Cloud Transformation

Landing-Zone Governance Assessment

A scheduled, read-only scan of management groups, policy, access and cost, published as a private report.

Azure Governance Visualizer runs from a GitHub Actions workflow on a schedule, signs in with OpenID Connect and reads the tenant: management groups, subscriptions, role assignments, policy, Defender plans and cost. Reports go to the repository and to an App Service site behind Entra ID.

runsreportsOIDCread-onlypublish HTMLsign in, reviewGitHubMicrosoft AzureTenant · read-only scopeGitHub repositoryHTML, Markdown, CSVGitHub Actionson a scheduleGovernanceVisualizeropen source, read-onlyMicrosoft Entra IDOIDC federated credentialAzure ResourceManagerand Microsoft GraphManagement groupsthe hierarchySubscriptionsresource groups, resourcesRole assignmentsincl. custom rolesAzure Policycompliance, exemptionsDefender for Cloudplans per subscriptionCost Managementspend, idle resourcesAzure App Servicereport site, Entra sign-inGovernance teamsecurity, platform, FinOps

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

When to use it

  • Before a landing-zone redesign: see what exists before changing it
  • Many subscriptions built by different teams, with access and policy drift
  • Audits that need dated evidence instead of manual screenshots

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

Cloud Transformation