From 92ec4f711df188a4d58a312a5ebe33676ba84b36 Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Thu, 27 Aug 2026 21:50:16 +0530 Subject: [PATCH 1/7] SecOps - 41216 - Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost Management --- src/powershell/tests/Test-Assessment.41216.md | 9 + .../tests/Test-Assessment.41216.ps1 | 428 ++++++++++++++++++ 2 files changed, 437 insertions(+) create mode 100644 src/powershell/tests/Test-Assessment.41216.md create mode 100644 src/powershell/tests/Test-Assessment.41216.ps1 diff --git a/src/powershell/tests/Test-Assessment.41216.md b/src/powershell/tests/Test-Assessment.41216.md new file mode 100644 index 000000000..527eda266 --- /dev/null +++ b/src/powershell/tests/Test-Assessment.41216.md @@ -0,0 +1,9 @@ +Security Copilot is billed by the hour against a fixed pool of Security Compute Units (SCUs) provisioned per capacity, with optional overage units that take over when the provisioned pool is exhausted. When the combined provisioned plus overage capacity is reached, analysts receive an in-product error and Copilot stops responding to new prompts until the next hour, breaking incident triage in mid-flight. From a kill-chain perspective, an unmonitored capacity that silently saturates during a high-volume incident (for example, a phishing wave producing hundreds of correlated alerts) erodes defender velocity exactly when it matters: while Copilot is unavailable, analysts revert to manual workflows, mean-time-to-respond (MTTR) increases, and the threat actor's window for Lateral Movement, Collection, and Exfiltration widens. Continuous monitoring of SCU consumption through Microsoft Cost Management — paired with budget alerts that fire well before the cap — converts a hard service interruption into an early signal that lets owners adjust capacity proactively. + +## Remediation resources + +- [Tutorial: Create and manage budgets](https://learn.microsoft.com/azure/cost-management-billing/costs/tutorial-acm-create-budgets) +- [Manage security compute unit usage in Security Copilot](https://learn.microsoft.com/copilot/security/manage-usage) + + +%TestResult% diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 new file mode 100644 index 000000000..abd605535 --- /dev/null +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -0,0 +1,428 @@ +<# +.SYNOPSIS + Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost Management + +.DESCRIPTION + Discovers Microsoft Security Copilot capacity resources via Azure Resource Graph, then for each + subscription that hosts a capacity confirms that Cost Management is billing the capacity (Query - + Usage) and that at least one Consumption budget with qualifying notifications targets the capacity, + its resource group, or the subscription. + +.NOTES + Test ID: 41216 + Workshop Task: SECOPS_111 + Pillar: SecOps + Category: AI for security + Required APIs: + - Azure Resource Graph (management.azure.com) — capacity discovery + - Cost Management Query - Usage (Microsoft.CostManagement/query) — subscription scope + - Consumption Budgets - List (Microsoft.Consumption/budgets) — subscription scope +#> + +function Test-Assessment-41216 { + [ZtTest( + Category = 'AI for security', + ImplementationCost = 'Low', + Service = ('Azure'), + MinimumLicense = ('Consumption-based: Microsoft Security Copilot'), + Pillar = 'SecOps', + RiskLevel = 'Medium', + SfiPillar = 'Monitor and detect cyberthreats', + TenantType = ('Workforce'), + TestId = 41216, + Title = 'Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost Management', + UserImpact = 'Low' + )] + [CmdletBinding()] + param() + + #region Data Collection + Write-PSFMessage '🟦 Start' -Tag Test -Level VeryVerbose + + $activity = 'Checking Security Copilot SCU consumption monitoring' + $capacityType = 'microsoft.securitycopilot/capacities' + + # Q0: Discover Security Copilot capacity resources across all accessible subscriptions via Azure + # Resource Graph. This check is self-contained and does not depend on any other spec's output. + Write-ZtProgress -Activity $activity -Status 'Discovering Security Copilot capacities via Resource Graph' + + $argQuery = @" +resources +| where type =~ '$capacityType' +| join kind=leftouter ( + resourcecontainers + | where type =~ 'microsoft.resources/subscriptions' + | where properties.state =~ 'Enabled' + | project subscriptionId, subscriptionName = name +) on subscriptionId +| project id, name, location, resourceGroup, subscriptionId, subscriptionName, provisioningState = tostring(properties.provisioningState) +"@ + + $capacities = @() + try { + $capacities = @(Invoke-ZtAzureResourceGraphRequest -Query $argQuery) + Write-PSFMessage "ARG query returned $($capacities.Count) Security Copilot capacity resource(s)" -Tag Test -Level VeryVerbose + } + catch { + Write-PSFMessage "Azure Resource Graph query failed: $($_.Exception.Message)" -Tag Test -Level Warning + # Invoke-ZtAzureResourceGraphRequest throws "Azure REST request failed with status : ..." + $httpStatus = $null + if ($_.Exception.Message -match 'with status (\d+):') { $httpStatus = [int]$Matches[1] } + $result = if ($httpStatus -in @(401, 403)) { + '⚠️ Azure Resource Graph returned an authorization error while discovering Security Copilot capacities. Grant the assessing identity at least Reader on the subscriptions being evaluated, then re-run the assessment.' + } + else { + '⚠️ Azure Resource Graph returned an unexpected error while discovering Security Copilot capacities. This is likely transient; re-run the assessment.' + } + $params = @{ + TestId = '41216' + Title = 'Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost Management' + Status = $false + Result = $result + CustomStatus = 'Investigate' + } + Add-ZtTestResultDetail @params + return + } + + # Spec: no capacity resources in the tenant -> Skipped (NotApplicable). + if ($capacities.Count -eq 0) { + Write-PSFMessage 'No Security Copilot capacity resources found — skipping.' -Tag Test -Level VeryVerbose + Add-ZtTestResultDetail -SkippedBecause NotApplicable + return + } + + # Q1 + Q2: for each subscription that hosts a capacity, pull the last 30 days of Cost Management + # usage for the capacity resource type and the list of Consumption budgets. + $costFrom = (Get-Date).ToUniversalTime().AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ') + $costTo = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') + + $costQueryBody = @{ + type = 'ActualCost' + timeframe = 'Custom' + timePeriod = @{ from = $costFrom; to = $costTo } + dataset = @{ + granularity = 'Daily' + aggregation = @{ totalCost = @{ name = 'Cost'; function = 'Sum' } } + grouping = @( + @{ type = 'Dimension'; name = 'ResourceId' } + @{ type = 'Dimension'; name = 'ResourceType' } + ) + filter = @{ + dimensions = @{ name = 'ResourceType'; operator = 'In'; values = @($capacityType) } + } + } + } | ConvertTo-Json -Depth 10 + + $subscriptionIds = @($capacities | Select-Object -ExpandProperty subscriptionId -Unique) + $subscriptionData = @{} + + foreach ($subscriptionId in $subscriptionIds) { + $subEntry = [PSCustomObject]@{ + CostByResourceId = @{} # lowercased resourceId -> aggregate + Budgets = @() + Q1AuthError = $false + Q1Failed = $false + Q2AuthError = $false + Q2Failed = $false + } + + # Q1: Cost Management Query - Usage (POST). Follow properties.nextLink until exhausted. + Write-ZtProgress -Activity $activity -Status "Querying Cost Management usage for subscription $subscriptionId" + $costPath = "/subscriptions/$subscriptionId/providers/Microsoft.CostManagement/query?api-version=2025-03-01" + $nextUri = $null + $firstPage = $true + try { + do { + if ($firstPage) { + $response = Invoke-ZtAzureRequest -Path $costPath -Method POST -Payload $costQueryBody -FullResponse + $firstPage = $false + } + else { + $response = Invoke-ZtAzureRequest -Uri $nextUri -Method POST -Payload $costQueryBody -FullResponse + } + + if ($response.StatusCode -in @(401, 403)) { + $subEntry.Q1AuthError = $true + break + } + if ($response.StatusCode -ge 400) { + $subEntry.Q1Failed = $true + break + } + + $parsed = $response.Content | ConvertFrom-Json -ErrorAction Stop + $columns = @($parsed.properties.columns) + $colIndex = @{} + for ($i = 0; $i -lt $columns.Count; $i++) { $colIndex[$columns[$i].name] = $i } + + foreach ($row in @($parsed.properties.rows)) { + $resourceId = [string]$row[$colIndex['ResourceId']] + if ([string]::IsNullOrWhiteSpace($resourceId)) { continue } + $cost = [double]$row[$colIndex['Cost']] + $usageDate = if ($colIndex.ContainsKey('UsageDate')) { [string]$row[$colIndex['UsageDate']] } else { '' } + $currency = if ($colIndex.ContainsKey('Currency')) { [string]$row[$colIndex['Currency']] } else { '' } + + $key = $resourceId.ToLowerInvariant() + if (-not $subEntry.CostByResourceId.ContainsKey($key)) { + $subEntry.CostByResourceId[$key] = [PSCustomObject]@{ + Total = 0.0 + Peak = 0.0 + Days = [System.Collections.Generic.HashSet[string]]::new() + Currency = $currency + } + } + $aggregate = $subEntry.CostByResourceId[$key] + $aggregate.Total += $cost + if ($cost -gt $aggregate.Peak) { $aggregate.Peak = $cost } + if ($cost -gt 0 -and $usageDate) { [void]$aggregate.Days.Add($usageDate) } + if (-not $aggregate.Currency -and $currency) { $aggregate.Currency = $currency } + } + + $nextUri = $parsed.properties.nextLink + } while ($nextUri) + } + catch { + Write-PSFMessage "Cost Management query failed for subscription '$subscriptionId': $($_.Exception.Message)" -Tag Test -Level Warning + if ($_.Exception.Message -match 'with status (\d+):' -and [int]$Matches[1] -in @(401, 403)) { + $subEntry.Q1AuthError = $true + } + else { + $subEntry.Q1Failed = $true + } + } + + # Q2: Consumption Budgets - List (GET). Invoke-ZtAzureRequest auto-paginates and unwraps .value. + Write-ZtProgress -Activity $activity -Status "Querying Consumption budgets for subscription $subscriptionId" + $budgetsPath = "/subscriptions/$subscriptionId/providers/Microsoft.Consumption/budgets?api-version=2024-08-01" + try { + $subEntry.Budgets = @(Invoke-ZtAzureRequest -Path $budgetsPath -ErrorAction Stop) + } + catch { + Write-PSFMessage "Consumption budgets query failed for subscription '$subscriptionId': $($_.Exception.Message)" -Tag Test -Level Warning + if ($_.Exception.Message -match 'with status (\d+):' -and [int]$Matches[1] -in @(401, 403)) { + $subEntry.Q2AuthError = $true + } + else { + $subEntry.Q2Failed = $true + } + } + + $subscriptionData[$subscriptionId] = $subEntry + } + #endregion Data Collection + + #region Assessment Logic + $passed = $false + $customStatus = $null + + # Pre-classify each subscription's budgets: which ones have a qualifying notification (enabled, + # threshold <= 90, GreaterThan[OrEqualTo], with at least one email/role/group recipient) and what + # scope they target (explicit ResourceIds, resource groups, the capacity type, or the whole + # subscription when unfiltered). + foreach ($subscriptionId in $subscriptionData.Keys) { + $budgetInfos = @() + foreach ($budget in $subscriptionData[$subscriptionId].Budgets) { + $qualifyingThresholds = [System.Collections.Generic.List[double]]::new() + $notifications = $budget.properties.notifications + $notificationEntries = if ($notifications) { @($notifications.PSObject.Properties) } else { @() } + foreach ($notificationProperty in $notificationEntries) { + $notification = $notificationProperty.Value + $enabled = $notification.enabled -eq $true + $operatorOk = $notification.operator -in @('GreaterThan', 'GreaterThanOrEqualTo') + $threshold = 0.0 + $thresholdParsed = [double]::TryParse([string]$notification.threshold, [ref]$threshold) + $hasRecipient = (@($notification.contactEmails).Count -gt 0) -or (@($notification.contactRoles).Count -gt 0) -or (@($notification.contactGroups).Count -gt 0) + if ($enabled -and $operatorOk -and $thresholdParsed -and $threshold -le 90 -and $hasRecipient) { + $qualifyingThresholds.Add($threshold) + } + } + + # Flatten the filter (which may be a single dimensions block or an `and` of blocks) so a + # budget scoped by ResourceId, ResourceGroupName, or ResourceType can be matched to a capacity. + # A ResourceType filter of the capacity type is a superset of the spec's enumerated scopes: + # it targets every capacity in the subscription, so it counts as monitoring the capacity. + $resourceIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) + $resourceGroups = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) + $targetsCapacityType = $false + $filter = $budget.properties.filter + $hasFilter = $null -ne $filter -and $filter.PSObject.Properties.Count -gt 0 + $dimensionBlocks = @() + if ($filter.dimensions) { $dimensionBlocks += $filter.dimensions } + if ($filter.and) { foreach ($clause in $filter.and) { if ($clause.dimensions) { $dimensionBlocks += $clause.dimensions } } } + foreach ($dimension in $dimensionBlocks) { + switch ($dimension.name) { + 'ResourceId' { foreach ($value in @($dimension.values)) { [void]$resourceIds.Add([string]$value) } } + 'ResourceGroupName' { foreach ($value in @($dimension.values)) { [void]$resourceGroups.Add([string]$value) } } + 'ResourceType' { if (@($dimension.values) -contains $capacityType) { $targetsCapacityType = $true } } + } + } + + $budgetInfos += [PSCustomObject]@{ + Name = $budget.name + Amount = $budget.properties.amount + Unit = $budget.properties.currentSpend.unit + TimeGrain = $budget.properties.timeGrain + QualifyingThresholds = @($qualifyingThresholds | Sort-Object -Unique) + TargetsSubscription = -not $hasFilter + TargetsCapacityType = $targetsCapacityType + ResourceIds = $resourceIds + ResourceGroups = $resourceGroups + } + } + $subscriptionData[$subscriptionId] | Add-Member -NotePropertyName BudgetInfos -NotePropertyValue $budgetInfos -Force + } + + # Evaluate each discovered capacity. + $results = foreach ($capacity in $capacities) { + $subEntry = $subscriptionData[$capacity.subscriptionId] + $isDeleting = $capacity.provisioningState -in @('Deleting', 'Deleted') + + $totalCost = $null + $currency = $null + $daysBilled = $null + $peakCost = $null + $budgetName = $null + $budgetAmount = $null + $budgetUnit = $null + $timeGrain = $null + $thresholds = $null + + $q1Blocked = $subEntry.Q1AuthError -or $subEntry.Q1Failed + $q2Blocked = $subEntry.Q2AuthError -or $subEntry.Q2Failed + + if (-not $q1Blocked) { + $aggregate = $subEntry.CostByResourceId[$capacity.id.ToLowerInvariant()] + if ($aggregate) { + $totalCost = [math]::Round($aggregate.Total, 2) + $currency = $aggregate.Currency + $daysBilled = $aggregate.Days.Count + $peakCost = [math]::Round($aggregate.Peak, 2) + } + else { + $totalCost = 0.0 + $daysBilled = 0 + $peakCost = 0.0 + } + } + + # Find the first qualifying budget in the capacity's subscription that targets this capacity, + # its resource group, the capacity type, or the whole subscription (unfiltered). + $matchingBudget = $null + if (-not $q2Blocked) { + foreach ($budgetInfo in $subEntry.BudgetInfos) { + if ($budgetInfo.QualifyingThresholds.Count -eq 0) { continue } + $targetsCapacity = $budgetInfo.TargetsSubscription -or + $budgetInfo.TargetsCapacityType -or + $budgetInfo.ResourceIds.Contains($capacity.id) -or + $budgetInfo.ResourceGroups.Contains($capacity.resourceGroup) + if ($targetsCapacity) { $matchingBudget = $budgetInfo; break } + } + } + + if ($matchingBudget) { + $budgetName = $matchingBudget.Name + $budgetAmount = $matchingBudget.Amount + $budgetUnit = $matchingBudget.Unit + $timeGrain = $matchingBudget.TimeGrain + $thresholds = ($matchingBudget.QualifyingThresholds | ForEach-Object { "$_%" }) -join ', ' + } + + $hasCost = ($totalCost -gt 0) + $rowResult = + if ($q1Blocked -or $q2Blocked) { '⚠️ Investigate' } + elseif (-not $hasCost) { if ($isDeleting) { '⚠️ Deleting' } else { '⚠️ Investigate' } } + elseif ($matchingBudget) { '✅ Pass' } + else { '❌ Fail' } + + [PSCustomObject]@{ + Name = $capacity.name + Id = $capacity.id + ResourceGroup = $capacity.resourceGroup + SubscriptionId = $capacity.subscriptionId + SubscriptionName = $capacity.subscriptionName + ProvisioningState = $capacity.provisioningState + TotalCost = $totalCost + Currency = $currency + DaysBilled = $daysBilled + PeakCost = $peakCost + BudgetName = $budgetName + BudgetAmount = $budgetAmount + BudgetUnit = $budgetUnit + TimeGrain = $timeGrain + Thresholds = $thresholds + Blocked = ($q1Blocked -or $q2Blocked) + RowResult = $rowResult + } + } + + $determinableResults = @($results | Where-Object { -not $_.Blocked }) + $activeResults = @($determinableResults | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) + $capacitiesWithCost = @($activeResults | Where-Object { $_.TotalCost -gt 0 }) + $passingCapacities = @($results | Where-Object { $_.RowResult -eq '✅ Pass' }) + + if ($determinableResults.Count -eq 0) { + # Every hosting subscription returned an authorization/query error; state cannot be determined. + $customStatus = 'Investigate' + $testResultMarkdown = "⚠️ Cost Management usage or budgets could not be read for any subscription that hosts a Security Copilot capacity. Grant the assessing identity Cost Management Reader (or Reader) on those subscriptions, then re-run the assessment.