# Interactive login – opens a browser
az login

# If you prefer a service principal for CI/CD:
az login --service-principal -u <APP_ID> -p <PASSWORD> --tenant <TENANT_ID>

az account set --subscription <SUB_ID>

# Create a venv (recommended)
python -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate

# Install Azure SDK packages
pip install --upgrade pip
pip install azure-identity azure-mgmt-resource azure-mgmt-monitor azure-mgmt-keyvault azure-graphrbac
# Optional: for Microsoft Graph (sign‑in logs)
pip install msgraph-core

# Initialize a Node project (if you don't have one)
npm init -y

# Install Azure SDK packages
npm install @azure/identity @azure/arm-resources @azure/arm-monitor @azure/keyvault-secrets @microsoft/microsoft-graph-client
# TypeScript typings (if using TS)
npm install -D @types/node typescript ts-node

#!/usr/bin/env python3
"""
Azure Security Health‑Check Script
----------------------------------
* Detects publicly exposed storage accounts & VMs
* Flags service‑principal secrets older than DAYS_THRESHOLD
* Pulls risky sign‑ins from Microsoft Graph (if licensed)
* Evaluates a sample Azure Policy (MFA for privileged roles)

Requires:
    AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
    (or Managed Identity / Azure CLI login)

Run:
    python azure_security_check.py
"""

import os
import datetime
from typing import List

from azure.identity import DefaultAzureCredential
from azure.mgmt.resource import ResourceManagementClient
from azure.mgmt.compute import ComputeManagementClient
from azure.mgmt.storage import StorageManagementClient
from azure.mgmt.keyvault import KeyVaultManagementClient
from azure.mgmt.keyvault.v7_0.models import VaultProperties
from msgraph.core import GraphClient  # pip install msgraph-core

# -------------------------- CONFIG --------------------------
SUBSCRIPTION_ID = os.getenv("AZURE_SUBSCRIPTION_ID")
DAYS_THRESHOLD = int(os.getenv("CREDENTIAL_AGE_DAYS", "90"))  # secrets older than this are flagged
# -----------------------------------------------------------

def get_credential():
    """DefaultAzureCredential tries Env, Managed Identity, VS Code, Azure CLI."""
    return DefaultAzureCredential(exclude_interactive_browser_credential=False)

def list_public_storage_accounts(storage_client: StorageManagementClient) -> List[str]:
    """Return names of storage accounts with public blob access."""
    public = []
    for acct in storage_client.storage_accounts.list():
        # acct.enable_https_traffic_only is a security flag; we also check network rule set
        if acct.allow_blob_public_access:  # True if public access allowed
            public.append(acct.name)
    return public

def list_vms_with_public_ip(compute_client: ComputeManagementClient) -> List[str]:
    """Return VM names that have a public IP address attached."""
    vms_with_pip = []
    for vm in compute_client.virtual_machines.list_all():
        # Expand to get network profile details
        vm_instance = compute_client.virtual_machines.get(
            resource_group_name=vm.id.split("/")[4],
            vm_name=vm.name,
            expand='instanceView'
        )
        # Simplified: check if any NIC has a public IP
        for nic_ref in vm_instance.network_profile.network_interfaces:
            nic_name = nic_ref.id.split("/")[-1]
            # In a real script you'd call the Network client to get NIC details.
            # For brevity we assume a tag or naming convention indicates public IP.
            # Replace with actual NetworkManagementClient call in production.
            if "pub" in nic_name.lower():
                vms_with_pip.append(vm.name)
                break
    return vms_with_pip

