscription).
fn listSubscriptions()
List event subscriptions attached to a source resource by its full ARM id.
Resources
topic(infinite)— Event Grid custom topic
systemTopic(infinite)— Event Grid system topic for platform events
subscription(infinite)— Event subscription on a source resource
@dougschaefer/azure-facev2026.07.24.3azure/face.ts
fn detect(imageUrl: string, returnFaceId: boolean, returnFaceLandmarks: boolean, returnFaceAttributes: string, recognitionModel: string, detectionModel: string)
POST /face/v1.0/detect — detect faces in an image supplied as a URL. Returns one faceId per detected face. faceIds are ephemeral (24h TTL) and are passed directly to `identify`.
| Argument | Type | Description |
|---|---|---|
| imageUrl | string | Publicly accessible URL of the image frame to analyze |
| returnFaceId | boolean | Whether to return a faceId (required for identify) |
| returnFaceLandmarks | boolean | Whether to return face landmark points |
| returnFaceAttributes | string | Comma-separated face attribute names to return, e.g. `age,gender,headPose`. Leave empty to minimize quota usage. |
| recognitionModel | string | Recognition model to use. recognition_04 is the most accurate as of 2024. |
| detectionModel | string | Detection model to use. detection_03 is recommended for still images. |
fn identify(faceIds: array, personGroupId: string, maxNumOfCandidatesReturned: number, confidenceThreshold: number)
POST /face/v1.0/identify — 1:N identification: given one or more faceIds (from `detect`) and a personGroupId, return ordered candidate Persons with confidence scores.
| Argument | Type | Description |
|---|---|---|
| faceIds | array | One or more faceIds returned by `detect` (max 10, TTL 24h) |
| personGroupId | string | Id of the PersonGroup to search against. Each Person's userData must hold the Entra objectId. |
| maxNumOfCandidatesReturned | number | Max candidates per face (1-5). Default 1 returns only the best match. |
| confidenceThreshold | number | Minimum confidence score to include a candidate (0.0-1.0). Default 0.5. |
fn createPersonGroup(personGroupId: string, name: string, userData: string, recognitionModel: string)
PUT /face/v1.0/persongroups/{personGroupId} — create a new PersonGroup.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Unique id for the group (lowercase, alphanumeric, hyphens, underscores; max 64 chars) |
| name | string | Human-readable display name for the group (max 128 chars) |
| userData | string | Optional metadata string (max 16KB). Useful for tagging the deployment site or environment. |
| recognitionModel | string | Recognition model for faces enrolled in this group. Must match the model used during detect. |
fn listPersonGroups(start: string, top: number, returnRecognitionModel: boolean)
GET /face/v1.0/persongroups — list PersonGroups under this Face resource, with optional pagination. Returns a snapshot of groups available for identify.
| Argument | Type | Description |
|---|---|---|
| start | string | List groups with id > start (for pagination) |
| top | number | Max groups to return (1-1000) |
| returnRecognitionModel | boolean | Include the recognitionModel field in each group |
fn deletePersonGroup(personGroupId: string)
DELETE /face/v1.0/persongroups/{personGroupId} — delete a PersonGroup and all its Persons and faces.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup to delete |
fn addPerson(personGroupId: string, name: string, userData: string)
POST /face/v1.0/persongroups/{personGroupId}/persons — add a named Person to a PersonGroup.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup to add to |
| name | string | Display name for the person (e.g. the employee's full name) |
| userData | string | Entra objectId of the employee — this is what `identify` returns as the identity assertion. Max 16KB. |
fn addPersonFace(personGroupId: string, personId: string, imageUrl: string, userData: string, targetFace: string, detectionModel: string)
POST /face/v1.0/persongroups/{personGroupId}/persons/{personId}/persistedfaces — add a face image to an enrolled Person.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup |
| personId | string | Id of the Person (returned by `addPerson`) |
| imageUrl | string | Publicly accessible URL of the enrollment image (face clearly visible) |
| userData | string | Optional metadata for this specific face image |
| targetFace | string | Optional bounding box to target a specific face in the image: left,top,width,height (pixels) |
| detectionModel | string | Detection model to use when adding the face |
fn listPersons(personGroupId: string, start: string, top: number)
GET /face/v1.0/persongroups/{personGroupId}/persons — list all Persons in a PersonGroup.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup |
| start | string | List persons with id > start (for pagination) |
| top | number | Max persons to return (1-1000) |
fn trainPersonGroup(personGroupId: string)
POST /face/v1.0/persongroups/{personGroupId}/train — trigger training on a PersonGroup after adding or removing Persons/faces.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup to train |
fn getPersonGroupTrainingStatus(personGroupId: string)
GET /face/v1.0/persongroups/{personGroupId}/training — get the current training status for a PersonGroup.
| Argument | Type | Description |
|---|---|---|
| personGroupId | string | Id of the PersonGroup to check |
fn detectLiveness(sessionId?: string)
Liveness detection stub — Azure Face liveness is a session-based client-side flow, NOT a simple REST call.
| Argument | Type | Description |
|---|---|---|
| sessionId? | string | Reserved: sessionId for polling a completed liveness session result (not yet implemented) |
Resources
detectionResult(1h)— Detected faces from a single image: faceIds, bounding rectangles, and optional attributes
personGroup(7d)— A Face API PersonGroup: id, name, userData, and training status
personGroupList(1d)— List of all PersonGroups under this Face resource
person(7d)— A Person in a PersonGroup: personId, name, and userData (holds Entra objectId for IARS)
personList(1d)— List of Persons in a PersonGroup
trainingStatus(5m)— Training status for a PersonGroup: running, succeeded, or failed
identifyResult(1h)— 1:N identification result: for each faceId, an ordered list of candidate Persons with confidence scores. The top candidate's userData holds the Entra objectId for downstream iars-correlate.
addPersonFaceResult(30d)— Confirmation that a face image was added to a Person in a PersonGroup
@dougschaefer/azure-firewallv2026.07.24.3azure/firewall.ts
fn list()
List all Azure Firewalls in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single Azure Firewall.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of an Azure Firewall without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string, vnetName: string)
Create an Azure Firewall. Requires a VNet with an AzureFirewallSubnet.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
| vnetName | string | VNet name (must have AzureFirewallSubnet) |
fn delete(name: string, resourceGroup?: string)
Delete an Azure Firewall.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall name |
| resourceGroup? | string | Resource group name |
fn listPolicies()
List all firewall policies in a resource group.
fn getPolicy(name: string, resourceGroup?: string)
Get a single firewall policy.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
fn syncPolicy(name: string, resourceGroup?: string)
Refresh the stored state of a firewall policy without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
fn listRuleCollectionGroups(policyName: string, resourceGroup?: string)
List all rule collection groups in a firewall policy.
| Argument | Type | Description |
|---|---|---|
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
fn getRuleCollectionGroup(name: string, policyName: string, resourceGroup?: string)
Get a single rule collection group from a firewall policy.
