This repository is the Azure Enterprise-Scale (ALZ) reference implementation, providing infrastructure-as-code artifacts to deploy and govern multi-subscription Azure environments. It is not a runtime application but a deployment toolkit consisting of ARM templates, Bicep files, custom Azure Policy definitions/initiatives, custom role definitions, and PowerShell automation. The architecture follows the Cloud Adoption Framework's landing zone design, with a management group hierarchy, policy-driven governance, and modular networking topologies (hub-spoke, Virtual WAN). Key entry points include the main ARM deployment template (`eslzArm/eslzArm.json`), the portal accelerator (`eslzArm/eslz-portal.json`), and the Bicep-based policy compilation (`src/templates/policies.bicep`). Data flows are primarily declarative: policy definitions and assignments are deployed to management groups, which then enforce compliance on subscriptions and resources. External dependencies are entirely Azure-native: Azure Resource Manager, Azure Policy, Azure RBAC, and Azure networking services. The repository also includes a PowerShell module (`Alz.Tools`) for subscription alias creation, orphaned RBAC cleanup, and artifact conversion, plus a Pester-based test framework for policy validation.
This repository is a community-maintained toolkit for Microsoft Defender for Cloud (MDC), providing automation, configuration, and operational assets to extend and manage MDC capabilities. It contains hundreds of Azure Policy definitions, Logic App playbooks, PowerShell scripts, Azure Workbooks, and infrastructure-as-code templates (ARM, Bicep, Terraform) for enabling security controls, remediating recommendations, exporting security data, and integrating with external systems like Azure DevOps, ServiceNow, and Microsoft Sentinel. The repository also includes a production-grade connector (MDC Recommendations to Azure DevOps) built with Python Durable Functions, managed identity authentication, and modular Bicep infrastructure. Architecturally, the repo is a collection of loosely coupled, deployable artifacts rather than a single application. The most sophisticated component is the MDC-to-ADO connector, which uses an HTTP-triggered Durable Function to orchestrate enrichment (via Azure Resource Graph, Microsoft Graph, and MDC APIs), deduplication, and work item creation/update in Azure DevOps. It employs a consistent client pattern with tenacity retry, token caching, and OpenTelemetry tracing. Other notable patterns include DeployIfNotExists Azure Policies that create security automations, Logic Apps with managed identity for alert response, and PowerShell scripts for bulk operations and cost estimation. While the repository is actively maintained and contains several high-quality, reusable components, it also exhibits technical drift: many artifacts reference the deprecated 'Azure Security Center' name, use preview API versions, or contain hardcoded placeholder values. The overall quality is functional but uneven, with some components being production-ready and others requiring manual configuration or updates. The repository is best suited for security engineers and cloud architects looking for battle-tested automation patterns and reference implementations for Microsoft Defender for Cloud.