`n`n%TestResult%" + } + elseif ($capacitiesWithCost.Count -eq 0) { + # Capacity exists but Cost Management shows no billed consumption in the window. + $customStatus = 'Investigate' + $testResultMarkdown = "⚠️ Security Copilot capacities exist but Cost Management shows no billed consumption in the last 30 days. Copilot may not have been adopted yet, or the tenant is auto-provisioned through Microsoft 365 E5 (no chargeable Azure resource). Validate enablement and consumption in the Security Copilot usage monitoring dashboard.`n`n%TestResult%" + } + elseif ($passingCapacities.Count -gt 0) { + $passed = $true + $testResultMarkdown = "✅ Microsoft Security Copilot SCU consumption is visible through Cost Management and at least one budget with notifications is in place against the capacity.`n`n%TestResult%" + } + else { + # Consumption is flowing but no qualifying budget targets the capacity. + $testResultMarkdown = "❌ Security Copilot SCU consumption is flowing through Cost Management, but no budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targets the capacity, its resource group, or the subscription.`n`n%TestResult%" + } + #endregion Assessment Logic + + #region Report Generation + $budgetsPortalUrl = 'https://portal.azure.com/#view/Microsoft_Azure_CostManagement/Menu/~/budgets' + + $tableRows = '' + foreach ($item in $results | Sort-Object Name) { + $nameLink = "[$(Get-SafeMarkdown $item.Name)](https://portal.azure.com/#resource$($item.Id))" + $subscriptionDisplay = if (-not [string]::IsNullOrWhiteSpace($item.SubscriptionName)) { Get-SafeMarkdown $item.SubscriptionName } else { $item.SubscriptionId } + + $costDisplay = if ($null -eq $item.TotalCost) { '—' } elseif ($item.Currency) { '{0:N2} {1}' -f $item.TotalCost, $item.Currency } else { '{0:N2}' -f $item.TotalCost } + $trendDisplay = if ($null -eq $item.DaysBilled) { '—' } elseif ($item.DaysBilled -eq 0) { 'No billed days' } else { "$($item.DaysBilled) day(s), peak {0:N2}" -f $item.PeakCost } + $budgetDisplay = if ($item.BudgetName) { Get-SafeMarkdown $item.BudgetName } else { '—' } + $amountDisplay = if ($null -eq $item.BudgetAmount) { '—' } elseif ($item.BudgetUnit) { '{0:N2} {1}' -f $item.BudgetAmount, $item.BudgetUnit } else { '{0:N2}' -f $item.BudgetAmount } + $timeGrainDisplay = if ($item.TimeGrain) { $item.TimeGrain } else { '—' } + $thresholdDisplay = if ($item.Thresholds) { $item.Thresholds } else { '—' } + + $tableRows += "| $nameLink | $subscriptionDisplay | $costDisplay | $trendDisplay | $budgetDisplay | $amountDisplay | $timeGrainDisplay | $thresholdDisplay | $($item.RowResult) |`n" + } + + $formatTemplate = @' + + +## [Security Copilot capacity consumption and budgets]({0}) + +| Capacity | Subscription | Cost (30d) | Daily trend | Budget | Amount | Time grain | Alert thresholds | Result | +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | +{1} + +'@ + + $mdInfo = $formatTemplate -f $budgetsPortalUrl, $tableRows + $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo + #endregion Report Generation + + $params = @{ + TestId = '41216' + Title = 'Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost Management' + Status = $passed + Result = $testResultMarkdown + } + if ($null -ne $customStatus) { + $params.CustomStatus = $customStatus + } + + Add-ZtTestResultDetail @params +} From 6d7b64d95c37155b03c614aa2b0c37e0209e3862 Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Fri, 28 Aug 2026 10:27:29 +0530 Subject: [PATCH 2/7] made changes as per copilot's suggestions --- .../tests/Test-Assessment.41216.ps1 | 59 +++++++++++++------ 1 file changed, 40 insertions(+), 19 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index abd605535..867cd6770 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -215,6 +215,7 @@ resources #region Assessment Logic $passed = $false $customStatus = $null + $nowUtc = (Get-Date).ToUniversalTime() # Pre-classify each subscription's budgets: which ones have a qualifying notification (enabled, # threshold <= 90, GreaterThan[OrEqualTo], with at least one email/role/group recipient) and what @@ -224,6 +225,18 @@ resources $budgetInfos = @() foreach ($budget in $subscriptionData[$subscriptionId].Budgets) { $qualifyingThresholds = [System.Collections.Generic.List[double]]::new() + + # A budget only alerts while now falls within its timePeriod; an expired or not-yet-started + # budget cannot fire, so its notifications must not qualify (spec Q2: "active" budgets). + $budgetActive = $true + $parsedBudgetDate = [datetime]::MinValue + if ($budget.properties.timePeriod.startDate -and [datetime]::TryParse([string]$budget.properties.timePeriod.startDate, [ref]$parsedBudgetDate)) { + if ($parsedBudgetDate.ToUniversalTime() -gt $nowUtc) { $budgetActive = $false } + } + if ($budget.properties.timePeriod.endDate -and [datetime]::TryParse([string]$budget.properties.timePeriod.endDate, [ref]$parsedBudgetDate)) { + if ($parsedBudgetDate.ToUniversalTime() -lt $nowUtc) { $budgetActive = $false } + } + $notifications = $budget.properties.notifications $notificationEntries = if ($notifications) { @($notifications.PSObject.Properties) } else { @() } foreach ($notificationProperty in $notificationEntries) { @@ -233,7 +246,7 @@ resources $threshold = 0.0 $thresholdParsed = [double]::TryParse([string]$notification.threshold, [ref]$threshold) $hasRecipient = (@($notification.contactEmails).Count -gt 0) -or (@($notification.contactRoles).Count -gt 0) -or (@($notification.contactGroups).Count -gt 0) - if ($enabled -and $operatorOk -and $thresholdParsed -and $threshold -le 90 -and $hasRecipient) { + if ($budgetActive -and $enabled -and $operatorOk -and $thresholdParsed -and $threshold -le 90 -and $hasRecipient) { $qualifyingThresholds.Add($threshold) } } @@ -356,28 +369,36 @@ resources } } - $determinableResults = @($results | Where-Object { -not $_.Blocked }) - $activeResults = @($determinableResults | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) - $capacitiesWithCost = @($activeResults | Where-Object { $_.TotalCost -gt 0 }) - $passingCapacities = @($results | Where-Object { $_.RowResult -eq '✅ Pass' }) - - if ($determinableResults.Count -eq 0) { - # Every hosting subscription returned an authorization/query error; state cannot be determined. - $customStatus = 'Investigate' - $testResultMarkdown = "⚠️ Cost Management usage or budgets could not be read for any subscription that hosts a Security Copilot capacity. Grant the assessing identity Cost Management Reader (or Reader) on those subscriptions, then re-run the assessment.