6.6.3

JulianHayward · JulianHayward · commit de221e596b92 · 2025-05-01T22:48:38.000+02:00
diff --git a/.azuredevops/pipelines/AzGovViz.pipeline.yml b/.azuredevops/pipelines/AzGovViz.pipeline.yml
@@ -1,4 +1,4 @@
-# Azure Governance Visualizer v6_major_20230717_1
+# Azure Governance Visualizer v6_major_20250501_1
 # First things first:
 # 1. Mandatory: In the AzGovViz.variables.yml file set needed variables 'ServiceConnection' and 'ManagementGroupId
 # 2. Mandatory: Check line 20
@@ -9,7 +9,7 @@ trigger: none
 pr: none
 
 variables:
-  - template: ./AzGovViz.variables.yml
+  - template: 'AzGovViz.variables.yml'
 
 schedules:
 - cron: "0 0,12 * * *"
@@ -19,17 +19,6 @@ schedules:
     include:
     - master #CHECK branch 'master' is applicable? - delete me :)
 
-#Running AzOps? Run Azure Governance Visualizer after 'AzOps - Push' ..
-#AzOps accelerator https://github.com/Azure/AzOps-Accelerator
-#resources:
-#  pipelines:
-#    - pipeline: 'Push'
-#      source: 'AzOps - Push'
-#      trigger:
-#        branches:
-#          include:
-#            - master #CHECK branch 'master' is applicable? - delete me :)
-
 jobs:
 - job: AzureGovernanceVisualizer
   timeoutInMinutes: 0
diff --git a/README.md b/README.md
@@ -84,22 +84,16 @@ The [Azure Governance Visualizer accelerator](https://github.com/Azure/Azure-Gov
 
 ## Release history
 
-**Changes** (2024-November-01 / 6.6.1 Patch)
+**Changes** (2025-May-01 / 6.6.3 Patch)
 
-- HTML fix filters __TenantSummary__ PolicyAssignment, __ScopeInsights__ PolicySetAssignments
-- use [AzAPICall](https://aka.ms/AzAPICall) PowerShell module version 1.2.4 (Handle 'subscription not registered' `/providers/Microsoft.Security/settings`)
-
-**Changes** (2024-October-26 / 6.6.0 Minor)
-
-- Microsoft Defender for Cloud Coverage (Tenant Summary and CSV export). Example html:
-![MicrosoftDefenderForCloudCoverage_preview](img/MicrosoftDefenderForCloudCoverage_preview.png)
-- CostOptimization add `microsoft.network/privateendpoints` for intent=cost savings
-- extend ResourcesAll.csv output with sku and kind information
-- update [API reference](#api-reference) '/subscriptions/`subscriptionId`/resources' use API version 2024-03-01 (previous 2023-07-01)
-
-**Changes** (2024-October-9 / 6.5.5 Patch)
-
-- introduce a new optional [parameter](#parameters) `-SubscriptionIdWhitelist`, which defines the subscriptions that must match in order to be processed.
+- [issue53](https://github.com/Azure/Azure-Governance-Visualizer/issues/53)
+  - fix -> Get Default Management Group; flag as 'unknown.', if principal has no permissions to get default Management Group (non root MG read)
+  - update API-version `2020-02-01` to `2023-04-01` for '/providers/Microsoft.Management/managementGroups/`tenantId`/settings' 
+- [issue278](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/278) 
+  - fix -> Getting Advisor Scores for Subscription; skip on error-code `500` `(error: 'AdvisorScore::List()'`
+  - update API-version `2020-07-01-preview` to `2023-01-01` for '/subscriptions/`subscriptionId`/providers/Microsoft.Advisor/advisorScore'
+- [issue276](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/276) 
+  - fix -> Getting Microsoft Defender for Cloud Secure Score for Subscription; skip on error-code `431 (RequestHeaderFieldsTooLarge)` 
 
 [Full release history](history.md)
 