def list_stale_service_principals(graph_client: GraphClient) -> List[dict]:
    """Query Microsoft Graph for service principals with credentials older than DAYS_THRESHOLD."""
    stale = []
    # Graph endpoint: /servicePrincipals?$filter=accountEnabled eq true
    # We'll pull a page and inspect keyCredentials & passwordCredentials
    query = f"/servicePrincipals?$select=id,displayName,keyCredentials,passwordCredentials&$top=999"
    resp = graph_client.get(query)
    if resp.status_code != 200:
        raise RuntimeError(f"Graph error: {resp.status_code} {resp.text}")
    data = resp.json()
    for sp in data.get("value", []):
        now = datetime.datetime.utcnow()
        for cred in sp.get("keyCredentials", []) + sp.get("passwordCredentials", []):
            # cred contains 'startDateTime' and 'endDateTime' (ISO strings)
            end_str = cred.get("endDateTime")
            if not end_str:
                continue
            end_dt = datetime.datetime.fromisoformat(end_str.rstrip("Z"))
            age_days = (now - end_dt).days
            if age_days > DAYS_THRESHOLD:
                stale.append({
                    "objectId": sp["id"],
                    "displayName": sp.get("displayName"),
                    "credentialType": "key" if cred in sp.get("keyCredentials", []) else "password",
                    "ageDays": age_days,
                    "endDateTime": end_str
                })
    return stale

def get_risky_signins(graph_client: GraphClient, lookback_hours: int = 24) -> List[dict]:
    """Pull risky sign‑ins from Azure AD Identity Protection (requires P1/P2)."""
    # Microsoft Graph beta endpoint: /identityProtection/riskyUsers
    # For sign‑ins: /identityProtection/riskyDetections
    # We'll use the simpler risky sign‑ins API:
    now = datetime.datetime.utcnow()
    start_time = (now - datetime.timedelta(hours=lookback_hours)).isoformat() + "Z"
    query = f"/identityProtection/riskyDetections?$filter=createdDateTime ge {start_time}"
    resp = graph_client.get(query)
    if resp.status_code != 200:
        raise RuntimeError(f"Graph risky sign‑ins error: {resp.status_code} {resp.text}")
    return resp.json().get("value", [])

def evaluate_mfa_policy(policy_client) -> bool:
    """
    Placeholder: In a real scenario you would call Azure Policy Insights
    to evaluate a built‑in policy like 'Require MFA for privileged roles'.
    Here we simply return True to show where the call would go.
    """
    # Example (pseudo):
    # results = policy_client.policy_states.list_query_results_for_subscription(
    #     f"/subscriptions/{SUBSCRIPTION_ID}",
    #     options={"filter": f"policyAttribute eq 'Microsoft.Authorization/policyDefinitions/...'"}
    # )
    # return all(r.compliance_state == "Compliant" for r in results.value)
    return True  # Assume compliant for demo

def main():
    cred = get_credential()
    # Initialize clients
    resource_client = ResourceManagementClient(cred, SUBSCRIPTION_ID)
    compute_client = ComputeManagementClient(cred, SUBSCRIPTION_ID)
    storage_client = StorageManagementClient(cred, SUBSCRIPTION_ID)
    # Graph client (no subscription needed)
    graph_client = GraphClient(credential=cred, scopes=["https://graph.microsoft.com/.default"])

    print("=== Azure Security Health‑Check ===\n")

    # 1️⃣ Public storage accounts
    public_storage = list_public_storage_accounts(storage_client)
    if public_storage:
        print(f"[!] {len(public_storage)} storage account(s) allow public blob access:")
        for name in public_storage:
            print(f"    - {name}")
    else:
        print("[✓] No storage accounts with public blob access detected.")

    # 2️⃣ VMs with public IPs (simplified check)
    vms_pub = list_vms_with_public_ip(compute_client)
    if vms_pub:
        print(f"\n[!] {len(vms_pub)} VM(s) appear to have a public IP attached:")
        for name in vms_pub:
            print(f"    - {name}")
    else:
        print("\n[✓] No VMs with obvious public IP detected (check Network client for full accuracy).")