`n`n%TestResult%" + # Aggregate across every active (non-deleting) capacity with fail > investigate > pass precedence; + # pass only when every active capacity is monitored. A single passing capacity must not mask + # another capacity that is unmonitored (Fail) or unreadable / not yet consuming (Investigate). + $activeResults = @($results | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) + $failRows = @($activeResults | Where-Object { $_.RowResult -eq '❌ Fail' }) + $passRows = @($activeResults | Where-Object { $_.RowResult -eq '✅ Pass' }) + $investigateRows = @($activeResults | Where-Object { $_.RowResult -eq '⚠️ Investigate' }) + $blockedRows = @($activeResults | Where-Object { $_.Blocked }) + $noCostRows = @($activeResults | Where-Object { -not $_.Blocked -and $_.TotalCost -le 0 }) + + if ($failRows.Count -gt 0) { + # Fail wins: at least one active capacity has consumption but no qualifying budget targets it. + $testResultMarkdown = "❌ One or more Security Copilot capacities have consumption flowing through Cost Management but no budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targeting the capacity, its resource group, or the subscription.`n`n%TestResult%" } - elseif ($capacitiesWithCost.Count -eq 0) { - # Capacity exists but Cost Management shows no billed consumption in the window. - $customStatus = 'Investigate' - $testResultMarkdown = "⚠️ Security Copilot capacities exist but Cost Management shows no billed consumption in the last 30 days. Copilot may not have been adopted yet, or the tenant is auto-provisioned through Microsoft 365 E5 (no chargeable Azure resource). Validate enablement and consumption in the Security Copilot usage monitoring dashboard.`n`n%TestResult%" - } - elseif ($passingCapacities.Count -gt 0) { + elseif ($passRows.Count -gt 0 -and $investigateRows.Count -eq 0) { + # Every active capacity is monitored. $passed = $true - $testResultMarkdown = "✅ Microsoft Security Copilot SCU consumption is visible through Cost Management and at least one budget with notifications is in place against the capacity.`n`n%TestResult%" + $testResultMarkdown = "✅ Microsoft Security Copilot SCU consumption is visible through Cost Management and every capacity is covered by a budget with notifications.`n`n%TestResult%" + } + elseif ($blockedRows.Count -gt 0 -and $passRows.Count -eq 0 -and $noCostRows.Count -eq 0) { + # No capacity could be evaluated because every hosting subscription returned a read/auth error. + $customStatus = 'Investigate' + $testResultMarkdown = "⚠️ Cost Management usage or budgets could not be read for the subscription(s) that host a Security Copilot capacity. Grant the assessing identity Cost Management Reader (or Reader) on those subscriptions, then re-run the assessment.`n`n%TestResult%" } else { - # Consumption is flowing but no qualifying budget targets the capacity. - $testResultMarkdown = "❌ Security Copilot SCU consumption is flowing through Cost Management, but no budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targets the capacity, its resource group, or the subscription.`n`n%TestResult%" + # Remaining cases are all Investigate: capacities with no billed consumption (Copilot not yet + # adopted, or the Microsoft 365 E5 inclusion path with no chargeable Azure resource), read + # errors on some subscriptions, or a pass/investigate mix that prevents confirming every capacity. + $customStatus = 'Investigate' + $testResultMarkdown = "⚠️ One or more Security Copilot capacities could not be confirmed as monitored: Cost Management shows no billed consumption for them, or their usage or budgets could not be read. Validate enablement and consumption in the Security Copilot usage monitoring dashboard, and review the capacities marked Investigate below.`n`n%TestResult%" } #endregion Assessment Logic From a5f2880438e7bbdebed7e1318599ce6ec460441d Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Fri, 28 Aug 2026 18:00:26 +0530 Subject: [PATCH 3/7] made changes as per copilot's suggestions --- src/powershell/tests/Test-Assessment.41216.ps1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index 867cd6770..065771b61 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -42,8 +42,8 @@ function Test-Assessment-41216 { $activity = 'Checking Security Copilot SCU consumption monitoring' $capacityType = 'microsoft.securitycopilot/capacities' - # Q0: Discover Security Copilot capacity resources across all accessible subscriptions via Azure - # Resource Graph. This check is self-contained and does not depend on any other spec's output. + # Discovery: enumerate Security Copilot capacity resources across all accessible subscriptions via + # Azure Resource Graph. This check is self-contained and does not depend on any other spec's output. Write-ZtProgress -Activity $activity -Status 'Discovering Security Copilot capacities via Resource Graph' $argQuery = @" From 8232ce718016cdea7a935a06e807c1f0694ffbc7 Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Mon, 31 Aug 2026 13:11:59 +0530 Subject: [PATCH 4/7] made changes as per updated spec --- src/powershell/tests/Test-Assessment.41216.md | 2 +- .../tests/Test-Assessment.41216.ps1 | 179 +++--------------- 2 files changed, 27 insertions(+), 154 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.md b/src/powershell/tests/Test-Assessment.41216.md index 527eda266..ef962b0b4 100644 --- a/src/powershell/tests/Test-Assessment.41216.md +++ b/src/powershell/tests/Test-Assessment.41216.md @@ -1,4 +1,4 @@ -Security Copilot is billed by the hour against a fixed pool of Security Compute Units (SCUs) provisioned per capacity, with optional overage units that take over when the provisioned pool is exhausted. When the combined provisioned plus overage capacity is reached, analysts receive an in-product error and Copilot stops responding to new prompts until the next hour, breaking incident triage in mid-flight. From a kill-chain perspective, an unmonitored capacity that silently saturates during a high-volume incident (for example, a phishing wave producing hundreds of correlated alerts) erodes defender velocity exactly when it matters: while Copilot is unavailable, analysts revert to manual workflows, mean-time-to-respond (MTTR) increases, and the threat actor's window for Lateral Movement, Collection, and Exfiltration widens. Continuous monitoring of SCU consumption through Microsoft Cost Management — paired with budget alerts that fire well before the cap — converts a hard service interruption into an early signal that lets owners adjust capacity proactively. +Security Copilot is billed by the hour against a fixed pool of Security Compute Units (SCUs) provisioned per capacity, with optional overage units that take over when the provisioned pool is exhausted. When the combined provisioned plus overage capacity is reached, analysts receive an in-product error and Copilot stops responding to new prompts until the next hour, breaking incident triage in mid-flight. From a kill-chain perspective, an unmonitored capacity that silently saturates during a high-volume incident (for example, a phishing wave producing hundreds of correlated alerts) erodes defender velocity exactly when it matters: while Copilot is unavailable, analysts revert to manual workflows, mean-time-to-respond (MTTR) increases, and the threat actor's window for Lateral Movement, Collection, and Exfiltration widens. Continuous monitoring of SCU consumption through Microsoft Cost Management — paired with budget alerts that fire well before the cap — converts a hard service interruption into an early signal that lets owners adjust capacity proactively. This check applies to **provisioned and overage (paid) SCU capacity**, which is billed through Azure and is therefore governable by a Cost Management budget. Microsoft 365 E5 and E7 **inclusion** capacity is auto-provisioned (zero-click) at no additional Azure cost, cannot be modified, and is monitored through the in-product Security Copilot usage dashboard rather than Cost Management — so a tenant with only inclusion capacity is out of scope for this check. ## Remediation resources diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index 065771b61..f4abf9d86 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -4,9 +4,8 @@ .DESCRIPTION Discovers Microsoft Security Copilot capacity resources via Azure Resource Graph, then for each - subscription that hosts a capacity confirms that Cost Management is billing the capacity (Query - - Usage) and that at least one Consumption budget with qualifying notifications targets