@@ -588,12 +582,12 @@ Azure Governance Visualizer polls the following APIs
 | ARM      | 2020-01-01-preview | /providers/Microsoft.Management/managementGroups/`managementGroupId`/providers/microsoft.insights/diagnosticSettings                   |
 | ARM      | 2019-10-01         | /providers/Microsoft.Management/managementGroups/`managementGroupId`/providers/Microsoft.PolicyInsights/policyStates/latest/summarize  |
 | ARM      | 2020-05-01         | /providers/Microsoft.Management/managementGroups/`managementGroupId`                                                                   |
-| ARM      | 2020-02-01         | /providers/Microsoft.Management/managementGroups/`tenantId`/settings                                                                   |
+| ARM      | 2023-04-01         | /providers/Microsoft.Management/managementGroups/`tenantId`/settings                                                                   |
 | ARM      | 2020-05-01         | /providers/Microsoft.Management/managementGroups                                                                                       |
 | ARM      | 2022-10-01         | /providers/Microsoft.ResourceGraph/resources                                                                                           |
 | ARM      | 2021-05-01         | /`resourceId`/providers/Microsoft.Insights/metrics                                                                                     |
 | ARM      | 2020-01-01         | /subscriptions/`subscriptionId`/locations                                                                                              |
-| ARM      | 2020-07-01-preview | /subscriptions/`subscriptionId`/providers/Microsoft.Advisor/advisorScore                                                               |
+| ARM      | 2023-01-01 | /subscriptions/`subscriptionId`/providers/Microsoft.Advisor/advisorScore                                                               |
 | ARM      | 2016-09-01         | /subscriptions/`subscriptionId`/providers/Microsoft.Authorization/locks                                                                |
 | ARM      | 2021-06-01         | /subscriptions/`subscriptionId`/providers/Microsoft.Authorization/policyAssignments                                                    |
 | ARM      | 2021-06-01         | /subscriptions/`subscriptionId`/providers/Microsoft.Authorization/policyDefinitions                                                    |
diff --git a/history.md b/history.md
@@ -4,6 +4,17 @@
 
 ### Azure Governance Visualizer version 6
 
+**Changes** (2025-May-01 / 6.6.3 Patch)
+
+- [issue53](https://github.com/Azure/Azure-Governance-Visualizer/issues/53)
+  - fix -> Get Default Management Group; flag as 'unknown.', if principal has no permissions to get default Management Group (non root MG read)
+  - update API-version `2020-02-01` to `2023-04-01` for '/providers/Microsoft.Management/managementGroups/`tenantId`/settings' 
+- [issue278](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/278) 
+  - fix -> Getting Advisor Scores for Subscription; skip on error-code `500` `(error: 'AdvisorScore::List()'`
+  - update API-version `2020-07-01-preview` to `2023-01-01` for '/subscriptions/`subscriptionId`/providers/Microsoft.Advisor/advisorScore'
+- [issue276](https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/276) 
+  - fix -> Getting Microsoft Defender for Cloud Secure Score for Subscription; skip on error-code `431 (RequestHeaderFieldsTooLarge)` 
+
 **Changes** (2024-November-01 / 6.6.1 Patch)
 
 - HTML fix filters __TenantSummary__ PolicyAssignment, __ScopeInsights__ PolicySetAssignments
diff --git a/pwsh/AzGovVizParallel.ps1 b/pwsh/AzGovVizParallel.ps1
@@ -371,7 +371,7 @@ Param
     $Product = 'AzGovViz',
 
     [string]
-    $ProductVersion = '6.6.2',
+    $ProductVersion = '6.6.3',
 
     [string]
     $GithubRepository = 'aka.ms/AzGovViz',
@@ -3821,21 +3821,30 @@ function getDefaultManagementGroup {
     $currentTask = 'Get Default Management Group'
     Write-Host $currentTask
     #https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group
-    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Management/managementGroups/$($azAPICallConf['checkContext'].Tenant.Id)/settings?api-version=2020-02-01"
+    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Management/managementGroups/$($azAPICallConf['checkContext'].Tenant.Id)/settings?api-version=2023-04-01"
     $method = 'GET'
-    $settingsMG = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask
+    #fix https://github.com/Azure/Azure-Governance-Visualizer/issues/53
+    $settingsMG = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -skipOnErrorCode 403
 