| Argument | Type | Description |
|---|---|---|
| name | string | Rule collection group name |
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
fn createRuleCollectionGroup(name: string, policyName: string, resourceGroup?: string, priority: number)
Create a rule collection group in a firewall policy.
| Argument | Type | Description |
|---|---|---|
| name | string | Rule collection group name |
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
| priority | number | Priority (100-65000, lower = higher priority) |
fn deleteRuleCollectionGroup(name: string, policyName: string, resourceGroup?: string)
Delete a rule collection group from a firewall policy.
| Argument | Type | Description |
|---|---|---|
| name | string | Rule collection group name |
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
fn addFilterCollection(rcgName: string, policyName: string, resourceGroup?: string, collectionName: string, collectionPriority: number, actionType: enum)
Add a filter rule collection (network or application rules) to an existing rule collection group.
| Argument | Type | Description |
|---|---|---|
| rcgName | string | Rule collection group name |
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
| collectionName | string | New rule collection name |
| collectionPriority | number | Collection priority (100-65000) |
| actionType | enum | Filter action |
fn addNatCollection(rcgName: string, policyName: string, resourceGroup?: string, collectionName: string, collectionPriority: number, ruleName: string, sourceAddresses: array, destinationAddresses: array, destinationPorts: array, translatedAddress: string, translatedPort: string, ipProtocols: array)
Add a NAT (DNAT) rule collection to an existing rule collection group.
| Argument | Type | Description |
|---|---|---|
| rcgName | string | Rule collection group name |
| policyName | string | Firewall policy name |
| resourceGroup? | string | Resource group name |
| collectionName | string | New NAT collection name |
| collectionPriority | number | Collection priority (100-65000) |
| ruleName | string | First DNAT rule name |
| sourceAddresses | array | Source IP(s) or * for any |
| destinationAddresses | array | Firewall public IP(s) to match |
| destinationPorts | array | External port(s) to match |
| translatedAddress | string | Internal IP to forward to |
| translatedPort | string | Internal port to forward to |
| ipProtocols | array | Protocols |
fn addRule(rcgName: string, policyName: string, collectionName: string, resourceGroup?: string, ruleType: enum, ruleName: string, sourceAddresses: array, destinationAddresses?: array, destinationPorts?: array, ipProtocols?: array, translatedAddress?: string, translatedPort?: string, targetFqdns?: array, protocols?: array, description?: string)
Add a rule to an existing rule collection. Supports NatRule, NetworkRule, and ApplicationRule types.
| Argument | Type | Description |
|---|---|---|
| rcgName | string | Rule collection group name |
| policyName | string | Firewall policy name |
| collectionName | string | Existing rule collection name |
| resourceGroup? | string | Resource group name |
| ruleType | enum | Rule type |
| ruleName | string | Rule name |
| sourceAddresses | array | Source IP(s), CIDR(s), or * for any |
| destinationAddresses? | array | Destination IP(s) or CIDR(s) |
| destinationPorts? | array | Destination port(s) |
| ipProtocols? | array | Protocols: TCP, UDP, Any, ICMP |
| translatedAddress? | string | DNAT translated internal IP (NatRule only) |
| translatedPort? | string | DNAT translated internal port (NatRule only) |
| targetFqdns? | array | Target FQDNs (ApplicationRule only) |
| protocols? | array | App protocols, e.g. Http=80 Https=443 (ApplicationRule only) |
| description? | string | Rule description |
fn removeRule(rcgName: string, policyName: string, collectionName: string, ruleName: string, resourceGroup?: string)
Remove a rule from a rule collection.
| Argument | Type | Description |
|---|---|---|
| rcgName | string | Rule collection group name |
| policyName | string | Firewall policy name |
| collectionName | string | Rule collection name |
| ruleName | string | Rule name to remove |
| resourceGroup? | string | Resource group name |
fn removeCollection(rcgName: string, policyName: string, collectionName: string, resourceGroup?: string)
Remove an entire rule collection from a rule collection group.
| Argument | Type | Description |
|---|---|---|
| rcgName | string | Rule collection group name |
| policyName | string | Firewall policy name |
| collectionName | string | Rule collection name to remove |
| resourceGroup? | string | Resource group name |
fn createPolicy(name: string, resourceGroup?: string, location: string)
Create a firewall policy.
| Argument | Type | Description |
|---|---|---|
| name | string | Policy name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
Resources
firewall(infinite)— Azure Firewall instance
policy(infinite)— Azure Firewall policy
ruleCollectionGroup(infinite)— Firewall policy rule collection group
@dougschaefer/azure-key-vaultv2026.07.24.3azure/key_vault.ts
fn list()
List all Key Vaults in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single Key Vault.
| Argument | Type | Description |
|---|---|---|
| name | string | Key Vault name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a Key Vault without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Key Vault name |
| resourceGroup? | string | Resource group name |
fn create(resourceGroup?: string, location: string)
Create a Key Vault.
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a Key Vault. If soft delete is enabled, the vault enters a deleted state and can be recovered.
| Argument | Type | Description |
|---|---|---|
| name | string | Key Vault name |
| resourceGroup? | string | Resource group name |
Resources
keyVault(infinite)— Azure Key Vault
@dougschaefer/azure-load-balancerv2026.07.24.3azure/load_balancer.ts
fn list()
List all load balancers in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single load balancer with full configuration.
| Argument | Type | Description |
|---|---|---|
| name | string | Load balancer name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a load balancer without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Load balancer name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a load balancer.
| Argument | Type | Description |
|---|---|---|
| name | string | Load balancer name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
fn delete(name: string, resourceGroup?: string)
Delete a load balancer.
| Argument | Type | Description |
|---|---|---|
| name | string | Load balancer name |
| resourceGroup? | string | Resource group name |
fn listBackendPools(lbName: string, resourceGroup?: string)
List backend address pools on a load balancer.
| Argument | Type | Description |
|---|---|---|
| lbName | string | Load balancer name |
| resourceGroup? | string | Resource group name |
fn listProbes(lbName: string, resourceGroup?: string)
List health probes on a load balancer.
| Argument | Type | Description |
|---|---|---|
| lbName | string | Load balancer name |
| resourceGroup? | string | Resource group name |
Resources
loadBalancer(infinite)— Azure Load Balancer (L4)
backendPool(infinite)— Backend address pool
probe(infinite)— Health probe
@dougschaefer/azure-log-analytics-workspacev2026.07.24.3azure/log_analytics_workspace.ts
fn list()
List all Log Analytics workspaces in a resource group (or all in the subscription if no resource group specified).
fn get(name: string, resourceGroup?: string)
Get a single Log Analytics workspace by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Workspace name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a Log Analytics workspace without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Workspace name |
| resourceGroup? | string | Resource group name |
Resources
workspace(infinite)— Azure Monitor Log Analytics workspace
@dougschaefer/azure-managed-identityv2026.07.24.3azure/managed_identity.ts
fn list()
List all user-assigned managed identities in a resource group (or subscription).