    # 3️⃣ Stale service‑principal credentials
    try:
        stale_sp = list_stale_service_principals(graph_client)
        if stale_sp:
            print(f"\n[!] {len(stale_sp)} service principal(s) have credentials older than {DAYS_THRESHOLD} days:")
            for sp in stale_sp:
                print(f"    - {sp['displayName']} ({sp['objectId']}) "
                      f"{sp['credentialType']} credential age: {sp['ageDays']} days "
                      f"(expires {sp['endDateTime']})")
        else:
            print(f"\n[✓] No service‑principal credentials older than {DAYS_THRESHOLD} days found.")
    except Exception as e:
        print(f"\n[⚠] Could not evaluate service‑principal credentials: {e}")

    # 4️⃣ Risky sign‑ins (last 24 h)
    try:
        risky = get_risky_signins(graph_client, lookback_hours=24)
        if risky:
            print(f"\n[!] {len(risky)} risky sign‑in detection(s) in the last 24 h:")
            for r in risky[:5]:  # show first 5
                print(f"    - User: {r.get('userDisplayName')} | Risk: {r.get('riskLevel')} | "
                      f"Type: {r.get('riskEventType')} | Time: {r.get('createdDateTime')}")
            if len(risky) > 5:
                print(f"    ... and {len(risky)-5} more.")
        else:
            print("\n[✓] No risky sign‑ins detected in the last 24 h.")
    except Exception as e:
        print(f"\n[⚠] Could not query risky sign‑ins (maybe missing Azure AD P1/P2 license): {e}")

    # 5️⃣ Azure Policy compliance (MFA for privileged roles)
    mfa_ok = evaluate_mfa_policy(None)  # pass real policy client in prod
    if mfa_ok:
        print("\n[✓] Azure Policy for MFA on privileged roles is compliant.")
    else:
        print("\n[!] Azure Policy for MFA on privileged roles is NON‑COMPLIANT – remediate!")

    print("\n=== Health‑Check Complete ===")

if __name__ == "__main__":
    main()

/**
 * Azure Security Health‑Check (Node.js/TS)
 * -------------------------------------------------
 * Same functionality as the Python script but using the Azure SDK for JS.
 *
 * Prerequisites (env vars):
 *   AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
 *
 * To run:
 *   npx ts-node azure-security-check.ts   # if you have ts-node installed
 *   # or compile: tsc azure-security-check.ts && node azure-security-check.js
 */

import { DefaultAzureCredential } from "@azure/identity";
import {
  ResourceManagementClient,
  ComputeManagementClient,
  StorageManagementClient,
} from "@azure/arm-resources"; // actually separate packages; see imports below
import { GraphClient } from "@microsoft/microsoft-graph-client";
import * as dotenv from "dotenv";

dotenv.config(); // loads .env file into process.env

const SUBSCRIPTION_ID = process.env.AZURE_SUBSCRIPTION_ID!;
const DAYS_THRESHOLD = parseInt(process.env.CREDENTIAL_AGE_DAYS ?? "90", 10);

// ------------------------------------------------------------------
// Helper: create Azure SDK clients
// ------------------------------------------------------------------
const credential = new DefaultAzureCredential({
  excludeInteractiveBrowserCredential: false,
});

const resourceClient = new ResourceManagementClient(credential, SUBSCRIPTION_ID);
const computeClient = new ComputeManagementClient(credential, SUBSCRIPTION_ID);
const storageClient = new StorageManagementClient(credential, SUBSCRIPTION_ID);

// Microsoft Graph client (requires delegated permission: IdentityRiskEvent.Read.All)
const graphClient = GraphClient.init({
  authProvider: (done) => {
    credential.getToken(["https://graph.microsoft.com/.default"]).then(
      (tokenInfo) => done(null, tokenInfo.token),
      (err) => done(err, null)
    );
  },
});

// ------------------------------------------------------------------
// 1️⃣ Public storage accounts
// ------------------------------------------------------------------
async function listPublicStorageAccounts(): Promise<string[]> {
  const publicAccounts: string[] = [];
  for await const acct of storageClient.storageAccounts.list()) {
    if (acct.allowBlobPublicAccess) {
      publicAccounts.push(acct.name!);
    }
  }
  return publicAccounts;
}