-    if (($settingsMG).count -gt 0) {
-        Write-Host " default ManagementGroup Id: $($settingsMG.properties.defaultManagementGroup)"
-        $script:defaultManagementGroupId = $settingsMG.properties.defaultManagementGroup
-        Write-Host " requireAuthorizationForGroupCreation: $($settingsMG.properties.requireAuthorizationForGroupCreation)"
-        $script:requireAuthorizationForGroupCreation = $settingsMG.properties.requireAuthorizationForGroupCreation
+    if ($settingsMG) {
+        if (($settingsMG).count -gt 0) {
+            Write-Host " default ManagementGroup Id: $($settingsMG.properties.defaultManagementGroup)"
+            $script:defaultManagementGroupId = $settingsMG.properties.defaultManagementGroup
+            Write-Host " requireAuthorizationForGroupCreation: $($settingsMG.properties.requireAuthorizationForGroupCreation)"
+            $script:requireAuthorizationForGroupCreation = $settingsMG.properties.requireAuthorizationForGroupCreation
+        }
+        else {
+            Write-Host " default ManagementGroup: $(($azAPICallConf['checkContext']).Tenant.Id) (Tenant Root)"
+            $script:defaultManagementGroupId = ($azAPICallConf['checkContext']).Tenant.Id
+            $script:requireAuthorizationForGroupCreation = $false
+        }
     }
     else {
-        Write-Host " default ManagementGroup: $(($azAPICallConf['checkContext']).Tenant.Id) (Tenant Root)"
-        $script:defaultManagementGroupId = ($azAPICallConf['checkContext']).Tenant.Id
-        $script:requireAuthorizationForGroupCreation = $false
+        Write-Host " default ManagementGroup: could not be determined, flagging default ManagementGroup as 'unknown.'"
+        $script:defaultManagementGroupId = 'unknown.'
+        $script:requireAuthorizationForGroupCreation = 'unknown.'
     }
+
 }
 function getEntities {
     Write-Host 'Entities'
@@ -30875,9 +30884,10 @@ function dataCollectionAdvisorScores {
     )
 
     $currentTask = "Getting Advisor Scores for Subscription: '$($scopeDisplayName)' ('$scopeId') [quotaId:'$SubscriptionQuotaId']"
-    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Advisor/advisorScore?api-version=2020-07-01-preview"
+    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Advisor/advisorScore?api-version=2023-01-01"
     $method = 'GET'
-    $advisorScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 404
+    #fix https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/278
+    $advisorScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 404, 500
 
     if ($advisorScoreResult -eq 'SubScriptionNotRegistered' -or $advisorScoreResult -eq 'DisallowedProvider') {
     }
@@ -32514,13 +32524,19 @@ function dataCollectionASCSecureScoreSub {
         $currentTask = "Getting Microsoft Defender for Cloud Secure Score for Subscription: '$($scopeDisplayName)' ('$scopeId') [quotaId:'$subscriptionQuotaId']"
         $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Security/securescores?api-version=2020-01-01"
         $method = 'GET'
-        $subASCSecureScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection'
+        #fix https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/276
+        $subASCSecureScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 431
 