the capacity, - its resource group, or the subscription. + subscription that hosts a capacity confirms that at least one Consumption budget with qualifying + notifications targets the capacity, its resource group, or the subscription. .NOTES Test ID: 41216 @@ -15,7 +14,6 @@ Category: AI for security Required APIs: - Azure Resource Graph (management.azure.com) — capacity discovery - - Cost Management Query - Usage (Microsoft.CostManagement/query) — subscription scope - Consumption Budgets - List (Microsoft.Consumption/budgets) — subscription scope #> @@ -92,107 +90,18 @@ resources return } - # Q1 + Q2: for each subscription that hosts a capacity, pull the last 30 days of Cost Management - # usage for the capacity resource type and the list of Consumption budgets. - $costFrom = (Get-Date).ToUniversalTime().AddDays(-30).ToString('yyyy-MM-ddTHH:mm:ssZ') - $costTo = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') - - $costQueryBody = @{ - type = 'ActualCost' - timeframe = 'Custom' - timePeriod = @{ from = $costFrom; to = $costTo } - dataset = @{ - granularity = 'Daily' - aggregation = @{ totalCost = @{ name = 'Cost'; function = 'Sum' } } - grouping = @( - @{ type = 'Dimension'; name = 'ResourceId' } - @{ type = 'Dimension'; name = 'ResourceType' } - ) - filter = @{ - dimensions = @{ name = 'ResourceType'; operator = 'In'; values = @($capacityType) } - } - } - } | ConvertTo-Json -Depth 10 - + # Q1: for each subscription that hosts a capacity, list the Consumption budgets. $subscriptionIds = @($capacities | Select-Object -ExpandProperty subscriptionId -Unique) $subscriptionData = @{} foreach ($subscriptionId in $subscriptionIds) { $subEntry = [PSCustomObject]@{ - CostByResourceId = @{} # lowercased resourceId -> aggregate - Budgets = @() - Q1AuthError = $false - Q1Failed = $false - Q2AuthError = $false - Q2Failed = $false + Budgets = @() + BudgetAuthError = $false + BudgetFailed = $false } - # Q1: Cost Management Query - Usage (POST). Follow properties.nextLink until exhausted. - Write-ZtProgress -Activity $activity -Status "Querying Cost Management usage for subscription $subscriptionId" - $costPath = "/subscriptions/$subscriptionId/providers/Microsoft.CostManagement/query?api-version=2025-03-01" - $nextUri = $null - $firstPage = $true - try { - do { - if ($firstPage) { - $response = Invoke-ZtAzureRequest -Path $costPath -Method POST -Payload $costQueryBody -FullResponse - $firstPage = $false - } - else { - $response = Invoke-ZtAzureRequest -Uri $nextUri -Method POST -Payload $costQueryBody -FullResponse - } - - if ($response.StatusCode -in @(401, 403)) { - $subEntry.Q1AuthError = $true - break - } - if ($response.StatusCode -ge 400) { - $subEntry.Q1Failed = $true - break - } - - $parsed = $response.Content | ConvertFrom-Json -ErrorAction Stop - $columns = @($parsed.properties.columns) - $colIndex = @{} - for ($i = 0; $i -lt $columns.Count; $i++) { $colIndex[$columns[$i].name] = $i } - - foreach ($row in @($parsed.properties.rows)) { - $resourceId = [string]$row[$colIndex['ResourceId']] - if ([string]::IsNullOrWhiteSpace($resourceId)) { continue } - $cost = [double]$row[$colIndex['Cost']] - $usageDate = if ($colIndex.ContainsKey('UsageDate')) { [string]$row[$colIndex['UsageDate']] } else { '' } - $currency = if ($colIndex.ContainsKey('Currency')) { [string]$row[$colIndex['Currency']] } else { '' } - - $key = $resourceId.ToLowerInvariant() - if (-not $subEntry.CostByResourceId.ContainsKey($key)) { - $subEntry.CostByResourceId[$key] = [PSCustomObject]@{ - Total = 0.0 - Peak = 0.0 - Days = [System.Collections.Generic.HashSet[string]]::new() - Currency = $currency - } - } - $aggregate = $subEntry.CostByResourceId[$key] - $aggregate.Total += $cost - if ($cost -gt $aggregate.Peak) { $aggregate.Peak = $cost } - if ($cost -gt 0 -and $usageDate) { [void]$aggregate.Days.Add($usageDate) } - if (-not $aggregate.Currency -and $currency) { $aggregate.Currency = $currency } - } - - $nextUri = $parsed.properties.nextLink - } while ($nextUri) - } - catch { - Write-PSFMessage "Cost Management query failed for subscription '$subscriptionId': $($_.Exception.Message)" -Tag Test -Level Warning - if ($_.Exception.Message -match 'with status (\d+):' -and [int]$Matches[1] -in @(401, 403)) { - $subEntry.Q1AuthError = $true - } - else { - $subEntry.Q1Failed = $true - } - } - - # Q2: Consumption Budgets - List (GET). Invoke-ZtAzureRequest auto-paginates and unwraps .value. + # Q1: Consumption Budgets - List (GET). Invoke-ZtAzureRequest auto-paginates and unwraps .value. Write-ZtProgress -Activity $activity -Status "Querying Consumption budgets for subscription $subscriptionId" $budgetsPath = "/subscriptions/$subscriptionId/providers/Microsoft.Consumption/budgets?api-version=2024-08-01" try { @@ -201,10 +110,10 @@ resources catch { Write-PSFMessage "Consumption budgets query failed for subscription '$subscriptionId': $($_.Exception.Message)" -Tag Test -Level Warning if ($_.Exception.Message -match 'with status (\d+):' -and [int]$Matches[1] -in @(401, 403)) { - $subEntry.Q2AuthError = $true + $subEntry.BudgetAuthError = $true } else { - $subEntry.Q2Failed = $true + $subEntry.BudgetFailed = $true } } @@ -291,38 +200,18 @@ resources $subEntry = $subscriptionData[$capacity.subscriptionId] $isDeleting = $capacity.provisioningState -in @('Deleting', 'Deleted') - $totalCost = $null - $currency = $null - $daysBilled = $null - $peakCost = $null $budgetName = $null $budgetAmount = $null $budgetUnit = $null $timeGrain = $null $thresholds = $null - $q1Blocked = $subEntry.Q1AuthError -or $subEntry.Q1Failed - $q2Blocked = $subEntry.Q2AuthError -or $subEntry.Q2Failed - - if (-not $q1Blocked) { - $aggregate = $subEntry.CostByResourceId[$capacity.id.ToLowerInvariant()] - if ($aggregate) { - $totalCost = [math]::Round($aggregate.Total, 2) - $currency = $aggregate.Currency - $daysBilled = $aggregate.Days.Count - $peakCost = [math]::Round($aggregate.Peak, 2) - } - else { - $totalCost = 0.0 - $daysBilled = 0 - $peakCost = 0.0 - } - } + $budgetBlocked = $subEntry.BudgetAuthError -or $subEntry.BudgetFailed # Find the first qualifying budget in the capacity's subscription that targets this capacity, # its resource group, the capacity type, or the whole subscription (unfiltered). $matchingBudget = $null - if (-not $q2Blocked) { + if (-not $budgetBlocked) { foreach ($budgetInfo in $subEntry.BudgetInfos) { if ($budgetInfo.QualifyingThresholds.Count -eq 0) { continue } $targetsCapacity = $budgetInfo.TargetsSubscription -or @@ -341,11 +230,10 @@ resources $thresholds = ($matchingBudget.QualifyingThresholds | ForEach-Object { "$_%" }) -join ', ' } - $hasCost = ($totalCost -gt 0) $rowResult = - if ($q1Blocked -or $q2Blocked) { '⚠️ Investigate' } - elseif (-not $hasCost) { if ($isDeleting) { '⚠️ Deleting' } else { '⚠️ Investigate' } } + if ($budgetBlocked) { '⚠️ Investigate' } elseif ($matchingBudget) { '✅ Pass' } + elseif ($isDeleting) { '⚠️ Deleting' } else { '❌ Fail' } [PSCustomObject]@{ @@ -355,50 +243,37 @@ resources SubscriptionId = $capacity.subscriptionId SubscriptionName = $capacity.subscriptionName ProvisioningState = $capacity.provisioningState - TotalCost = $totalCost - Currency = $currency - DaysBilled = $daysBilled - PeakCost = $peakCost BudgetName = $budgetName BudgetAmount = $budgetAmount BudgetUnit = $budgetUnit TimeGrain = $timeGrain Thresholds = $thresholds - Blocked = ($q1Blocked -or $q2Blocked) + Blocked = $budgetBlocked RowResult = $rowResult } } # Aggregate across every active (non-deleting) capacity with fail > investigate > pass precedence; - # pass only when every active capacity is monitored. A single passing capacity must not mask - # another capacity that is unmonitored (Fail) or unreadable / not yet consuming (Investigate). + # pass only when every active capacity is covered by a qualifying budget. A single passing capacity + # must not mask another that is unmonitored (Fail) or whose budgets could not be read (Investigate). $activeResults = @($results | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) $failRows = @($activeResults | Where-Object { $_.RowResult -eq '❌ Fail' }) $passRows = @($activeResults | Where-Object { $_.RowResult -eq '✅ Pass' }) $investigateRows = @($activeResults | Where-Object { $_.RowResult -eq '⚠️ Investigate' }) - $blockedRows = @($activeResults | Where-Object { $_.Blocked }) - $noCostRows = @($activeResults | Where-Object { -not $_.Blocked -and $_.TotalCost -le 0 }) if ($failRows.Count -gt 0) { - # Fail wins: at least one active capacity has consumption but no qualifying budget targets it. - $testResultMarkdown = "❌ One or more Security Copilot capacities have consumption flowing through Cost Management but no budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targeting the capacity, its resource group, or the subscription.