fn get(name: string, resourceGroup?: string)
Get a single user-assigned managed identity.
| Argument | Type | Description |
|---|---|---|
| name | string | Identity name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a managed identity without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Identity name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a user-assigned managed identity.
| Argument | Type | Description |
|---|---|---|
| name | string | Identity name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
fn update(name: string, resourceGroup?: string)
Replace the tags on a user-assigned managed identity (az CLI 2.87+).
| Argument | Type | Description |
|---|---|---|
| name | string | Identity name |
| resourceGroup? | string | Resource group name |
fn listFederatedCredentials(identityName: string, resourceGroup?: string)
List federated identity credentials configured on a managed identity.
| Argument | Type | Description |
|---|---|---|
| identityName | string | Managed identity name |
| resourceGroup? | string | Resource group name |
fn createFederatedCredential(identityName: string, resourceGroup?: string, name: string)
Create a federated identity credential on a managed identity for workload identity federation (GitHub Actions, Kubernetes, or any OIDC issuer). Identify the incoming token by exact subject OR by a claims-matching expression (az CLI 2.87+ preview) — exactly one of the two.
| Argument | Type | Description |
|---|---|---|
| identityName | string | Managed identity name |
| resourceGroup? | string | Resource group name |
| name | string | Federated credential name |
fn deleteFederatedCredential(identityName: string, resourceGroup?: string, name: string)
Delete a federated identity credential from a managed identity.
| Argument | Type | Description |
|---|---|---|
| identityName | string | Managed identity name |
| resourceGroup? | string | Resource group name |
| name | string | Federated credential name |
fn delete(name: string, resourceGroup?: string)
Delete a user-assigned managed identity.
| Argument | Type | Description |
|---|---|---|
| name | string | Identity name |
| resourceGroup? | string | Resource group name |
Resources
identity(infinite)— Azure user-assigned managed identity
federatedCredential(infinite)— Federated identity credential on a user-assigned managed identity
@dougschaefer/azure-monitorv2026.07.24.3azure/monitor.ts
fn listMetricAlerts()
List all metric alert rules in a resource group (or subscription).
fn listActivityLogAlerts()
List all activity log alerts in the subscription.
fn listActionGroups()
List all action groups in a resource group (or subscription).
fn getDiagnosticSettings()
List diagnostic settings for a specific Azure resource.
fn setDiagnosticSetting()
Create or converge a diagnostic setting that ships a resource's logs to a Log Analytics workspace. Idempotent — an existing setting of the same name is replaced so the declared categories are exactly what ends up configured. Prefer resourceSpecific (the default), which lands rows in per-category tables such as AZFWNetworkRule rather than the legacy catch-all AzureDiagnostics table; it ingests cheaper and queries far more cleanly. A resource with no diagnostic setting emits nothing at all — platf
Resources
metricAlert(infinite)— Azure Monitor metric alert rule
activityLogAlert(infinite)— Azure Monitor activity log alert
diagnosticSetting(infinite)— Diagnostic setting on an Azure resource
actionGroup(infinite)— Azure Monitor action group
@dougschaefer/azure-nat-gatewayv2026.07.24.3azure/nat_gateway.ts
fn list()
List all NAT gateways in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single NAT gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | NAT gateway name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a NAT gateway without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | NAT gateway name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a NAT gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | NAT gateway name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a NAT gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | NAT gateway name |
| resourceGroup? | string | Resource group name |
Resources
natGateway(infinite)— Azure NAT gateway
@dougschaefer/azure-network-interfacev2026.07.24.3azure/network_interface.ts
fn list()
List all network interfaces in a resource group (or all in the subscription if no resource group specified).
fn get(name: string, resourceGroup?: string)
Get a single network interface by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Network interface (NIC) name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a network interface without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Network interface (NIC) name |
| resourceGroup? | string | Resource group name |
Resources
networkInterface(infinite)— Azure network interface (NIC)
@dougschaefer/azure-network-watcherv2026.07.24.3azure/network_watcher.ts
fn list()
List all Network Watcher instances in the subscription.
fn listFlowLogs(watcherName: string)
List all NSG flow logs for a Network Watcher.
| Argument | Type | Description |
|---|---|---|
| watcherName | string | Network Watcher name |
fn listConnectionMonitors(watcherName: string)
List all connection monitors for a Network Watcher.
| Argument | Type | Description |
|---|---|---|
| watcherName | string | Network Watcher name |
fn checkConnectivity(sourceVmId: string, destPort: number)
Test connectivity from a source VM to a destination endpoint.
| Argument | Type | Description |
|---|---|---|
| sourceVmId | string | Source VM resource ID |
| destPort | number | Destination port |
fn setFlowLog(name: string, enabled: boolean)
Create or converge a flow log, optionally with Traffic Analytics. Flow logs are the only record of which 5-tuples actually crossed the network — rules state what is permitted, never what is used, so they cannot tell you whether a rule is load-bearing or dead. Indispensable before inserting a firewall into an existing path, where you need observed flows rather than assumed ones. Target a virtual network: Azure blocked creation of new *NSG* flow logs on 2025-06-30 ahead of their 2027-09-30 retirem
| Argument | Type | Description |
|---|---|---|
| name | string | Flow log resource name |
| enabled | boolean | Enable the flow log |
Resources
watcher(infinite)— Azure Network Watcher instance
flowLog(infinite)— NSG flow log configuration
connectionMonitor(infinite)— Connection monitor test
@dougschaefer/azure-nsgv2026.07.24.3azure/nsg.ts
fn list()
List all NSGs in a resource group (or all in the subscription if no resource group specified).
fn get(name: string, resourceGroup?: string)
Get a single NSG with all its rules.
| Argument | Type | Description |
|---|---|---|
| name | string | NSG name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of an NSG and its rules without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | NSG name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a network security group.
| Argument | Type | Description |
|---|---|---|
| name | string | NSG name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a network security group.
| Argument | Type | Description |
|---|---|---|
| name | string | NSG name |
| resourceGroup? | string | Resource group name |
fn listRules(nsgName: string, resourceGroup?: string)
List all custom rules in an NSG.
| Argument | Type | Description |
|---|---|---|
| nsgName | string | NSG name |
| resourceGroup? | string | Resource group name |
fn getRule(nsgName: string, ruleName: string, resourceGroup?: string)
Get a single NSG rule.
| Argument | Type | Description |
|---|---|---|
| nsgName | string | NSG name |
| ruleName | string | Rule name |
| resourceGroup? | string | Resource group name |
fn createRule(nsgName: string, ruleName: string, access: enum, resourceGroup?: string)
Create a security rule in an NSG.
| Argument | Type | Description |
|---|---|---|
| nsgName | string | NSG name |
| ruleName | string | Rule name |
| access | enum | Allow or deny traffic |
| resourceGroup? | string | Resource group name |
fn updateRule(nsgName: string, ruleName: string, resourceGroup?: string, priority?: number, access?: enum, protocol?: string, description?: string)
Update an existing security rule. Only specified fields are changed.