-        if ($subASCSecureScoreResult -ne 'DisallowedProvider') {
-            $subASCSecureScoreResultASCScore = ($subASCSecureScoreResult.where({ $_.name -eq 'ascScore' }))
-            if ($subASCSecureScoreResultASCScore.count -gt 0) {
-                $secureScorePercentageRounded = [math]::Round(($subASCSecureScoreResultASCScore.properties.score.current / $subASCSecureScoreResultASCScore.properties.score.max * 100), 2)
-                $subscriptionASCSecureScore = "$($secureScorePercentageRounded)% ($($subASCSecureScoreResultASCScore.properties.score.current) of $($subASCSecureScoreResultASCScore.properties.score.max) points)"
+        if ($subASCSecureScoreResult) {
+            if ($subASCSecureScoreResult -ne 'DisallowedProvider') {
+                $subASCSecureScoreResultASCScore = ($subASCSecureScoreResult.where({ $_.name -eq 'ascScore' }))
+                if ($subASCSecureScoreResultASCScore.count -gt 0) {
+                    $secureScorePercentageRounded = [math]::Round(($subASCSecureScoreResultASCScore.properties.score.current / $subASCSecureScoreResultASCScore.properties.score.max * 100), 2)
+                    $subscriptionASCSecureScore = "$($secureScorePercentageRounded)% ($($subASCSecureScoreResultASCScore.properties.score.current) of $($subASCSecureScoreResultASCScore.properties.score.max) points)"
+                }
+                else {
+                    $subscriptionASCSecureScore = 'n/a'
+                }
             }
             else {
                 $subscriptionASCSecureScore = 'n/a'
diff --git a/pwsh/dev/devAzGovVizParallel.ps1 b/pwsh/dev/devAzGovVizParallel.ps1
@@ -371,7 +371,7 @@ Param
     $Product = 'AzGovViz',
 
     [string]
-    $ProductVersion = '6.6.2',
+    $ProductVersion = '6.6.3',
 
     [string]
     $GithubRepository = 'aka.ms/AzGovViz',
diff --git a/pwsh/dev/functions/dataCollection/dataCollectionFunctions.ps1 b/pwsh/dev/functions/dataCollection/dataCollectionFunctions.ps1
@@ -88,9 +88,10 @@ function dataCollectionAdvisorScores {
     )
 
     $currentTask = "Getting Advisor Scores for Subscription: '$($scopeDisplayName)' ('$scopeId') [quotaId:'$SubscriptionQuotaId']"
-    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Advisor/advisorScore?api-version=2020-07-01-preview"
+    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Advisor/advisorScore?api-version=2023-01-01"
     $method = 'GET'
-    $advisorScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 404
+    #fix https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/278
+    $advisorScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 404, 500
 
     if ($advisorScoreResult -eq 'SubScriptionNotRegistered' -or $advisorScoreResult -eq 'DisallowedProvider') {
     }
@@ -1727,13 +1728,19 @@ function dataCollectionASCSecureScoreSub {
         $currentTask = "Getting Microsoft Defender for Cloud Secure Score for Subscription: '$($scopeDisplayName)' ('$scopeId') [quotaId:'$subscriptionQuotaId']"
         $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/subscriptions/$($scopeId)/providers/Microsoft.Security/securescores?api-version=2020-01-01"
         $method = 'GET'
-        $subASCSecureScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection'
-
-        if ($subASCSecureScoreResult -ne 'DisallowedProvider') {
-            $subASCSecureScoreResultASCScore = ($subASCSecureScoreResult.where({ $_.name -eq 'ascScore' }))
-            if ($subASCSecureScoreResultASCScore.count -gt 0) {
-                $secureScorePercentageRounded = [math]::Round(($subASCSecureScoreResultASCScore.properties.score.current / $subASCSecureScoreResultASCScore.properties.score.max * 100), 2)
-                $subscriptionASCSecureScore = "$($secureScorePercentageRounded)% ($($subASCSecureScoreResultASCScore.properties.score.current) of $($subASCSecureScoreResultASCScore.properties.score.max) points)"
+        #fix https://github.com/JulianHayward/Azure-MG-Sub-Governance-Reporting/issues/276
+        $subASCSecureScoreResult = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -caller 'CustomDataCollection' -skipOnErrorCode 431
+
+        if ($subASCSecureScoreResult) {
+            if ($subASCSecureScoreResult -ne 'DisallowedProvider') {
+                $subASCSecureScoreResultASCScore = ($subASCSecureScoreResult.where({ $_.name -eq 'ascScore' }))
+                if ($subASCSecureScoreResultASCScore.count -gt 0) {
+                    $secureScorePercentageRounded = [math]::Round(($subASCSecureScoreResultASCScore.properties.score.current / $subASCSecureScoreResultASCScore.properties.score.max * 100), 2)
+                    $subscriptionASCSecureScore = "$($secureScorePercentageRounded)% ($($subASCSecureScoreResultASCScore.properties.score.current) of $($subASCSecureScoreResultASCScore.properties.score.max) points)"
+                }
+                else {
+                    $subscriptionASCSecureScore = 'n/a'
+                }
             }
             else {
                 $subscriptionASCSecureScore = 'n/a'
diff --git a/pwsh/dev/functions/getDefaultManagementGroup.ps1 b/pwsh/dev/functions/getDefaultManagementGroup.ps1
@@ -2,19 +2,28 @@
     $currentTask = 'Get Default Management Group'
     Write-Host $currentTask
     #https://learn.microsoft.com/azure/governance/management-groups/how-to/protect-resource-hierarchy#setting---default-management-group
-    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Management/managementGroups/$($azAPICallConf['checkContext'].Tenant.Id)/settings?api-version=2020-02-01"
+    $uri = "$($azAPICallConf['azAPIEndpointUrls'].ARM)/providers/Microsoft.Management/managementGroups/$($azAPICallConf['checkContext'].Tenant.Id)/settings?api-version=2023-04-01"
     $method = 'GET'
-    $settingsMG = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask
+    #fix https://github.com/Azure/Azure-Governance-Visualizer/issues/53
+    $settingsMG = AzAPICall -AzAPICallConfiguration $azAPICallConf -uri $uri -method $method -currentTask $currentTask -skipOnErrorCode 403
 