`n`n%TestResult%" + # Fail wins: at least one active capacity has no qualifying budget targeting it. + $testResultMarkdown = "❌ One or more Security Copilot capacities have no Cost Management budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targeting the capacity, its resource group, or the subscription.`n`n%TestResult%" } elseif ($passRows.Count -gt 0 -and $investigateRows.Count -eq 0) { - # Every active capacity is monitored. + # Every active capacity is covered by a qualifying budget. $passed = $true - $testResultMarkdown = "✅ Microsoft Security Copilot SCU consumption is visible through Cost Management and every capacity is covered by a budget with notifications.`n`n%TestResult%" - } - elseif ($blockedRows.Count -gt 0 -and $passRows.Count -eq 0 -and $noCostRows.Count -eq 0) { - # No capacity could be evaluated because every hosting subscription returned a read/auth error. - $customStatus = 'Investigate' - $testResultMarkdown = "⚠️ Cost Management usage or budgets could not be read for the subscription(s) that host a Security Copilot capacity. Grant the assessing identity Cost Management Reader (or Reader) on those subscriptions, then re-run the assessment.`n`n%TestResult%" + $testResultMarkdown = "✅ Every Microsoft Security Copilot capacity is covered by a Cost Management budget with alert notifications, so SCU spend is monitored and alerted on before the cap.`n`n%TestResult%" } else { - # Remaining cases are all Investigate: capacities with no billed consumption (Copilot not yet - # adopted, or the Microsoft 365 E5 inclusion path with no chargeable Azure resource), read - # errors on some subscriptions, or a pass/investigate mix that prevents confirming every capacity. + # No fail and not all-pass: budgets could not be read for one or more hosting subscriptions. $customStatus = 'Investigate' - $testResultMarkdown = "⚠️ One or more Security Copilot capacities could not be confirmed as monitored: Cost Management shows no billed consumption for them, or their usage or budgets could not be read. Validate enablement and consumption in the Security Copilot usage monitoring dashboard, and review the capacities marked Investigate below.`n`n%TestResult%" + $testResultMarkdown = "⚠️ Cost Management budgets could not be read for the subscription(s) that host a Security Copilot capacity. Grant the assessing identity Cost Management Reader (or Reader) on those subscriptions, then re-run the assessment.`n`n%TestResult%" } #endregion Assessment Logic @@ -410,23 +285,21 @@ resources $nameLink = "[$(Get-SafeMarkdown $item.Name)](https://portal.azure.com/#resource$($item.Id))" $subscriptionDisplay = if (-not [string]::IsNullOrWhiteSpace($item.SubscriptionName)) { Get-SafeMarkdown $item.SubscriptionName } else { $item.SubscriptionId } - $costDisplay = if ($null -eq $item.TotalCost) { '—' } elseif ($item.Currency) { '{0:N2} {1}' -f $item.TotalCost, $item.Currency } else { '{0:N2}' -f $item.TotalCost } - $trendDisplay = if ($null -eq $item.DaysBilled) { '—' } elseif ($item.DaysBilled -eq 0) { 'No billed days' } else { "$($item.DaysBilled) day(s), peak {0:N2}" -f $item.PeakCost } $budgetDisplay = if ($item.BudgetName) { Get-SafeMarkdown $item.BudgetName } else { '—' } $amountDisplay = if ($null -eq $item.BudgetAmount) { '—' } elseif ($item.BudgetUnit) { '{0:N2} {1}' -f $item.BudgetAmount, $item.BudgetUnit } else { '{0:N2}' -f $item.BudgetAmount } $timeGrainDisplay = if ($item.TimeGrain) { $item.TimeGrain } else { '—' } $thresholdDisplay = if ($item.Thresholds) { $item.Thresholds } else { '—' } - $tableRows += "| $nameLink | $subscriptionDisplay | $costDisplay | $trendDisplay | $budgetDisplay | $amountDisplay | $timeGrainDisplay | $thresholdDisplay | $($item.RowResult) |`n" + $tableRows += "| $nameLink | $subscriptionDisplay | $budgetDisplay | $amountDisplay | $timeGrainDisplay | $thresholdDisplay | $($item.RowResult) |`n" } $formatTemplate = @' -## [Security Copilot capacity consumption and budgets]({0}) +## [Security Copilot capacity budgets]({0}) -| Capacity | Subscription | Cost (30d) | Daily trend | Budget | Amount | Time grain | Alert thresholds | Result | -| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | +| Capacity | Subscription | Budget | Amount | Time grain | Alert thresholds | Result | +| :--- | :--- | :--- | :--- | :--- | :--- | :--- | {1} '@ From 5fe72eb39f589d385f7907ba2e4d0ba530408b5e Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Mon, 31 Aug 2026 13:36:25 +0530 Subject: [PATCH 5/7] made changes as per copilot's suggestions --- .../tests/Test-Assessment.41216.ps1 | 66 +++++++++++-------- 1 file changed, 37 insertions(+), 29 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index f4abf9d86..c5db53aa6 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -160,25 +160,15 @@ resources } } - # Flatten the filter (which may be a single dimensions block or an `and` of blocks) so a - # budget scoped by ResourceId, ResourceGroupName, or ResourceType can be matched to a capacity. - # A ResourceType filter of the capacity type is a superset of the spec's enumerated scopes: - # it targets every capacity in the subscription, so it counts as monitoring the capacity. - $resourceIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) - $resourceGroups = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) - $targetsCapacityType = $false + # Collect the budget's filter clauses. A budget with no filter is subscription-scoped + # (covers every resource, including the capacity). Otherwise the filter is a single + # `dimensions` clause or an `and` of clauses; Cost Management evaluates `and` + # conjunctively, so ALL clauses must match a capacity for the budget to apply. $filter = $budget.properties.filter $hasFilter = $null -ne $filter -and $filter.PSObject.Properties.Count -gt 0 - $dimensionBlocks = @() - if ($filter.dimensions) { $dimensionBlocks += $filter.dimensions } - if ($filter.and) { foreach ($clause in $filter.and) { if ($clause.dimensions) { $dimensionBlocks += $clause.dimensions } } } - foreach ($dimension in $dimensionBlocks) { - switch ($dimension.name) { - 'ResourceId' { foreach ($value in @($dimension.values)) { [void]$resourceIds.Add([string]$value) } } - 'ResourceGroupName' { foreach ($value in @($dimension.values)) { [void]$resourceGroups.Add([string]$value) } } - 'ResourceType' { if (@($dimension.values) -contains $capacityType) { $targetsCapacityType = $true } } - } - } + $filterClauses = @() + if ($filter.dimensions) { $filterClauses += $filter.dimensions } + if ($filter.and) { foreach ($clause in $filter.and) { if ($clause.dimensions) { $filterClauses += $clause.dimensions } } } $budgetInfos += [PSCustomObject]@{ Name = $budget.name @@ -187,9 +177,7 @@ resources TimeGrain = $budget.properties.timeGrain QualifyingThresholds = @($qualifyingThresholds | Sort-Object -Unique) TargetsSubscription = -not $hasFilter - TargetsCapacityType = $targetsCapacityType - ResourceIds = $resourceIds - ResourceGroups = $resourceGroups + FilterClauses = $filterClauses } } $subscriptionData[$subscriptionId] | Add-Member -NotePropertyName BudgetInfos -NotePropertyValue $budgetInfos -Force @@ -208,17 +196,29 @@ resources $budgetBlocked = $subEntry.BudgetAuthError -or $subEntry.BudgetFailed - # Find the first qualifying budget in the capacity's subscription that targets