Merge branch 'main' into fix/issue749

arthurclares · web-flow · commit 8ba439444e65 · 2025-09-09T11:26:29.000+01:00
diff --git a/.github/workflows/ado-sync-workitems.yml b/.github/workflows/ado-sync-workitems.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/hugo-build-pr-check.yml b/.github/workflows/hugo-build-pr-check.yml
@@ -32,7 +32,7 @@ jobs:
       HUGO_VERSION: 0.124.1
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/hugo-site-build.yml b/.github/workflows/hugo-site-build.yml
@@ -41,7 +41,7 @@ jobs:
       HUGO_VERSION: 0.140.0
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
@@ -101,7 +101,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -21,7 +21,7 @@ jobs:
       id-token: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/validate-queries.yml b/.github/workflows/validate-queries.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/validate-recommendations.yml b/.github/workflows/validate-recommendations.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
         with:
           egress-policy: audit
 
diff --git a/azure-resources/Network/loadBalancers/recommendations.yaml b/azure-resources/Network/loadBalancers/recommendations.yaml
@@ -1,6 +1,6 @@
 - description: Use Standard Load Balancer SKU
   aprlGuid: 38c3bca1-97a1-eb42-8cd3-838b243f35ba
-  recommendationTypeId: null
+  recommendationTypeId: 332e07de-da0d-4ee7-b1c4-ca9016005e1d
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Network/loadBalancers
@@ -17,7 +17,7 @@
 
 - description: Ensure the Backend Pool contains at least two instances
   aprlGuid: 6d82d042-6d61-ad49-86f0-6a5455398081
-  recommendationTypeId: null
+  recommendationTypeId: 5b132ebc-bd86-46fc-b2ee-95bc3e2d3017
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Network/loadBalancers
diff --git a/azure-resources/Network/networkWatchers/kql/1e28bbc1-1eb7-486f-8d7f-93943f40219c.kql b/azure-resources/Network/networkWatchers/kql/1e28bbc1-1eb7-486f-8d7f-93943f40219c.kql
@@ -1 +1,14 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is deployed but Connection Monitor is not deployed
+Resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId, name, id
+| join kind = leftouter (
+resources
+| where type =~ 'microsoft.network/networkwatchers/connectionmonitors'
+| summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+      | where isnull(nwlocation) or isempty(nwlocation)
+| project recommendationId = "1e28bbc1-1eb7-486f-8d7f-93943f40219c", name, id, tags=''
diff --git a/azure-resources/Network/networkWatchers/kql/4e133bd0-8762-bc40-a95b-b29142427d73.kql b/azure-resources/Network/networkWatchers/kql/4e133bd0-8762-bc40-a95b-b29142427d73.kql
@@ -1 +1,15 @@
-// under-development
+// Azure Resource Graph Query
+// This query will return all regions for which Network Watcher is not deployed
+Resources
+| where location <> 'global'
+| summarize by location, subscriptionId
+| project location, subscriptionId
+| join kind = leftouter (
+    resources
+    | where type =~ "microsoft.network/networkwatchers"
+    | summarize by location, subscriptionId
+    | project nwlocation = location, nwsubscriptionId = subscriptionId
+    )  on $left.location == $right.nwlocation,
+    $left.subscriptionId == $right.nwsubscriptionId
+    | where isnull(nwlocation) or isempty(nwlocation)
+    | project recommendationId = "4e133bd0-8762-bc40-a95b-b29142427d73", name = strcat('NetworkWatcher_',location) , id=subscriptionId, tags='', param1 = strcat("missingLocation: ", location)
diff --git a/azure-resources/Network/privateDnsZones/kql/3538aa48-c40b-455b-a93b-269fe6e65be2.kql b/azure-resources/Network/privateDnsZones/kql/3538aa48-c40b-455b-a93b-269fe6e65be2.kql
@@ -1,2 +1,4 @@
-// under-development
-
+// Azure Resource Graph Query
+// This query will return Time-To-Live (TTL) for the DNS recordsets. Make sure it is set appropriately to ensure RTOs
+dnsresources
+| project recommendationId = "3538aa48-c40b-455b-a93b-269fe6e65be2", name, id, tags, param1 = strcat("Time-To-Live: ", tostring(properties.ttl))
diff --git a/azure-resources/Network/virtualNetworkGateways/recommendations.yaml b/azure-resources/Network/virtualNetworkGateways/recommendations.yaml
@@ -68,7 +68,7 @@
 