| Argument | Type | Description |
|---|---|---|
| nsgName | string | NSG name |
| ruleName | string | Rule name |
| resourceGroup? | string | Resource group name |
| priority? | number | New priority |
| access? | enum | New access |
| protocol? | string | New protocol |
| description? | string | New description |
fn deleteRule(nsgName: string, ruleName: string, resourceGroup?: string)
Delete a security rule from an NSG.
| Argument | Type | Description |
|---|---|---|
| nsgName | string | NSG name |
| ruleName | string | Rule name |
| resourceGroup? | string | Resource group name |
Resources
nsg(infinite)— Azure network security group
rule(infinite)— Individual security rule within an NSG
@dougschaefer/azure-policyv2026.07.24.3azure/policy.ts
fn listAssignments(scope?: string)
List policy assignments at the subscription or a resource group.
| Argument | Type | Description |
|---|---|---|
| scope? | string | Explicit ARM scope id |
fn getAssignment(name: string, scope?: string)
Get a single policy assignment by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Assignment name |
| scope? | string | Explicit ARM scope id |
fn createAssignment(name: string, scope?: string, displayName?: string)
Assign a policy or initiative at a scope (idempotent upsert by name).
| Argument | Type | Description |
|---|---|---|
| name | string | Assignment name |
| scope? | string | Explicit ARM scope id |
| displayName? | string | Friendly display name |
fn deleteAssignment(name: string, scope?: string)
Remove a policy assignment by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Assignment name |
| scope? | string | Explicit ARM scope id |
fn listDefinitions()
List policy definitions. Use customOnly to skip the large built-in catalog.
fn getDefinition(name: string)
Get a single policy definition by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Policy definition name |
fn listSetDefinitions()
List policy initiatives (set definitions). Use customOnly to skip built-ins.
fn summarizeCompliance()
Summarize policy compliance state across a scope via Policy Insights.
Resources
assignment(infinite)— Azure Policy assignment
definition(infinite)— Azure Policy definition
setDefinition(infinite)— Azure Policy initiative (set definition)
complianceSummary(infinite)— Policy compliance summary for a scope
@dougschaefer/azure-postgres-flexible-serverv2026.07.24.3azure/postgres_flexible_server.ts
fn list()
List all PostgreSQL flexible servers in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single PostgreSQL flexible server.
| Argument | Type | Description |
|---|---|---|
| name | string | Flexible server name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a PostgreSQL flexible server without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Flexible server name |
| resourceGroup? | string | Resource group name |
fn listDatabases(serverName: string, resourceGroup?: string)
List all databases on a PostgreSQL flexible server.
| Argument | Type | Description |
|---|---|---|
| serverName | string | Flexible server name |
| resourceGroup? | string | Resource group name |
fn listFirewallRules(serverName: string, resourceGroup?: string)
List all firewall (public-access) rules on a PostgreSQL flexible server.
| Argument | Type | Description |
|---|---|---|
| serverName | string | Flexible server name |
| resourceGroup? | string | Resource group name |
Resources
server(infinite)— Azure Database for PostgreSQL Flexible Server
database(infinite)— Database hosted on a PostgreSQL flexible server
firewallRule(infinite)— Firewall (public-access) rule on a PostgreSQL flexible server
@dougschaefer/azure-private-endpointv2026.07.24.3azure/private_endpoint.ts
fn list()
List all private endpoints in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single private endpoint.
| Argument | Type | Description |
|---|---|---|
| name | string | Private endpoint name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a private endpoint without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Private endpoint name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string, vnetName: string, subnetName: string)
Create a private endpoint for a Private Link-enabled service.
| Argument | Type | Description |
|---|---|---|
| name | string | Private endpoint name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
| vnetName | string | VNet containing the subnet |
| subnetName | string | Subnet for the private endpoint NIC |
fn delete(name: string, resourceGroup?: string)
Delete a private endpoint.
| Argument | Type | Description |
|---|---|---|
| name | string | Private endpoint name |
| resourceGroup? | string | Resource group name |
fn listPrivateDnsZones()
List all private DNS zones in a resource group.
Resources
privateEndpoint(infinite)— Azure Private Endpoint for Private Link connections
privateDnsZone(infinite)— Private DNS zone for private endpoint resolution
@dougschaefer/azure-public-ipv2026.07.24.3azure/public_ip.ts
fn list()
List all public IP addresses in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single public IP address.
| Argument | Type | Description |
|---|---|---|
| name | string | Public IP name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a public IP address without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Public IP name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a public IP address.
| Argument | Type | Description |
|---|---|---|
| name | string | Public IP name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a public IP address.
| Argument | Type | Description |
|---|---|---|
| name | string | Public IP name |
| resourceGroup? | string | Resource group name |
Resources
publicIp(infinite)— Azure public IP address
@dougschaefer/azure-recovery-services-vaultv2026.07.24.3azure/recovery_services_vault.ts
fn list()
List all Recovery Services vaults in a resource group (or all in the subscription if no resource group specified).
fn get(name: string, resourceGroup?: string)
Get a single Recovery Services vault, enriched with its backup storage redundancy configuration.
| Argument | Type | Description |
|---|---|---|
| name | string | Vault name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a Recovery Services vault, including its backup storage redundancy configuration, without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Vault name |
| resourceGroup? | string | Resource group name |
fn listBackupItems(vaultName: string, resourceGroup?: string)
List all protected (backup) items registered with a vault (read-only).
| Argument | Type | Description |
|---|---|---|
| vaultName | string | Vault name |
| resourceGroup? | string | Resource group name |
Resources
vault(infinite)— Azure Recovery Services (backup) vault
backupItem(infinite)— A protected (backup) item registered with a vault
@dougschaefer/azure-resource-groupv2026.07.24.3azure/resource_group.ts
fn list()
List all resource groups in the subscription. Produces one resource instance per group.
fn get(name: string)
Get a single resource group by name.
| Argument | Type | Description |
|---|---|---|
| name | string | Resource group name |
fn create(name: string, location: string)
Create a resource group.
| Argument | Type | Description |
|---|---|---|
| name | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string)
Delete a resource group and all its resources.
| Argument | Type | Description |
|---|---|---|
| name | string | Resource group name to delete |
Resources
resourceGroup(infinite)— Azure resource group
@dougschaefer/azure-role-assignmentv2026.07.24.3azure/role_assignment.ts
fn list()
List role assignments at the subscription, a resource group, or an explicit scope.
fn create(role: string)
Grant a principal a role at a scope (subscription, resource group, or explicit scope).
| Argument | Type | Description |
|---|---|---|
| role | string | Role name or role definition id |
fn delete()
Revoke a role assignment by its fully-qualified id (verify with list first).
fn listDenyAssignments()
List RBAC deny assignments — Azure-managed blocks (from managed applications, Blueprints, or deployment stacks) that override any role grant. Read-only.
fn listDefinitions()
List role definitions. Optionally restrict to custom roles only.