this capacity, - # its resource group, the capacity type, or the whole subscription (unfiltered). + # Find the first qualifying budget in the capacity's subscription that targets this capacity. + # A subscription-scoped (unfiltered) budget always covers it; a filtered budget covers it only + # when EVERY clause matches (AND). A clause on a dimension we cannot evaluate against the + # capacity (for example Tags) fails the match rather than being ignored, to avoid a false pass. $matchingBudget = $null if (-not $budgetBlocked) { foreach ($budgetInfo in $subEntry.BudgetInfos) { if ($budgetInfo.QualifyingThresholds.Count -eq 0) { continue } - $targetsCapacity = $budgetInfo.TargetsSubscription -or - $budgetInfo.TargetsCapacityType -or - $budgetInfo.ResourceIds.Contains($capacity.id) -or - $budgetInfo.ResourceGroups.Contains($capacity.resourceGroup) - if ($targetsCapacity) { $matchingBudget = $budgetInfo; break } + + if ($budgetInfo.TargetsSubscription) { $matchingBudget = $budgetInfo; break } + + $allClausesMatch = $true + foreach ($clause in $budgetInfo.FilterClauses) { + $clauseValues = @($clause.values) + $clauseMatch = switch ($clause.name) { + 'ResourceId' { $clauseValues -contains $capacity.id } + 'ResourceGroupName' { $clauseValues -contains $capacity.resourceGroup } + 'ResourceType' { $clauseValues -contains $capacityType } + default { $false } + } + if (-not $clauseMatch) { $allClausesMatch = $false; break } + } + if ($allClausesMatch) { $matchingBudget = $budgetInfo; break } } } @@ -231,9 +231,9 @@ resources } $rowResult = - if ($budgetBlocked) { '⚠️ Investigate' } + if ($isDeleting) { '⚠️ Deleting' } + elseif ($budgetBlocked) { '⚠️ Investigate' } elseif ($matchingBudget) { '✅ Pass' } - elseif ($isDeleting) { '⚠️ Deleting' } else { '❌ Fail' } [PSCustomObject]@{ @@ -257,6 +257,14 @@ resources # pass only when every active capacity is covered by a qualifying budget. A single passing capacity # must not mask another that is unmonitored (Fail) or whose budgets could not be read (Investigate). $activeResults = @($results | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) + + # Every discovered capacity is being torn down; there is no active capacity to assess. + if ($activeResults.Count -eq 0) { + Write-PSFMessage 'All discovered Security Copilot capacities are Deleting/Deleted — skipping.' -Tag Test -Level VeryVerbose + Add-ZtTestResultDetail -SkippedBecause NotApplicable + return + } + $failRows = @($activeResults | Where-Object { $_.RowResult -eq '❌ Fail' }) $passRows = @($activeResults | Where-Object { $_.RowResult -eq '✅ Pass' }) $investigateRows = @($activeResults | Where-Object { $_.RowResult -eq '⚠️ Investigate' }) From 6a01e544b4a4e7b862709b030386f620117b5f96 Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Tue, 1 Sep 2026 14:33:12 +0530 Subject: [PATCH 6/7] made changes as per updated spec --- .../tests/Test-Assessment.41216.ps1 | 65 ++++++++++--------- 1 file changed, 35 insertions(+), 30 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index c5db53aa6..ace373316 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -136,7 +136,7 @@ resources $qualifyingThresholds = [System.Collections.Generic.List[double]]::new() # A budget only alerts while now falls within its timePeriod; an expired or not-yet-started - # budget cannot fire, so its notifications must not qualify (spec Q2: "active" budgets). + # budget cannot fire, so its notifications must not qualify (spec Q1: "active" budget). $budgetActive = $true $parsedBudgetDate = [datetime]::MinValue if ($budget.properties.timePeriod.startDate -and [datetime]::TryParse([string]$budget.properties.timePeriod.startDate, [ref]$parsedBudgetDate)) { @@ -162,13 +162,22 @@ resources # Collect the budget's filter clauses. A budget with no filter is subscription-scoped # (covers every resource, including the capacity). Otherwise the filter is a single - # `dimensions` clause or an `and` of clauses; Cost Management evaluates `and` - # conjunctively, so ALL clauses must match a capacity for the budget to apply. + # `dimensions`/`tags` clause or an `and` of clauses; Cost Management evaluates `and` + # conjunctively, so ALL clauses must match a capacity for the budget to apply. Tag clauses + # are unevaluable here because ARG discovery does not return resource tags, so a budget + # carrying any tag constraint cannot be proven to cover the capacity. $filter = $budget.properties.filter $hasFilter = $null -ne $filter -and $filter.PSObject.Properties.Count -gt 0 - $filterClauses = @() - if ($filter.dimensions) { $filterClauses += $filter.dimensions } - if ($filter.and) { foreach ($clause in $filter.and) { if ($clause.dimensions) { $filterClauses += $clause.dimensions } } } + $dimensionClauses = @() + $hasUnevaluableClause = $false + if ($filter.dimensions) { $dimensionClauses += $filter.dimensions } + if ($filter.tags) { $hasUnevaluableClause = $true } + if ($filter.and) { + foreach ($clause in $filter.and) { + if ($clause.dimensions) { $dimensionClauses += $clause.dimensions } + if ($clause.tags) { $hasUnevaluableClause = $true } + } + } $budgetInfos += [PSCustomObject]@{ Name = $budget.name @@ -177,7 +186,8 @@ resources TimeGrain = $budget.properties.timeGrain QualifyingThresholds = @($qualifyingThresholds | Sort-Object -Unique) TargetsSubscription = -not $hasFilter - FilterClauses = $filterClauses + DimensionClauses = $dimensionClauses + HasUnevaluableClause = $hasUnevaluableClause } } $subscriptionData[$subscriptionId] | Add-Member -NotePropertyName BudgetInfos -NotePropertyValue $budgetInfos -Force @@ -186,7 +196,6 @@ resources # Evaluate each discovered capacity. $results = foreach ($capacity in $capacities) { $subEntry = $subscriptionData[$capacity.subscriptionId] - $isDeleting = $capacity.provisioningState -in @('Deleting', 'Deleted') $budgetName = $null $budgetAmount = $null @@ -207,8 +216,13 @@ resources if ($budgetInfo.TargetsSubscription) { $matchingBudget = $budgetInfo; break } + # A filtered budget must carry no unevaluable (tag) clause, expose at least one + # evaluable dimension clause, and every dimension clause must include the capacity (AND). + if ($budgetInfo.HasUnevaluableClause) { continue } + if ($budgetInfo.DimensionClauses.Count -eq 0) { continue } + $allClausesMatch = $true - foreach ($clause in $budgetInfo.FilterClauses) { + foreach ($clause in $budgetInfo.DimensionClauses) { $clauseValues = @($clause.values) $clauseMatch = switch ($clause.name) { 'ResourceId' { $clauseValues -contains $capacity.id } @@ -231,8 +245,7 @@ resources } $rowResult = - if ($isDeleting) { '⚠️ Deleting' } - elseif ($budgetBlocked) { '⚠️ Investigate' } + if ($budgetBlocked) { '⚠️ Investigate' } elseif ($matchingBudget) { '✅ Pass' } else { '❌ Fail' } @@ -253,30 +266,22 @@ resources } } - # Aggregate across every active (non-deleting) capacity with fail > investigate > pass precedence; - # pass only when every active capacity is covered by a qualifying budget. A single passing capacity - # must not mask another that is unmonitored (Fail) or whose budgets could not be read (Investigate). - $activeResults = @($results | Where-Object { $_.ProvisioningState -notin @('Deleting', 'Deleted') }) - - # Every discovered capacity is being torn down; there is no active capacity to assess. - if ($activeResults.Count -eq 0) { - Write-PSFMessage 'All discovered Security Copilot capacities are Deleting/Deleted — skipping.' -Tag Test -Level VeryVerbose - Add-ZtTestResultDetail -SkippedBecause NotApplicable - return - } - - $failRows = @($activeResults | Where-Object { $_.RowResult -eq '❌ Fail' }) - $passRows = @($activeResults | Where-Object { $_.RowResult -eq '✅ Pass' }) - $investigateRows = @($activeResults | Where-Object { $_.RowResult -eq '⚠️ Investigate' }) + # Aggregate across every discovered capacity with fail > investigate > pass precedence; pass only + # when every capacity is covered by a qualifying budget. A single passing capacity must not mask + # another that is unmonitored (Fail) or whose budgets could not be read (Investigate). The spec + # defines Skipped only when discovery returns no capacity, so every returned capacity is evaluated. + $failRows = @($results | Where-Object { $_.RowResult -eq '❌ Fail' }) + $passRows = @($results | Where-Object { $_.RowResult -eq '✅ Pass' }) + $investigateRows = @($results | Where-Object { $_.RowResult -eq '⚠️ Investigate' }) if ($failRows.Count -gt 0) { - # Fail wins: at least one active capacity has no qualifying budget targeting it. + # Fail wins: at least one capacity has no qualifying budget targeting it. $testResultMarkdown = "❌ One or more Security Copilot capacities have no Cost Management budget with qualifying notifications (enabled, threshold ≤ 90%, with an email, role, or action-group recipient) targeting the capacity, its resource group, or the subscription.