-    if (($settingsMG).count -gt 0) {
-        Write-Host " default ManagementGroup Id: $($settingsMG.properties.defaultManagementGroup)"
-        $script:defaultManagementGroupId = $settingsMG.properties.defaultManagementGroup
-        Write-Host " requireAuthorizationForGroupCreation: $($settingsMG.properties.requireAuthorizationForGroupCreation)"
-        $script:requireAuthorizationForGroupCreation = $settingsMG.properties.requireAuthorizationForGroupCreation
+    if ($settingsMG) {
+        if (($settingsMG).count -gt 0) {
+            Write-Host " default ManagementGroup Id: $($settingsMG.properties.defaultManagementGroup)"
+            $script:defaultManagementGroupId = $settingsMG.properties.defaultManagementGroup
+            Write-Host " requireAuthorizationForGroupCreation: $($settingsMG.properties.requireAuthorizationForGroupCreation)"
+            $script:requireAuthorizationForGroupCreation = $settingsMG.properties.requireAuthorizationForGroupCreation
+        }
+        else {
+            Write-Host " default ManagementGroup: $(($azAPICallConf['checkContext']).Tenant.Id) (Tenant Root)"
+            $script:defaultManagementGroupId = ($azAPICallConf['checkContext']).Tenant.Id
+            $script:requireAuthorizationForGroupCreation = $false
+        }
     }
     else {
-        Write-Host " default ManagementGroup: $(($azAPICallConf['checkContext']).Tenant.Id) (Tenant Root)"
-        $script:defaultManagementGroupId = ($azAPICallConf['checkContext']).Tenant.Id
-        $script:requireAuthorizationForGroupCreation = $false
+        Write-Host " default ManagementGroup: could not be determined, flagging default ManagementGroup as 'unknown.'"
+        $script:defaultManagementGroupId = 'unknown.'
+        $script:requireAuthorizationForGroupCreation = 'unknown.'
     }
+
 }
diff --git a/version.json b/version.json
@@ -1,3 +1,3 @@
 {
-  "ProductVersion": "6.6.2"
+  "ProductVersion": "6.6.3"
 }

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,3 @@`
`1`	`1`	`{`
`2`		`- "ProductVersion": "6.6.2"`
	`2`	`+ "ProductVersion": "6.6.3"`
`3`	`3`	`}`