fn getDefinition(name: string)
Get a role definition by its role name (e.g. Contributor).
| Argument | Type | Description |
|---|---|---|
| name | string | Role name, e.g. Contributor or Reader |
Resources
assignment(infinite)— Azure RBAC role assignment
definition(infinite)— Azure RBAC role definition
denyAssignment(infinite)— Azure RBAC deny assignment (read-only, Azure-managed)
@dougschaefer/azure-route-tablev2026.07.24.3azure/route_table.ts
fn list()
List all route tables in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single route table with all its routes.
| Argument | Type | Description |
|---|---|---|
| name | string | Route table name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a route table without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Route table name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a route table.
| Argument | Type | Description |
|---|---|---|
| name | string | Route table name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a route table.
| Argument | Type | Description |
|---|---|---|
| name | string | Route table name |
| resourceGroup? | string | Resource group name |
fn listRoutes(routeTableName: string, resourceGroup?: string)
List all routes in a route table.
| Argument | Type | Description |
|---|---|---|
| routeTableName | string | Route table name |
| resourceGroup? | string | Resource group name |
fn createRoute(routeTableName: string, routeName: string, resourceGroup?: string)
Create a route in a route table.
| Argument | Type | Description |
|---|---|---|
| routeTableName | string | Route table name |
| routeName | string | Route name |
| resourceGroup? | string | Resource group name |
fn updateRoute(routeTableName: string, routeName: string, resourceGroup?: string)
Update an existing route in a route table.
| Argument | Type | Description |
|---|---|---|
| routeTableName | string | Route table name |
| routeName | string | Route name |
| resourceGroup? | string | Resource group name |
fn deleteRoute(routeTableName: string, routeName: string, resourceGroup?: string)
Delete a route from a route table.
| Argument | Type | Description |
|---|---|---|
| routeTableName | string | Route table name |
| routeName | string | Route name |
| resourceGroup? | string | Resource group name |
Resources
routeTable(infinite)— Azure route table
route(infinite)— Individual route within a route table
@dougschaefer/azure-servicebusv2026.07.24.3azure/servicebus.ts
fn listNamespaces()
List Service Bus namespaces in a resource group (or subscription).
fn getNamespace(name: string, resourceGroup?: string)
Get a single Service Bus namespace.
| Argument | Type | Description |
|---|---|---|
| name | string | Namespace name |
| resourceGroup? | string | Resource group name |
fn syncNamespace(name: string, resourceGroup?: string)
Refresh the stored state of a Service Bus namespace without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Namespace name |
| resourceGroup? | string | Resource group name |
fn listQueues(namespaceName: string, resourceGroup?: string)
List queues in a Service Bus namespace, including depth attributes (messageCount, countDetails).
| Argument | Type | Description |
|---|---|---|
| namespaceName | string | Service Bus namespace name |
| resourceGroup? | string | Resource group name |
fn listTopics(namespaceName: string, resourceGroup?: string)
List topics in a Service Bus namespace, including depth attributes (countDetails, subscriptionCount).
| Argument | Type | Description |
|---|---|---|
| namespaceName | string | Service Bus namespace name |
| resourceGroup? | string | Resource group name |
fn listSubscriptions(namespaceName: string, topicName: string, resourceGroup?: string)
List subscriptions on a Service Bus topic, including depth attributes (messageCount, countDetails).
| Argument | Type | Description |
|---|---|---|
| namespaceName | string | Service Bus namespace name |
| topicName | string | Topic name within the namespace |
| resourceGroup? | string | Resource group name |
Resources
namespace(infinite)— Azure Service Bus namespace
queue(infinite)— Queue within a Service Bus namespace
topic(infinite)— Topic within a Service Bus namespace
subscription(infinite)— Subscription on a Service Bus topic
@dougschaefer/azure-sqlv2026.07.24.3azure/sql.ts
fn listServers()
List all SQL servers in a resource group (or all in the subscription).
fn getServer(name: string, resourceGroup?: string)
Get a single SQL server.
| Argument | Type | Description |
|---|---|---|
| name | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn syncServer(name: string, resourceGroup?: string)
Refresh the stored state of a SQL server without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn syncDatabase(name: string, serverName: string, resourceGroup?: string)
Refresh the stored state of a database without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Database name |
| serverName | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn createServer(resourceGroup?: string, location: string, adminUser: string)
Create an Azure SQL logical server.
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
| adminUser | string | Server admin username |
fn deleteServer(name: string, resourceGroup?: string)
Delete an Azure SQL logical server and all its databases.
| Argument | Type | Description |
|---|---|---|
| name | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn listDatabases(serverName: string, resourceGroup?: string)
List all databases on a SQL server.
| Argument | Type | Description |
|---|---|---|
| serverName | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn getDatabase(name: string, serverName: string, resourceGroup?: string)
Get a single database on a SQL server.
| Argument | Type | Description |
|---|---|---|
| name | string | Database name |
| serverName | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn createDatabase(name: string, serverName: string, resourceGroup?: string)
Create a database on a SQL server.
| Argument | Type | Description |
|---|---|---|
| name | string | Database name |
| serverName | string | SQL server name |
| resourceGroup? | string | Resource group name |
fn deleteDatabase(name: string, serverName: string, resourceGroup?: string)
Delete a database from a SQL server.
| Argument | Type | Description |
|---|---|---|
| name | string | Database name |
| serverName | string | SQL server name |
| resourceGroup? | string | Resource group name |
Resources
server(infinite)— Azure SQL logical server
database(infinite)— Azure SQL database
@dougschaefer/azure-ssh-keyv2026.07.24.3azure/ssh_key.ts
fn list()
List all SSH public keys in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single SSH public key by name.
| Argument | Type | Description |
|---|---|---|
| name | string | SSH public key name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of an SSH public key without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | SSH public key name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create an SSH public key resource.
| Argument | Type | Description |
|---|---|---|
| name | string | SSH public key name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete an SSH public key resource.
| Argument | Type | Description |
|---|---|---|
| name | string | SSH public key name |
| resourceGroup? | string | Resource group name |
Resources
sshKey(infinite)— Azure SSH public key resource
@dougschaefer/azure-staticwebappv2026.07.24.3azure/staticwebapp.ts
fn list()
List Static Web Apps in a resource group (or subscription).
fn get(name: string)
Get a single Static Web App.
| Argument | Type | Description |
|---|---|---|
| name | string | Static Web App name |
fn sync(name: string)
Refresh the stored state of a Static Web App without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Static Web App name |
fn listEnvironments(name: string)
List the deployment environments of a Static Web App, including production.
| Argument | Type | Description |
|---|---|---|
| name | string | Static Web App name |
Resources
site(infinite)— Azure Static Web App
environment(infinite)— Deployment environment of an Azure Static Web App
@dougschaefer/azure-storage-accountv2026.07.24.3azure/storage_account.ts
fn list()
List all storage accounts in a resource group (or all in the subscription).
fn get(name: string, resourceGroup?: string)
Get a single storage account.
| Argument | Type | Description |
|---|---|---|
| name | string | Storage account name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a storage account without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | Storage account name |
| resourceGroup? | string | Resource group name |
fn create(resourceGroup?: string, location: string)
Create a storage account.
