Skip to content

feat: RG Scorecard, Findings sheet, and Activity Log improvements#37

Merged
Daren9m merged 7 commits into
claude/azure-tenant-cleanup-strategy-dHLP3from
feature/v0.4.0-cross-reference-findings
Mar 20, 2026
Merged

feat: RG Scorecard, Findings sheet, and Activity Log improvements#37
Daren9m merged 7 commits into
claude/azure-tenant-cleanup-strategy-dHLP3from
feature/v0.4.0-cross-reference-findings

Conversation

@Daren9m
Copy link
Copy Markdown
Collaborator

@Daren9m Daren9m commented Mar 20, 2026

Summary

Cross-references cost, inventory, and activity data into actionable outputs. Also simplifies and improves the Activity Log phase.

New XLSX Worksheets

Findings (first sheet) — 44 auto-detected items:

  • 10 HIGH: 7 stopped VMs (disks billing), 3 idle SQL databases
  • 34 LOW: 25 empty RGs, 5 empty App Plans, 2 empty LBs, 1 unused NSG, 8 orphaned NICs
  • Each finding: priority, owner, RG monthly cost, recommended action

RG Scorecard — 97-100 resource groups with:

  • Monthly cost (Cost Management API)
  • Resource count and type count
  • Days since last activity, last caller
  • Dormant resource count and percentage

Activity Log Improvements

  • Replaced 26-job windowed approach with single query per subscription
  • Adaptive chunking: auto-halves window size when hitting 5K limit
  • Accepts all records with ResourceId (removed broken OperationName/Status filters)
  • Degrades gracefully when API returns sparse data

Test Plan

  • XLSX opens without errors
  • Findings sheet appears first with prioritized items
  • RG Scorecard shows cost + activity cross-reference
  • Phase 2 completes without errors
  • Cost data: $10K/mo across 85 RGs
  • 20 KQL queries + cost analysis + findings in 1.2 minutes

Addresses #34

🤖 Generated with Claude Code

Daren9m and others added 7 commits March 19, 2026 20:58
RG Scorecard: Joins cost + resource count + activity + dormancy per
resource group into a single view. Shows monthly cost, days since
last activity, dormant resource count, and dormancy percentage.

Findings sheet (moved to first position in workbook):
- Auto-detects actionable items from all discovery data
- Stopped VMs with disk costs still billing
- Idle/sample SQL databases (paused GP_S_Gen5, AdventureWorks)
- Empty App Service Plans (flags paid tiers as HIGH)
- Dormant RGs with high monthly cost
- Empty load balancers, orphaned NICs, unused NSGs
- Each finding includes: priority, owner, RG cost, recommended action
- Sorted by priority then cost impact

Tested against Procentrix Dev: 44 findings (10 HIGH, 34 LOW),
99 RGs cross-referenced with cost data.

Addresses #34

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Phase 2:
- Remove date windowing (13 windows x N subs = 26+ parallel jobs)
- Single query per subscription with server-side -Status Succeeded filter
- Client-side filter to human write/delete/action ops only (skip system noise)
- Expected: ~5-10s per sub instead of 60+ seconds

Phase 4:
- Same simplification — one query per sub instead of windowed
- Add Disable-AzContextAutosave to prevent token cache contention

The old approach downloaded 27K+ raw records across 26 parallel jobs
just to find "when was this last touched?" The new approach gets the
same answer from ~2K filtered records in one query per subscription.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The -Status "Succeeded" parameter on Get-AzActivityLog was filtering
too aggressively — returned only 2 raw records instead of thousands.
Moved status filtering to client-side where it works reliably.
Also removed the Caller "@" filter from Phase 2 (kept in Phase 4
where it's needed for human-only RG creation detection).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add /action$ alongside /write$ and /delete$ — captures operations
like VM start/stop, key regeneration, and other management actions
that indicate a resource is actively managed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When raw records are returned but no filtered records match, log
sample operation names and status values to understand why the
filter is dropping everything. Temporary diagnostic to fix the
0-records issue.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The OperationName.Value and Status.Value property paths return null
on some Az module versions, causing filters to drop all 5,000 records.
Simplified to only require a non-empty ResourceId — any activity log
record pointing to a resource is useful for last-touch tracking.

Removed diagnostic logging (no longer needed).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the initial 90-day query hits the 5000 record limit, automatically
re-queries in 7-day chunks. If a chunk also hits the limit, halves the
window size for remaining queries (down to 1-day minimum).

Degrades gracefully when Activity Log API returns sparse data —
cost data and KQL queries provide the primary staleness signals.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@Daren9m Daren9m changed the title feat: RG Scorecard + Findings sheet with cross-referenced data feat: RG Scorecard, Findings sheet, and Activity Log improvements Mar 20, 2026
@Daren9m Daren9m merged commit 1e01180 into claude/azure-tenant-cleanup-strategy-dHLP3 Mar 20, 2026
@Daren9m Daren9m deleted the feature/v0.4.0-cross-reference-findings branch March 20, 2026 06:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant