An Inside Look at the Secure DevOps Kit for Microsoft Azure (AzSK)

Many challenges in cloud security come from the sheer scale of modern deployments. When you manage only a handful of servers, a manual review process can work. As infrastructure grows to dozens of subscriptions and hundreds of resource groups, however, manual security checks become impractical and error-prone.

DevOps practices compound the challenge: the speed of continuous delivery increases the risk that a misconfigured resource slips through unnoticed. This is the problem that Microsoft’s own IT department — which reportedly runs the majority of its internal applications on Azure — sought to solve. The result is the Secure DevOps Kit for Azure, commonly abbreviated AzSK. It is open source and published on GitHub. This article walks through installation, core scanning commands, auto-remediation, attestation, CI/CD integration, and continuous assurance.

What Is AzSK?

AzSK is a collection of PowerShell cmdlets and Azure DevOps extensions that enforce a security baseline across the full DevOps lifecycle:

• Subscription scanning — checks subscription-level settings such as Security Center configuration, alerts, and ARM policies.
• Resource group scanning — runs Security Verification Tests (SVTs) against all resources in a given resource group.
• CI/CD integration — an Azure DevOps marketplace extension that checks ARM templates and deployed resources as part of a pipeline.
• IDE integration — a Visual Studio extension called Security IntelliSense that flags insecure code patterns inline.
• Continuous assurance — a scheduled scan that feeds results into Azure Monitor Log Analytics to catch configuration drift over time.

Installation

AzSK requires PowerShell 5.0 or later on Windows. Install the module from the PowerShell Gallery with:

Install-Module AzSK -Scope CurrentUser

If you encounter conflicts with existing modules, add the -AllowClobber flag:

Install-Module AzSK -Scope CurrentUser -AllowClobber

The kit is updated monthly. If your installed version falls more than two releases behind, AzSK will display error messages prompting you to upgrade. Re-running the install command above will update to the latest version. To enable automatic update prompts, run:

Set-AzSKPolicySettings -AutoUpdate OnCode language: JavaScript (javascript)

AzSK has been updated to use the Az PowerShell modules. If you have the older AzureRM modules installed, uninstall them before proceeding to avoid conflicts.

Scanning a Subscription

Start by authenticating to Azure:

Connect-AzAccount

Then run the subscription-level scan cmdlet (replace the placeholder with your subscription ID):

Get-AzSKSubscriptionSecurityStatus -SubscriptionId <your-subscription-id>Code language: HTML, XML (xml)

After the scan completes, a folder opens automatically containing:

• A SecurityReport.csv summary file
• Subfolders with detailed log files

Open SecurityReport.csv in Excel and filter on the Status column. The two most important statuses are:

• Failed — a control was checked automatically and did not pass.
• Verify — the control cannot be checked automatically; it requires manual review.

A Recommendation column in the CSV describes the remediation steps for each failed control. Common subscription-level findings include:

• Azure Security Center not configured with the correct contact details (Set-AzSKAzureSecurityCenterPolicies)
• Missing subscription alerts (Set-AzSKAlerts)
• No ARM policies configured (Set-AzSKARMPolicies)
• Azure Security Center Standard tier not enabled

Scanning a Resource Group

To run Security Verification Tests (SVTs) against all resources in a specific resource group, use:

Get-AzSKAzureServicesSecurityStatus -SubscriptionId <your-subscription-id> -ResourceGroupNames <rg-name>Code language: HTML, XML (xml)

The scan duration scales with the number of resources in the group. Output is the same CSV and log structure as the subscription scan. If you prefer PDF output, add the -GeneratePDF flag, which supports both landscape and portrait orientations:

Get-AzSKAzureServicesSecurityStatus -SubscriptionId <your-subscription-id> -ResourceGroupNames <rg-name> -GeneratePDF LandscapeCode language: HTML, XML (xml)

Automatic Remediation with -GenerateFixScript

Both subscription and resource-group scan cmdlets accept a -GenerateFixScript flag. When specified, AzSK produces a remediation script alongside the normal report output. The results folder will contain an additional FixControlScripts subfolder with two files:

• RunFixScript.ps1 — the remediation script to execute
• FixControlConfig.json — a parameters file (IP addresses, usernames, and so on) that you may need to edit before running the script

The SecurityReport.csv includes a column indicating which controls are eligible for auto-fix. Review the config file carefully before executing the fix script in a production environment.

Attestation: Acknowledging Accepted Risk

Sometimes a control failure represents an accepted, documented risk rather than something that needs to be fixed — for example, a legacy workload that cannot be migrated immediately. AzSK supports attestation to prevent known accepted exceptions from cluttering future scan reports.

Pass the -ControlsToAttest switch to either scan cmdlet. After the normal scan completes, AzSK enters an interactive attestation mode in which you provide a justification and disposition for each flagged control. The attestation record — including who provided it and when — is stored in the subscription inside a dedicated resource group named AzSKRG.

Default attestation expiry periods by severity are:

Severity	Default Expiry
Critical	7 days
High	30 days
Medium	60 days
Low	90 days

A user needs Owner or Contributor permissions on the AzSKRG resource group to perform attestation, which limits this capability to authorized security personnel. For environments with many resources spread across multiple resource groups, AzSK also supports bulk attestation.

CI/CD Pipeline Integration

Running scans on demand is a good starting point, but real security hygiene requires checks to run automatically on every deployment. AzSK publishes an extension to the Azure DevOps Marketplace called the Secure DevOps Kit (AzSK) CICD Extensions for Azure. It provides two key pipeline tasks:

• ARM Template Checker — validates infrastructure-as-code templates before deployment.
• SVT Task — runs Security Verification Tests against resources that have already been deployed.

When a check fails, you can configure the pipeline to fail the deployment, send an email notification, or pause for manual approval. This gates insecure changes before they reach production.

Security IntelliSense for Visual Studio

For developers working in Visual Studio (2015 Update 3 and later, 2017, and 2019), the Security IntelliSense extension surfaces security issues directly in the editor using red and green squiggles, similar to standard syntax error highlighting. This shifts security feedback even further left — to the moment code is written.

Continuous Assurance: Catching Configuration Drift

Pipeline checks and on-demand scans are point-in-time assessments. A resource that passes a deployment scan can drift into a non-compliant state later — for example, if someone manually changes a network security group rule or disables an audit policy through the portal. Continuous Assurance addresses this by scheduling recurring scans that feed results into Azure Monitor Log Analytics.

Prerequisites for Continuous Assurance:

• A Log Analytics workspace configured in Azure Monitor
• AzSK running on Windows 10 or Windows Server 2016

To enable Continuous Assurance on a subscription, run:

Install-AzSKContinuousAssurance -SubscriptionId <your-subscription-id> `
    -ResourceGroupNames <comma-separated-rg-names> `
    -LAWSId <log-analytics-workspace-id> `
    -LAWSSharedKey <log-analytics-shared-key>Code language: HTML, XML (xml)

Once configured, AzSK runs scans on a schedule and pushes results to Log Analytics, where you can build dashboards and alerts to track the security posture of all subscriptions across the entire DevOps lifecycle from a single pane of glass.

Summary

AzSK provides a layered approach to Azure security that matches the pace of DevOps delivery:

• Ad-hoc scans establish a baseline and identify existing issues.
• Auto-fix scripts accelerate remediation of common misconfigurations.
• Attestation formalizes accepted exceptions with an audit trail.
• CI/CD integration prevents regressions from reaching production.
• Continuous Assurance monitors for drift after deployment.

Because AzSK is open source, the controls it checks, the fix scripts it generates, and the policies it enforces can all be reviewed and customized to fit your organization’s requirements.