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a storage account.
| Argument | Type | Description |
|---|---|---|
| name | string | Storage account name |
| resourceGroup? | string | Resource group name |
Resources
storageAccount(infinite)— Azure storage account
@dougschaefer/azure-topologyv2026.07.24.3azure/topology.ts
fn inventory()
Discover all resources across the subscription (or a single resource group). Produces per-resource data handles for VMs, disks, VNets, NSGs, firewalls, public IPs, NAT gateways, route tables, load balancers, application gateways, Bastion, Key Vaults, storage accounts, private endpoints, managed identities, and SQL servers.
fn generate()
Generate a Mermaid topology diagram. When resourceGroup is provided, diagrams a single RG. When omitted, produces a subscription-wide hub-and-spoke diagram across all resource groups with LR layout, traffic flow arrows, and Azure-branded colors.
fn costEstimate(resourceGroup?: string)
Estimate monthly costs for VMs in a resource group using the Azure Retail Pricing API (public, no auth required).
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
fn exportTemplate(resourceGroup?: string)
Export an ARM template for all resources in a resource group.
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
Resources
topology(infinite)— Mermaid topology diagram for an Azure resource group
costEstimate(infinite)— Cost estimate for resources in a resource group
armTemplate(infinite)— Exported ARM template for a resource group
inventoryItem(infinite)— Individual Azure resource discovered during subscription inventory
@dougschaefer/azure-vmv2026.07.24.3azure/vm.ts
fn list()
List VMs in a resource group (or all in the subscription if no resource group specified). Includes power state.
fn get(name: string, resourceGroup?: string)
Get a single VM with instance details.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a VM without making changes. Useful for drift detection and monitoring.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn getInstanceView(name: string, resourceGroup?: string)
Get the instance view of a VM — power state, agent status, disk status.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string, adminUsername: string, vnetName?: string, subnetName?: string, osDiskSizeGb?: number)
Create a virtual machine. Creates NIC, public IP, and OS disk automatically unless specified.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
| adminUsername | string | Admin username |
| vnetName? | string | Existing VNet name |
| subnetName? | string | Existing subnet name |
| osDiskSizeGb? | number | OS disk size in GB |
fn delete(name: string, resourceGroup?: string)
Delete a virtual machine. Note: associated NIC, OS disk, and public IP are NOT automatically deleted — clean up separately.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn start(name: string, resourceGroup?: string)
Start a stopped/deallocated VM.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn stop(name: string, resourceGroup?: string)
Power off a VM without deallocating (still incurs compute charges).
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn deallocate(name: string, resourceGroup?: string)
Deallocate a VM (releases compute resources, stops charges). Optionally hibernate instead, preserving the in-memory state.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn restart(name: string, resourceGroup?: string)
Restart a running VM.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
fn resize(name: string, size: string, resourceGroup?: string)
Resize a VM to a different size. VM must be deallocated first for some size changes.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| size | string | New VM size, e.g. Standard_D4s_v5 |
| resourceGroup? | string | Resource group name |
fn listSizes(location: string)
List available VM sizes in a location.
| Argument | Type | Description |
|---|---|---|
| location | string | Azure region, e.g. eastus2 |
fn runCommand(name: string, resourceGroup?: string)
Run a shell command on a VM via the Azure VM Run Command extension.
| Argument | Type | Description |
|---|---|---|
| name | string | VM name |
| resourceGroup? | string | Resource group name |
Resources
vm(infinite)— Azure virtual machine
instanceView(infinite)— VM instance view with power state and agent status
@dougschaefer/azure-vnetv2026.07.24.3azure/vnet.ts
fn list()
List all VNets in a resource group (or all in the subscription if no resource group specified).
fn get(name: string, resourceGroup?: string)
Get a single VNet by name.
| Argument | Type | Description |
|---|---|---|
| name | string | VNet name |
| resourceGroup? | string | Resource group name |
fn sync(name: string, resourceGroup?: string)
Refresh the stored state of a VNet and its subnets without making changes.
| Argument | Type | Description |
|---|---|---|
| name | string | VNet name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a virtual network.
| Argument | Type | Description |
|---|---|---|
| name | string | VNet name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region, e.g. eastus2 |
fn delete(name: string, resourceGroup?: string)
Delete a virtual network.
| Argument | Type | Description |
|---|---|---|
| name | string | VNet name |
| resourceGroup? | string | Resource group name |
fn listSubnets(vnetName: string, resourceGroup?: string)
List all subnets in a VNet.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| resourceGroup? | string | Resource group name |
fn getSubnet(vnetName: string, subnetName: string, resourceGroup?: string)
Get a single subnet.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| subnetName | string | Subnet name |
| resourceGroup? | string | Resource group name |
fn createSubnet(vnetName: string, subnetName: string, resourceGroup?: string)
Create a subnet in a VNet.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| subnetName | string | Subnet name |
| resourceGroup? | string | Resource group name |
fn updateSubnet(vnetName: string, subnetName: string, resourceGroup?: string)
Update a subnet — attach or detach NSG or route table.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| subnetName | string | Subnet name |
| resourceGroup? | string | Resource group name |
fn deleteSubnet(vnetName: string, subnetName: string, resourceGroup?: string)
Delete a subnet from a VNet.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| subnetName | string | Subnet name |
| resourceGroup? | string | Resource group name |
fn listPeerings(vnetName: string, resourceGroup?: string)
List all peering connections for a VNet.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| resourceGroup? | string | Resource group name |
fn createPeering(vnetName: string, peeringName: string, resourceGroup?: string)
Create a VNet peering connection. Creates one direction only — you need to create the reverse peering on the remote VNet separately.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | Local VNet name |
| peeringName | string | Peering connection name |
| resourceGroup? | string | Resource group name |
fn deletePeering(vnetName: string, peeringName: string, resourceGroup?: string)
Delete a VNet peering connection.
| Argument | Type | Description |
|---|---|---|
| vnetName | string | VNet name |
| peeringName | string | Peering connection name |
| resourceGroup? | string | Resource group name |
Resources
vnet(infinite)— Azure virtual network
subnet(infinite)— Azure subnet within a virtual network
peering(infinite)— Virtual network peering connection
@dougschaefer/azure-vwanv2026.07.24.3azure/vwan.ts
fn list()
List all Virtual WANs in a resource group (or subscription).
fn get(name: string, resourceGroup?: string)
Get a single Virtual WAN.
| Argument | Type | Description |
|---|---|---|
| name | string | vWAN name |
| resourceGroup? | string | Resource group name |
fn create(name: string, resourceGroup?: string, location: string)
Create a Virtual WAN.
| Argument | Type | Description |
|---|---|---|
| name | string | vWAN name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
fn delete(name: string, resourceGroup?: string)
Delete a Virtual WAN.
