A collection of PowerShell scripts, Azure/DevOps tooling, and SQL utilities for managing cloud infrastructure, developer environments, and Active Directory.
scripts/dev-experience/New-DevMachine.ps1 bootstraps a new Windows 11 developer machine end-to-end via winget: PowerShell, Windows Terminal, PowerToys, Git/GitHub CLI, Azure CLI/Bicep, .NET SDK, Visual Studio, VS Code (with a curated critical extension set), SQL Server Developer Edition, Azure Functions Core Tools, Ollama (+ Phi-4 model pull), Microsoft Scout Agent, and Microsoft 365 Copilot. Node.js, Python, and Power Platform tooling are available as opt-in extras.
./scripts/dev-experience/New-DevMachine.ps1 -GitUserName "Your Name" -GitUserEmail "you@example.com"See docs/How-to Setup - Dev Machine.md for the full manual walkthrough this script automates.
Organized by intent: know your estate (governance), reduce risk (security), change things safely (resources), and run the platform (everything else).
| Folder | Purpose |
|---|---|
| docs/ | How-to guides and command references (AD, SQL, SSL, web, build server, Azure CLI). |
| scripts/azure-governance/ | Estate-wide inventory and FinOps hygiene via Azure Resource Graph (read-only). |
| scripts/azure-security/ | Posture and identity-hygiene reports: Key Vault audit, expiring app credentials (read-only). |
| scripts/azure-resources/ | Create/change/remove Azure resources: Key Vault, storage, SQL, Front Door, Logic Apps, Entra, Monitor. |
| scripts/azure-devops/ | Azure DevOps helpers (branch names, library variables, pull requests). |
| scripts/azure-functions/ | Local Azure Functions host and certificate helpers. |
| scripts/cybersecurity/ | Tokens, certificates, cryptography, TLS readiness, PCI DSS tests, event logs. |
| scripts/dev-experience/ | Developer machine bootstrap and terminal profile. |
| scripts/dns/, scripts/iis-web-server/, scripts/windows-servers/ | Classic infrastructure and server administration. |
| scripts/dotnet/, scripts/sitecore/, scripts/imperva/ | App-specific build, publish, and load-balancer tooling. |
| t-sql/ | SQL Server DBA scripts. |
Shared modules: scripts/AzureCli.psm1 (az CLI + Resource Graph helpers), scripts/Azure.psm1, scripts/System.psm1.
All read-only unless noted, az CLI only (no extensions), work across every subscription you can access, and export CSV with -OutputPath.
| Script | Use it to |
|---|---|
| Get-AzKeyVaultSecurityAudit.ps1 | Find vaults on legacy access policies, without purge protection, or open to the public internet. |
| Get-AzAppCredentialExpiry.ps1 | Prevent outages from expired Entra app secrets/certificates. |
| Get-AzOrphanedResources.ps1 | Find unattached disks, idle public IPs, orphaned NICs and other waste. |
| Convert-AzKeyVaultToRbac.ps1 | Changes state. Migrate access-policy vaults to RBAC with equivalent built-in roles. Run with -WhatIf first. |
./scripts/azure-security/Get-AzKeyVaultSecurityAudit.ps1 -OutputPath ./kv-audit.csv
./scripts/azure-resources/key-vault/Convert-AzKeyVaultToRbac.ps1 -SubscriptionId "<name-or-id>" -WhatIfSet-AzKeyVaultAclGroup.ps1 grants groups access-policy permissions on legacy vaults. Use it only as a short-term bridge (for example, data migrations) until vaults are moved to RBAC.
Older scripts predate current practice. When touching them, prefer: Microsoft Graph / az ad over the retired AzureAD module (for example Add-ManagedIdentityRole.ps1), [Parameter(Mandatory)] over $(throw ...) defaults, no Set-ExecutionPolicy Unrestricted, and -WhatIf on every destructive script.
- Shared modules live only in scripts/. Import them with
Join-Path $PSScriptRoot(new scripts) or a relative path (older scripts). - Scripts that change state support
-WhatIf(SupportsShouldProcess). Run with-WhatIffirst. - No secrets, tenant/subscription IDs, or customer data in the repo; use placeholders (
00000000-...). - See .github/copilot-instructions.md for full authoring guidance.