Loading repository data…
vegazbabz / repository
A fully automated, modular Azure infrastructure project for security benchmark testing and environment provisioning. Deploy a complete multi-tier Azure environment in minutes — either with out-of-the-box Azure defaults or with CIS/MCSB-hardened configuration (to measure remediations).
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
⬇️ Get it from the PowerShell Gallery —
Install-PSResource AzureDemoEnvironment
A fully automated, modular Azure infrastructure project for security benchmark testing and environment provisioning. Deploy a complete multi-tier Azure environment in minutes — either with out-of-the-box Azure defaults (to measure your baseline CIS/MCSB score) or with CIS/MCSB-hardened configuration (to measure remediations).
[!WARNING] Deploying resources from this repository will incur real costs in your Azure subscription. Every module provisions billable Azure resources. Some — such as Azure Firewall, DDoS Protection, and VPN Gateway — are expensive even when idle. See Cost guidance for estimates. The author of this repository accepts no responsibility for any Azure costs, charges, or overspend incurred by anyone using this project. You are solely responsible for monitoring and managing spend in your own subscription. Before deploying, set up Azure Cost Management budgets and alerts to cap unexpected spend.
Selected from shared topics, language and repository description—not editorial ratings.
Synchronize AAD user properties to SharePoint User Profiles periodically and fully automated.
44/100 healthNew to Azure? Start with Prerequisites and Your first deployment.
Just want to see what this deploys? Skip to What gets deployed.
Setting up CI/CD? Jump to GitHub Actions setup.
12 independent Bicep modules are available. Each module deploys into its own dedicated resource group (e.g. ade-compute-rg). Modules are independently toggleable — you only pay for what you enable.
| Module | Default resources | Notable opt-in features |
|---|---|---|
monitoring | Log Analytics Workspace, Application Insights, Action Group | Alert rules |
networking | VNet (10.0.0.0/16), all subnets, NSGs, Bastion (Developer SKU — free) | Application Gateway, Azure Firewall, VPN Gateway, NAT Gateway, DDoS Protection, Private DNS Zones |
security | Key Vault (RBAC model), User-Assigned Managed Identity | Defender for Cloud (all plans), Microsoft Sentinel |
compute | Windows Server 2022 VM (Standard_B2s) | Ubuntu 22.04 VM, VM Scale Set |
storage | General-purpose v2 Storage Account | Data Lake Gen2, File Shares, soft delete, versioning |
databases | Azure SQL Server + Serverless Database (AdventureWorksLT) | SQL Server on VM (IaaS), Cosmos DB (serverless), PostgreSQL Flexible Server, MySQL Flexible Server, Redis Cache |
appservices | App Service Plan (B1), Windows Web App, Function App, Logic App | — |
containers | Container Registry (Basic), AKS (1-node, free tier), Container Apps, Container Instances | — |
integration | Service Bus (Standard), Event Hub (Basic), Event Grid, SignalR | API Management |
ai | — (all resources opt-in due to cost and quota) | Azure AI Services, Azure OpenAI, Cognitive Search, Machine Learning |
data | — (all resources opt-in due to cost and quota) | Data Factory, Synapse Analytics, Databricks, Microsoft Purview |
governance | Automation Account (auto-stop/start), optional budget alerts | Resource locks, Azure Policy initiative assignments |
aianddataare disabled in all built-in profiles by default due to cost and quota requirements. Enable them in a custom profile when needed.
flowchart LR
deploy["deploy.ps1"] -- "reads" --> profile["Profile JSON<br/>(modules + feature flags)"]
profile -- "selects" --> modules["Bicep modules<br/>(strict dependency order)"]
modules -- "one RG each" --> rgs["<prefix>-<module>-rg"]
modules -- "outputs feed" --> downstream["downstream modules<br/>(subnet IDs, Key Vault ID, ...)"]
deploy.ps1 with a profile (which modules to enable and which features to turn on) and a mode (default = baseline, hardened = CIS/MCSB-aligned).monitoring → networking → security → compute → storage → databases → appservices → containers → integration → ai → data → governance.The orchestration is pure PowerShell 7 + Azure CLI. No Azure PowerShell module (Az.*) is required.
| Tool | Minimum version | Install |
|---|---|---|
| PowerShell | 7.0 (7.4+ recommended) | github.com/PowerShell/PowerShell |
| Azure CLI | 2.60 | learn.microsoft.com/cli/azure/install-azure-cli |
| Bicep CLI | latest | az bicep install (run once after installing Azure CLI) |
Windows note: PowerShell 7 is separate from Windows PowerShell 5.1. Install it from the link above. Scripts will refuse to run on 5.1.
# Verify PowerShell version — must say 7.x or higher
$PSVersionTable.PSVersion
# Verify Azure CLI is installed
az version
# Log in to Azure
az login
# Set the subscription you want to deploy into
az account set --subscription "<your-subscription-id>"
# Confirm the right subscription is active
az account show --query "{name:name, id:id}" -o table
Option A — PowerShell Gallery (recommended). The module exports four
commands that wrap the repository scripts one-to-one: Deploy-AdeEnvironment
(deploy.ps1), Remove-AdeEnvironment (destroy.ps1), Initialize-AdeSeedData
(seed-data.ps1), and Get-AdeCostDashboard. All parameters are identical to
the scripts.
Install-PSResource AzureDemoEnvironment
# or, on older PowerShellGet: Install-Module AzureDemoEnvironment -Scope CurrentUser
The examples in the rest of this README use the
./scripts/...form. If you installed the module, substitute the matching command anywhere — the parameters are identical:./scripts/deploy.ps1 ...→Deploy-AdeEnvironment ...
Option B — clone the repository and run the scripts directly (required if you want to edit profiles or Bicep templates in place):
git clone https://github.com/vegazbabz/azure-demo-environment.git
cd azure-demo-environment
The minimal profile is the lowest-cost starting point. It deploys: monitoring, networking, security (Key Vault + managed identity), one Windows VM, storage, and governance automation. Estimated cost: ~$15–30/month with auto-shutdown enabled. Budget alerts are deployed only when an alert email is provided.
# Module install (Option A)
Deploy-AdeEnvironment -Profile minimal -Location westeurope -Prefix ade
# Repo clone (Option B) — PowerShell 7, run from the repo root
./scripts/deploy.ps1 -Profile minimal -Location westeurope -Prefix ade
Admin passwords are handled automatically: a separate cryptographically random password is generated per service (VM, SQL, PostgreSQL, MySQL, Synapse) and stored in the environment's Key Vault — nothing is printed to the terminal. Pass -AdminPassword to use one value for all services instead (min 12 characters with uppercase, lowercase, a digit, and a symbol); it is also synced to Key Vault. Profiles without a Key Vault fall back to a single generated password shown in a console banner.
The script will:
# Module install (Option A)
Remove-AdeEnvironment -Prefix ade -Force
# Repo clone (Option B)
./scripts/destroy.ps1 -Prefix ade -Force
This deletes ADE-managed resource groups for the prefix and discovered Azure-managed resource groups that belong to the environment.
Profiles live in config/profiles/ (bundled inside the module when installed from the Gallery). Pass the profile name (no path, no .json) or the path to a custom JSON file.
| Profile | Modules enabled | Estimated cost | Best for |
|---|---|---|---|
minimal | monitoring, networking, security, compute (Windows VM), storage, governance | ~$15–30/month | First run, orientation, low-cost baseline |
compute-only | monitoring, networking, security, compute (Windows + Linux + VMSS), governance | ~$60–100/month | CIS Compute sections, VM hardening testing |
networking-only | monitoring, networking (+ App Gateway), governance | ~$200–300/month | Network topology and connectivity testing |
databases-only | monitoring, networking, security, databases (SQL + Cosmos DB), governance | ~$80–150/month | Database benchmark testing |
security-focus | monitoring, networking, security (+ Defender + Sentinel), compute (Windows + Linux), storage, databases (SQL only), governance (+ locks) | ~$100–200/month | Security posture and Defender coverage testing |
full | 10 standard modules (ai and data disabled) | ~$300–500/month | Complete standard CIS/MCSB coverage without quota-heavy AI/data services |
hardened | 10 standard modules with hardening flags enabled (ai and data disabled) | ~$3 |