| Argument | Type | Description |
|---|---|---|
| name | string | vWAN name |
| resourceGroup? | string | Resource group name |
fn listHubs()
List all virtual hubs in a resource group (or subscription).
fn getHub(name: string, resourceGroup?: string)
Get a single virtual hub.
| Argument | Type | Description |
|---|---|---|
| name | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
fn createHub(name: string, resourceGroup?: string, location: string, vwanName: string)
Create a virtual hub within a vWAN.
| Argument | Type | Description |
|---|---|---|
| name | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
| vwanName | string | Parent vWAN name |
fn deleteHub(name: string, resourceGroup?: string)
Delete a virtual hub.
| Argument | Type | Description |
|---|---|---|
| name | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
fn listHubConnections(hubName: string, resourceGroup?: string)
List all VNet connections to a virtual hub.
| Argument | Type | Description |
|---|---|---|
| hubName | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
fn createHubConnection(name: string, hubName: string, resourceGroup?: string)
Connect a VNet to a virtual hub.
| Argument | Type | Description |
|---|---|---|
| name | string | Connection name |
| hubName | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
fn deleteHubConnection(name: string, hubName: string, resourceGroup?: string)
Remove a VNet connection from a virtual hub.
| Argument | Type | Description |
|---|---|---|
| name | string | Connection name |
| hubName | string | Virtual hub name |
| resourceGroup? | string | Resource group name |
fn listVpnSites()
List all VPN sites in a resource group (or subscription).
fn getVpnSite(name: string, resourceGroup?: string)
Get a single VPN site.
| Argument | Type | Description |
|---|---|---|
| name | string | VPN site name |
| resourceGroup? | string | Resource group name |
fn createVpnSite(name: string, resourceGroup?: string, location: string, vwanName: string, deviceModel?: string)
Create a VPN site (branch office) configuration.
| Argument | Type | Description |
|---|---|---|
| name | string | VPN site name |
| resourceGroup? | string | Resource group name |
| location | string | Azure region |
| vwanName | string | Associated vWAN name |
| deviceModel? | string | VPN device model |
fn deleteVpnSite(name: string, resourceGroup?: string)
Delete a VPN site.
| Argument | Type | Description |
|---|---|---|
| name | string | VPN site name |
| resourceGroup? | string | Resource group name |
fn listVpnGateways()
List all site-to-site VPN gateways in a resource group (or subscription).
fn getVpnGateway(name: string, resourceGroup?: string)
Get a single VPN gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | VPN gateway name |
| resourceGroup? | string | Resource group name |
fn setVpnGatewayScaleUnit(name: string, resourceGroup?: string)
Set the scale unit count on a site-to-site VPN gateway. Each scale unit is 500 Mbps of aggregate tunnel throughput and is billed hourly whether or not tunnels carry traffic, so this is the primary cost lever on a vWAN S2S gateway. Idempotent — a no-op when the gateway is already at the requested count. Re-provisioning briefly interrupts every tunnel on the gateway.
| Argument | Type | Description |
|---|---|---|
| name | string | VPN gateway name |
| resourceGroup? | string | Resource group name |
fn inventory(resourceGroup?: string)
Inventory the complete vWAN topology — vWAN, hubs, hub connections, VPN sites, and VPN gateways in a resource group.
| Argument | Type | Description |
|---|---|---|
| resourceGroup? | string | Resource group name |
Resources
vwan(infinite)— Azure Virtual WAN
virtualHub(infinite)— Virtual hub within a vWAN
hubConnection(infinite)— VNet connection to a virtual hub
vpnSite(infinite)— VPN site (branch office) configuration
vpnGateway(infinite)— Site-to-site VPN gateway in a virtual hub
04Workflows
@dougschaefer/provision-entra-user5fe81c5c-677b-43ea-b6de-b74d2b60ae28
Operator-facing entrypoint to provision a new Entra ID user from non-secret profile fields. Delegates to @dougschaefer/azure-ad-user.provision on the `entra-users` instance, which generates a single-use temporary password in-process (force-change-on-next-sign-in) and discards it — no credential is ever an input, logged, persisted to model data, or vaulted. Only the non-secret action and profile fields land in swamp's audit trail.
provisionCreate the directory user via the azure-ad-user model.
1.create-userentra-users.provision— Generate a single-use temp password in-process and create the account with force-change-on-next-sign-in.
@dougschaefer/azure-rbac-audit54073e15-c3b5-478a-bf01-0fe073d14fc0
Subscription RBAC snapshot for access reviews: every role assignment at every scope (including management-group inheritance on az CLI 2.87+), every deny assignment, and every custom role definition, captured as versioned model data. Runs against an @dougschaefer/azure-role-assignment instance named `rbac-assignments`. Read-only — changes nothing. Steps run sequentially because they share one model's lock. Set fast to true to skip principal/role-name resolution on large tenants.
auditCapture assignments, deny assignments, and custom roles.
1.list-assignmentsrbac-assignments.list— List role assignments at all scopes visible to the subscription, including management-group-inherited entries.
2.list-deny-assignmentsrbac-assignments.listDenyAssignments— List deny assignments — Azure-managed blocks that override any role grant (managed applications, Blueprints, deployment stacks).
3.list-custom-rolesrbac-assignments.listDefinitions— List custom (non-built-in) role definitions so reviewers can see exactly what any bespoke role permits.
@dougschaefer/azure-ai-inventory9f05e1c0-a5ce-4ddd-a12f-81dabad11011
Subscription AI footprint snapshot: every AI Services / Cognitive Services account (Foundry AIServices, OpenAI, Face, Speech, ...), every model deployment on every account (single fan-out run), and every AI Search service, captured as versioned model data. Read-only — changes nothing. Runs against an @dougschaefer/azure-ai-foundry instance named `ai-foundry` and an @dougschaefer/azure-ai-search instance named `ai-search`. The account/deployment steps run sequentially (shared model lock); the sea
inventoryCapture AI accounts, model deployments, and search services.
1.list-accountsai-foundry.listAccounts— List all AI Services / Cognitive Services accounts in the subscription, any kind.
2.list-deploymentsai-foundry.listDeployments— Fan out across every account and capture each model deployment (deployed model name, version, SKU, capacity).
3.list-search-servicesai-search.list— List AI Search services subscription-wide — the retrieval layer behind Foundry RAG agents.
@dougschaefer/azure-cost-review815ea2a3-2c27-4c03-b11f-cbbc89060ec8
Repeatable Azure cost review for a subscription. Pulls actual billed spend from Cost Management sliced three ways (by service for the shape of the bill, by meter to expose silent rate changes such as an added VPN scale unit or connection unit, and by resource to rank individual line items), then gathers the evidence needed to act on it: per-VM CPU and network utilization, a network-spend audit that checks whether expensive plumbing is actually in the data path, an orphaned-resource sweep, and fi
spendWhat was actually billed, sliced three ways. These steps are the factual backbone of the review and must succeed for the run to be meaningful.