 - description: Configure customer-controlled ExpressRoute gateway maintenance
   aprlGuid: 3e115044-a3aa-433e-be01-ce17d67e50da
-  recommendationTypeId: null
+  recommendationTypeId: b4af9e04-3570-41f1-b4cf-b7af07224799
   recommendationControl: HighAvailability
   recommendationImpact: Medium
   recommendationResourceType: Microsoft.Network/virtualNetworkGateways
diff --git a/azure-resources/Network/virtualWans/_index.md b/azure-resources/Network/virtualWans/_index.md
@@ -1,7 +1,7 @@
 ---
 title: virtualWans
 geekdocCollapseSection: true
-geekdocHidden: false
+geekdocHidden: true
 ---
 
 {{< azure-resources-recommendationlist name="azure-resources-recommendationlist" >}}
diff --git a/azure-resources/Storage/storageAccounts/kql/e6c7e1cc-2f47-264d-aa50-1da421314472.kql b/azure-resources/Storage/storageAccounts/kql/e6c7e1cc-2f47-264d-aa50-1da421314472.kql
@@ -2,7 +2,6 @@
 // This query will return all storage accounts that are not using Zone or Region replication
 Resources
 | where type =~ "Microsoft.Storage/storageAccounts"
-| where location in~ ("australiaeast", "brazilsouth", "canadacentral", "centralindia", "centralus", "eastasia", "eastus", "eastus2", "francecentral", "germanywestcentral", "israelcentral", "italynorth", "japaneast", "japanwest", "koreacentral", "mexicocentral", "newzealandnorth", "northeurope", "norwayeast", "polandcentral", "qatarcentral", "southafricanorth", "southcentralus", "southeastasia", "spaincentral", "swedencentral", "switzerlandnorth", "uaenorth", "uksouth", "westeurope", "westus2", "westus3", "usgovvirginia", "chinanorth3")
 | where sku.name in~ ("Standard_LRS", "Premium_LRS")
 | project recommendationId = "e6c7e1cc-2f47-264d-aa50-1da421314472", name, id, tags, param1 = strcat("sku: ", sku.name)
 
diff --git a/azure-resources/Subscription/subscriptions/kql/c041d596-6c97-4c5f-b4b3-9cd37628f2e2.kql b/azure-resources/Subscription/subscriptions/kql/c041d596-6c97-4c5f-b4b3-9cd37628f2e2.kql
@@ -1,12 +1,12 @@
 // Azure Resource Graph Query
-// Count VM instances with a tag that contains "Citrix VDA" and create output if that count is >2000 for each subscription.
-// The Citrix published limit is 2500. This query runs an 80% check.
+// Count VM instances with a tag that contains "Citrix VDA" and create output if that count is >4000 for each subscription.
+// The Citrix published limit is 5000. This query runs an 80% check.
 
 resources
 | where type == 'microsoft.compute/virtualmachines'
 | where tags contains 'Citrix VDA'
 | summarize VMs=count() by subscriptionId
-| where VMs > 2000
+| where VMs > 4000
 | join (resourcecontainers| where type =='microsoft.resources/subscriptions' | project subname=name, subscriptionId) on subscriptionId
 | project recommendationId='c041d596-6c97-4c5f-b4b3-9cd37628f2e2', name= subname, id = subscriptionId, param1='Too many instances.', param2= VMs
 
diff --git a/azure-resources/Subscription/subscriptions/recommendations.yaml b/azure-resources/Subscription/subscriptions/recommendations.yaml
@@ -1,4 +1,4 @@
-- description: Do not create more than 2000 Citrix VDA servers per subscription
+- description: Do not create more than 4000 Citrix VDA servers per subscription
   aprlGuid: c041d596-6c97-4c5f-b4b3-9cd37628f2e2
   recommendationTypeId: null
   recommendationControl: OtherBestPractices
diff --git a/azure-resources/Web/serverFarms/recommendations.yaml b/azure-resources/Web/serverFarms/recommendations.yaml
@@ -17,7 +17,7 @@
 
 - description: Use Standard or Premium tier
   aprlGuid: b2113023-a553-2e41-9789-597e2fb54c31
-  recommendationTypeId: null
+  recommendationTypeId: dc298556-8232-4aa8-bfe0-5204c5017be0
   recommendationControl: HighAvailability
   recommendationImpact: High
   recommendationResourceType: Microsoft.Web/serverFarms
diff --git a/docs/layouts/shortcodes/azure-resources-recommendationlist.html b/docs/layouts/shortcodes/azure-resources-recommendationlist.html
@@ -73,6 +73,12 @@ <h4>
         <span style="font-weight: normal">{{ .aprlGuid }}</span>
       </h4>
     </div>
+    <div style="margin-top: 10px;">
+      <h4>
+        <span style="font-weight: bold;">Advisor GUID:</span>&nbsp;
+        <span style="font-weight: normal">{{ if .recommendationTypeId }}{{ .recommendationTypeId }}{{ else }}n/a{{ end }}</span>
+      </h4>
+    </div>
     <div style="max-width: 100%; word-wrap: break-word; overflow-wrap: break-word;">
       <h4>Description:</h4>
       <pre