// ------------------------------------------------------------------
// 2️⃣ VMs with public IPs (simplified)
// ------------------------------------------------------------------
async function listVmsWithPublicIp(): Promise<string[]> {
  const vms: string[] = [];
  for await const vm of computeClient.virtualMachines.listAll()) {
    // In production, call the Network client to inspect NICs.
    // Here we use a naming convention as a placeholder.
    if (vm.name?.toLowerCase().includes("pub")) {
      vms.push(vm.name);
    }
  }
  return vms;
}

// ------------------------------------------------------------------
// 3️⃣ Stale service‑principal credentials (Microsoft Graph)
// ------------------------------------------------------------------
interface StaleSP {
  objectId: string;
  displayName?: string;
  credentialType: "key" | "password";
  ageDays: number;
  endDateTime: string;
}
async function getStaleServicePrincipals(): Promise<StaleSP[]> {
  const stale: StaleSP[] = [];
  const now = new Date();
  const thresholdDate = new Date(now.getTime() - DAYS_THRESHOLD * 24 * 60 * 60 * 1000);

  // Paginate through servicePrincipals (max 999 per page)
  let nextLink = "/servicePrincipals?$select=id,displayName,keyCredentials,passwordCredentials&$top=999";
  while (nextLink) {
    const resp = await graphClient.api(nextLink).get();
    const value = value as any[] ?? resp.value;
    for (const sp of value) {
      const creds = [...(sp.keyCredentials ?? []), ...(sp.passwordCredentials ?? [])];
      for (const cred of creds) {
        const endStr = cred.endDateTime;
        if (!endStr) continue;
        const endDate = new Date(endStr);
        if (endDate < thresholdDate) {
          stale.push({
            objectId: sp.id,
            displayName: sp.displayName,
            credentialType: cred.keyId ? "key" : "password",
            ageDays: Math.floor((now.getTime() - endDate.getTime()) / (1000 * 60 * 60 * 24)),
            endDateTime: endStr,
          });
        }
      }
    }
    nextLink = resp["@odata.nextLink"] ?? null;
  }
  return stale;
}

// ------------------------------------------------------------------
// 4️⃣ Risky sign‑ins (last 24 h)
// ------------------------------------------------------------------
interface RiskySignIn {
  userDisplayName?: string;
  riskLevel: string;
  riskEventType: string;
  createdDateTime: string;
}
async function getRiskySignins(hours = 24): Promise<RiskySignIn[]> {
  const start = new Date(Date.now() - hours * 60 * 60 * 1000)
    .toISOString()
    .replace(/\.\d+/, "") // strip ms
    + "Z";
  const filter = `createdDateTime ge ${start}`;
  const resp = await graphClient
    .api(`/identityProtection/riskyDetections`)
    .filter(filter)
    .get();
  return resp.value as RiskySignIn[];
}

// ------------------------------------------------------------------
// 5️⃣ Placeholder for Azure Policy MFA check
// ------------------------------------------------------------------
async def evaluateMfaPolicy(): Promise<boolean> {
  // In real code: use @azure/arm-policyinsights
  // For demo, assume compliant.
  return true;
}

// ------------------------------------------------------------------
// Main orchestration
// ------------------------------------------------------------------
(async () => {
  console.log("=== Azure Security Health‑Check (JS/TS) ===\n");

  // 1️⃣ Public storage
  const publicStorage = await listPublicStorageAccounts();
  if (publicStorage.length) {
    console.log(`[!] ${publicStorage.length} storage account(s) allow public blob access:`);
    publicStorage.forEach((n) => console.log(`    - ${n}`));
  } else {
    console.log("[✓] No storage accounts with public blob access detected.");
  }

  // 2️⃣ VMs with public IP (placeholder)
  const vmsPub = await listVmsWithPublicIp();
  if (vmsPub.length) {
    console.log(`\n[!] ${vmsPub.length} VM(s) appear to have a public IP attached:`);
    vmsPub.forEach((n) => console.log(`    - ${n}`));
  } else {
    console.log("\n[✓] No VMs with obvious public IP detected (see note in code).");
  }

  // 3️⃣ Stale SP credentials
  try {
    const staleSP = await getStaleServicePrincipals();
    if (staleSP.length) {
      console.log(
        `\n[!] ${staleSP.length} service principal(s) have credentials older than ${DAYS_THRESHOLD} days:`
      );
      staleSP.forEach((sp) => {
        console.log(
          `    - ${sp.displayName ?? sp.objectId} (${sp.objectId}) ${sp.credentialType} credential age: ${sp.ageDays} days (expires ${sp.endDateTime})`
        );
      });
    } else {
      console.log(
        `\n[✓] No service‑principal credentials older than ${DAYS_THRESHOLD} days found.`
      );
    }
  } catch (e) {
    console.error("\n[⚠] Failed to evaluate service‑principal credentials:", e);
  }

  // 4️⃣ Risky sign‑ins
  try {
    const risky = await getRiskySignins(24);
    if (risky.length) {
      console.log(`\n[!] ${risky.length} risky sign‑in detection(s) in the last 24 h:`);
      risky.slice(0, 5).forEach((r) => {
        console.log(
          `    - User: ${r.userDisplayName ?? "unknown"} | Risk: ${r.riskLevel} | Type: ${r.riskEventType} | Time: ${r.createdDateTime}`
        );
      });
      if (risky.length > 5) console.log(`    ... and ${risky.length - 5} more.`);
    } else {
      console.log("\n[✓] No risky sign‑ins detected in the last 24 h.");
    }
  } catch (e) {
    console.error("\n[⚠] Could not query risky sign‑ins (maybe missing Azure AD P1/P2 license):", e);
  }

  // 5️⃣ MFA policy
  const mfaOk = await evaluateMfaPolicy();
  if (mfaOk) {
    console.log("\n[✓] Azure Policy for MFA on privileged roles is compliant.");
  } else {
    console.log("\n[!] Azure Policy for MFA on privileged roles is NON‑COMPLIANT – remediate!");
  }

  console.log("\n=== Health‑Check Complete ===");
})();

# 1️⃣ Install deps
npm install @azure/identity @azure/arm-resources @azure/arm-monitor @azure/keyvault-secrets @microsoft/microsoft-graph-client dotenv

# 2️⃣ Create a .env file (never commit this!)
cat > .env <<EOF
AZURE_TENANT_ID=<your-tenant-id>
AZURE_CLIENT_ID=<your-app-id>
AZURE_CLIENT_SECRET=<your-client-secret>
AZURE_SUBSCRIPTION_ID=<your-subscription-id>
CREDENTIAL_AGE_DAYS=90
EOF

# 3️⃣ Execute
npx ts-node azure-security-check.ts   # or compile first: tsc azure-security-check.ts && node azure-security-check.js

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

kv_name = os.getenv("KEYVAULT_NAME")
kv_uri = f"https://{kv_name}.vault.azure.net/"
credential = DefaultAzureCredential()
client = SecretClient(vault_url=kv_uri, credential=credential)
sp_secret = client.get_secret("AzureSpSecret").value

import { DefaultAzureCredential } from "@azure/identity";
import { SecretClient } from "@azure/keyvault-secrets";

const kvName = process.env.KEYVAULT_NAME;
const kvUri = `https://${kvName}.vault.azure.net/`;
const credential = new DefaultAzureCredential();
const client = new SecretClient(kvUri, credential);
const spSecret = await client.getSecret("AzureSpSecret");

import logging, sys
logging.basicConfig(level=logging.DEBUG, stream=sys.stdout)

process.env.AZURE_LOG_LEVEL = "info"; // or "verbose"