1.cost-by-service— Billed cost per Azure service per month — the top-level shape of the bill and the fastest way to see whether compute or network dominates.
2.cost-by-meter— Billed cost per meter per month. This is the slice that catches silent increases a service-level rollup hides — an added gateway scale unit, a new connection unit per branch, or a firewall tier change all show up here as a changed hour count on a specific meter.
3.cost-by-resource— Billed cost per individual resource, ranking the specific line items so the largest few can be attacked directly.
evidenceThe measurements and findings needed to decide what to change. These steps are additive — each is allowed to fail so that a single throttled or unavailable API still leaves a usable review rather than no review at all.
1.vm-utilization— Per-VM CPU and network utilization over the window, with an idle/oversized verdict. Network counters carry as much weight as CPU: they are what separates a genuinely idle VM from a quiet appliance that is still serving.
2.network-audit— Checks whether network spend is earning its price — secured-hub firewall actually in the data path, broad allow rules shadowing narrower ones, gateway scale units against observed peak throughput, and tunnels with no measured traffic. Link liveness is judged from time-series metrics rather than the gateway's cumulative byte counters, which reset on re-provision and would otherwise report busy tunnels as dead.
3.orphan-sweep— Resources that bill without serving anything — unattached disks, public IPs associated with nothing, ownerless NICs, and stale snapshots.
4.advisor— First-party Azure Advisor cost recommendations and Consumption reservation recommendations, collected last so they are read against the utilization and audit evidence above rather than on their own.
@dougschaefer/boards-state-rollup584d6379-ca70-4bcf-93fa-51218972fe73
Roll Azure Boards parent work-item state up from children: a parent moves to in-progress as soon as any child starts, and to done once every child is done. Azure DevOps cannot do this natively. Inherited-process rules only act on the work item that triggered them — no rule action writes to a parent — and the stock Basic process is a system process that cannot carry custom rules at all. Marketplace extensions close the gap by taking org-wide board write access; this workflow keeps the writes insi
rollupSweep the project and reconcile parent states against their children.
1.reconcile-parent-statesazure-boards.rollupParentStates— Fan-out sweep: one call reads every work item in the project via WIQL, computes each parent's desired state from its children bottom-up, and patches only the ones that differ. A single call rather than a loop of per-epic calls, so the model lock is taken once. Writes a `rollup` resource recording what changed — or what would change, on a dry run — which is the audit record for the sweep.
05Previous Versions
2026.07.24.2
2026.07.24.2 — add azure-monitor.setDiagnosticSetting for idempotent, resource-specific diagnostic settings. azure-cost.auditNetworkSpend gains a no-diagnostic-logging check (an expensive security appliance emitting no logs) and no longer reports a firewall's deployment cost as recoverable savings, since DNAT must be re-homed first.
Modified 1 models
2026.07.24.1
Add @dougschaefer/azure-cost — actual-spend analysis and waste auditing via Cost Management, Resource Graph, Advisor and Consumption APIs (queryCosts, vmUtilization, auditNetworkSpend, findOrphans, advisorCostRecommendations). Add setVpnGatewayScaleUnit to azure-vwan for vWAN S2S gateway right-sizing. Add azure-cost-review workflow. Shared armToken/armRequest helpers.
Added 1, modified 1 models. Added 1 workflows. updated labels
2026.07.17.1
azure-ad-service-principal: add listAppRoleAssignments (paginated via @odata.nextLink) and listSynchronizationJobs. Community PR #4 by @webframp.
Modified 1 models
2026.07.14.1
v2026.07.14.1 — Azure Boards parent-state rollup: new rollupParentStates method (one WIQL sweep, bottom-up desired-state computation, advance-only by default, configurable state names for Basic/Agile/Scrum) that fills the gap where ADO rules can never write to a parent, plus the @dougschaefer/boards-state-rollup workflow bundle. All 42 model versions realigned.
Modified 1 models. Added 1 workflows
2026.07.10.3
Community contribution from NeilHanlon (github.com/dougschaefer6/swamp-azure PR #3): four read-only model types — azure-postgres-flexible-server (servers/databases/firewall rules), azure-recovery-services-vault (vaults + backup items), azure-log-analytics-workspace, azure-network-interface (38→42 types). App Service and Container Apps portions of the PR were declined in favor of composing with @rkcoleman/azure-app-service and @rkcoleman/azure-containers.
Added 4 models. updated labels
2026.07.10.2
AI + app development expansion: new azure-ai-foundry (AI Services accounts, model deployment create/delete, Foundry projects/connections via ARM, per-region model catalog + quota snapshots, fan-out deployment sweep), azure-ai-search lifecycle, and read-only azure-cosmos, azure-staticwebapp, azure-servicebus, azure-eventgrid inventory models (32→38 types); new bundled azure-ai-inventory workflow. Data-plane keys deliberately never fetched.
Added 6 models. Added 1 workflows. updated labels
2026.07.10.1
az CLI 2.88 alignment: managed-identity update + federated credentials (workload identity federation, incl. preview claims-matching expressions), RBAC deny-assignment listing + fast bulk list flags, VM hibernate on deallocate, new bundled azure-rbac-audit workflow
Modified 2 models. Added 1 workflows
2026.07.06.1
Sync deno fmt line-wrap fix (face.ts) after swamp update to 20260706.015952.0
2026.06.29.1
Add model JSDoc to azure-vm (symbols-docs scoring); republish to sync current source (incl. folded-in Face capabilities) to registry/GitHub.
Added 32, removed 1 models. updated labels
2026.05.27.3
Added 1, removed 1 workflows
2026.05.27.2
Security: genericized production IP and internal references in JSDoc. No functional change to any model.
2026.05.27.1
Modified 1 models. Added 1 workflows
2026.05.26.2
Added 7, modified 1 models. updated labels
2026.05.26.1
Align model version fields with manifest (2026.05.26.1); republish under swamp 20260526 conventions
2026.05.21.1
Add azure-ssh-key model (Microsoft.Compute/sshPublicKeys via az sshkey): list/get/sync/create/delete. Contributed by @randybias (PR #2), live-validated create→get→sync→list→delete on Hub subscription.
Added 1 models
2026.05.13.1
Add JSDoc to model entrypoints for rubric v2 symbols-docs
Bump to v2026.05.13.1. Adds a prose JSDoc block above each export const model so the new symbols-docs quality factor passes. No behavior changes.
2026.04.27.1
Add curated README and LICENSE to tarball (additionalFiles), bringing extension's Swamp Club quality grade from F/B to A-/B.
2026.04.13.1
Add .meta({ sensitive: true }) to VM adminPassword and sshKeyValue fields
2026.04.02.1
Add firewall policy rule management: createRuleCollectionGroup, deleteRuleCollectionGroup, addFilterCollection, addNatCollection, addRule, removeRule, removeCollection
Modified 1 models
06Stats
A
100 / 100
Downloads
41
Archive size
233.9 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned
07Platforms
08Labels