`n`n%TestResult%" } elseif ($passRows.Count -gt 0 -and $investigateRows.Count -eq 0) { - # Every active capacity is covered by a qualifying budget. + # Every capacity is covered by a qualifying budget. $passed = $true - $testResultMarkdown = "✅ Every Microsoft Security Copilot capacity is covered by a Cost Management budget with alert notifications, so SCU spend is monitored and alerted on before the cap.`n`n%TestResult%" + $testResultMarkdown = "✅ Every Microsoft Security Copilot (provisioned/overage) capacity is covered by a Cost Management budget with alert notifications, so SCU spend is monitored and alerted on before the cap.`n`n%TestResult%" } else { # No fail and not all-pass: budgets could not be read for one or more hosting subscriptions. @@ -293,7 +298,7 @@ resources $nameLink = "[$(Get-SafeMarkdown $item.Name)](https://portal.azure.com/#resource$($item.Id))" $subscriptionDisplay = if (-not [string]::IsNullOrWhiteSpace($item.SubscriptionName)) { Get-SafeMarkdown $item.SubscriptionName } else { $item.SubscriptionId } - $budgetDisplay = if ($item.BudgetName) { Get-SafeMarkdown $item.BudgetName } else { '—' } + $budgetDisplay = if ($item.BudgetName) { Get-SafeMarkdown $item.BudgetName } elseif ($item.RowResult -eq '❌ Fail') { 'No qualifying budget' } else { '—' } $amountDisplay = if ($null -eq $item.BudgetAmount) { '—' } elseif ($item.BudgetUnit) { '{0:N2} {1}' -f $item.BudgetAmount, $item.BudgetUnit } else { '{0:N2}' -f $item.BudgetAmount } $timeGrainDisplay = if ($item.TimeGrain) { $item.TimeGrain } else { '—' } $thresholdDisplay = if ($item.Thresholds) { $item.Thresholds } else { '—' } From 929bc0c1a4d52aeeccc7423fa911b9b8411786f5 Mon Sep 17 00:00:00 2001 From: aahmed-spec Date: Tue, 1 Sep 2026 19:59:10 +0530 Subject: [PATCH 7/7] made changes as per Alek's suggestions --- .../tests/Test-Assessment.41216.ps1 | 56 +++++++++++-------- 1 file changed, 32 insertions(+), 24 deletions(-) diff --git a/src/powershell/tests/Test-Assessment.41216.ps1 b/src/powershell/tests/Test-Assessment.41216.ps1 index ace373316..b5a660b35 100644 --- a/src/powershell/tests/Test-Assessment.41216.ps1 +++ b/src/powershell/tests/Test-Assessment.41216.ps1 @@ -53,7 +53,7 @@ resources | where properties.state =~ 'Enabled' | project subscriptionId, subscriptionName = name ) on subscriptionId -| project id, name, location, resourceGroup, subscriptionId, subscriptionName, provisioningState = tostring(properties.provisioningState) +| project id, name, location, resourceGroup, subscriptionId, subscriptionName, tags, provisioningState = tostring(properties.provisioningState) "@ $capacities = @() @@ -163,19 +163,17 @@ resources # Collect the budget's filter clauses. A budget with no filter is subscription-scoped # (covers every resource, including the capacity). Otherwise the filter is a single # `dimensions`/`tags` clause or an `and` of clauses; Cost Management evaluates `and` - # conjunctively, so ALL clauses must match a capacity for the budget to apply. Tag clauses - # are unevaluable here because ARG discovery does not return resource tags, so a budget - # carrying any tag constraint cannot be proven to cover the capacity. + # conjunctively, so ALL clauses (dimension and tag) must match a capacity for the budget to + # apply. Each clause is kept with its kind so tags can be evaluated against the capacity tags. $filter = $budget.properties.filter $hasFilter = $null -ne $filter -and $filter.PSObject.Properties.Count -gt 0 - $dimensionClauses = @() - $hasUnevaluableClause = $false - if ($filter.dimensions) { $dimensionClauses += $filter.dimensions } - if ($filter.tags) { $hasUnevaluableClause = $true } + $filterClauses = @() + if ($filter.dimensions) { $filterClauses += [PSCustomObject]@{ Kind = 'Dimension'; Clause = $filter.dimensions } } + if ($filter.tags) { $filterClauses += [PSCustomObject]@{ Kind = 'Tag'; Clause = $filter.tags } } if ($filter.and) { foreach ($clause in $filter.and) { - if ($clause.dimensions) { $dimensionClauses += $clause.dimensions } - if ($clause.tags) { $hasUnevaluableClause = $true } + if ($clause.dimensions) { $filterClauses += [PSCustomObject]@{ Kind = 'Dimension'; Clause = $clause.dimensions } } + if ($clause.tags) { $filterClauses += [PSCustomObject]@{ Kind = 'Tag'; Clause = $clause.tags } } } } @@ -186,8 +184,7 @@ resources TimeGrain = $budget.properties.timeGrain QualifyingThresholds = @($qualifyingThresholds | Sort-Object -Unique) TargetsSubscription = -not $hasFilter - DimensionClauses = $dimensionClauses - HasUnevaluableClause = $hasUnevaluableClause + FilterClauses = $filterClauses } } $subscriptionData[$subscriptionId] | Add-Member -NotePropertyName BudgetInfos -NotePropertyValue $budgetInfos -Force @@ -207,8 +204,9 @@ resources # Find the first qualifying budget in the capacity's subscription that targets this capacity. # A subscription-scoped (unfiltered) budget always covers it; a filtered budget covers it only - # when EVERY clause matches (AND). A clause on a dimension we cannot evaluate against the - # capacity (for example Tags) fails the match rather than being ignored, to avoid a false pass. + # when EVERY clause matches (AND). Dimension clauses match on ResourceId/ResourceGroupName/ + # ResourceType; tag clauses match when the capacity carries the tag with a listed value. A + # clause on a dimension we cannot evaluate fails the match rather than being ignored. $matchingBudget = $null if (-not $budgetBlocked) { foreach ($budgetInfo in $subEntry.BudgetInfos) { @@ -216,19 +214,29 @@ resources if ($budgetInfo.TargetsSubscription) { $matchingBudget = $budgetInfo; break } - # A filtered budget must carry no unevaluable (tag) clause, expose at least one - # evaluable dimension clause, and every dimension clause must include the capacity (AND). - if ($budgetInfo.HasUnevaluableClause) { continue } - if ($budgetInfo.DimensionClauses.Count -eq 0) { continue } + # A filtered budget must expose at least one clause and every clause must include the capacity. + if ($budgetInfo.FilterClauses.Count -eq 0) { continue } $allClausesMatch = $true - foreach ($clause in $budgetInfo.DimensionClauses) { + foreach ($filterClause in $budgetInfo.FilterClauses) { + $clause = $filterClause.Clause $clauseValues = @($clause.values) - $clauseMatch = switch ($clause.name) { - 'ResourceId' { $clauseValues -contains $capacity.id } - 'ResourceGroupName' { $clauseValues -contains $capacity.resourceGroup } - 'ResourceType' { $clauseValues -contains $capacityType } - default { $false } + if ($filterClause.Kind -eq 'Tag') { + # Tag key match is case-insensitive; value comparison via -contains is case-insensitive. + $capacityTagValue = $null + if ($capacity.tags) { + $tagProperty = $capacity.tags.PSObject.Properties | Where-Object { $_.Name -ieq $clause.name } | Select-Object -First 1 + if ($tagProperty) { $capacityTagValue = [string]$tagProperty.Value } + } + $clauseMatch = $null -ne $capacityTagValue -and ($clauseValues -contains $capacityTagValue) + } + else { + $clauseMatch = switch ($clause.name) { + 'ResourceId' { $clauseValues -contains $capacity.id } + 'ResourceGroupName' { $clauseValues -contains $capacity.resourceGroup } + 'ResourceType' { $clauseValues -contains $capacityType } + default { $false } + } } if (-not $clauseMatch) { $allClausesMatch = $false; break } }