Cloud & cloud-security engineer near Zurich. I work across Azure platform engineering and cloud security, with a focus on Microsoft Entra ID, RBAC and infrastructure-as-code. Some of the tools below run tedious Azure work unattended, the others audit what a tenant actually allows. All of them are tested against live tenants before they're written up at simonvedder.com, and each one with a page there comes with deploy steps and a command reference.
| Tool | Kind | What it does | Ships as |
|---|---|---|---|
| Least Privilege Studio | Web app | Pick the actions you need for Azure RBAC or Entra ID and get the narrowest roles that cover them — or just paste in your Terraform. | Browser |
| RiskyRolesAnalyzer | Audit | One script, one HTML report: every privileged Azure RBAC and Entra role assignment, including the ones behind groups, custom roles and dormant apps | PowerShell · page |
| AppLifecycleAnalyzer | Audit | One script, one HTML report: every Entra ID app registration with its credentials, their expiry dates and when the app was last used | PowerShell · page |
| AzureInPlaceUpgrade | Automation | Name a VM and a target, and it goes from Windows Server 2016, 2019 or 2022 to 2025 in place — nobody logs on | Module + Bicep (preview) · page · Gallery |
| AzureVMCredentialRotation | Automation | Rotates local admin passwords and SSH keys on the Azure VMs that Windows LAPS and Entra login cannot reach | PowerShell · page · Gallery |
| VM Power Management | Automation | Start and stop VMs on a schedule without keeping a list of machines — the tag names the schedule | Runbook (preview) · page · Gallery |
| Deallocate on Activity Log | Automation | A guest shutdown stops the OS and keeps billing the VM — an activity-log alert and a Logic App deallocate it within minutes | Logic App · page |
| NSG Gap Finder | Audit | Azure VMs whose NIC or subnet has no network security group attached | PowerShell |
| VM OS Audit | Audit | The operating systems actually running, including the forgotten ones | PowerShell |
| Golden Image Builder | Blueprint | Gallery, image definitions, build templates and the monthly schedule | Bicep |
| Self-Service VM Ordering | Blueprint | A web form, a Logic App and a queue instead of portal access — VMs and AVD session hosts | ARM |
Claude Code skills in skills: azure-cost · azure-rbac-advisor · azure-updates
Collections: powershell · terraform-azure · bicep · arm · kql
- AzureVMPowerManagement 0.1.6-preview · azure-vm-power-management · 2026-09-15
- AzureVMCredentialRotation 0.4.1 · azure-vm-credential-rotation · 2026-09-08
- AzureInPlaceUpgrade 0.3.1-preview · azure-vm-inplace-upgrade · 2026-09-07
- RiskyRolesAnalyzer 0.1.0-preview · risky-roles-analyzer · 2026-09-07
- least-privilege-studio v2.0.0 · least-privilege-studio · 2026-05-20
- maester365/maester #2214: feat(entra): add MT.1199 app registration credential expiry test · merged
- maester365/maester #2130: feat(entra): add MT.1198 app registration certificate lifetime test · merged
- Azure/Community-Policy #541: Add policies: Deploy the Microsoft Entra login extensions to Azure VMs · open
- Azure in-place upgrades don’t have to stay manual · 2026-09-10
- 169.254.169.254: The Cloud Metadata Endpoint · 2026-08-27
- There’s no built-in policy for Entra VM login · 2026-07-26
More at simonvedder.com · LinkedIn
The tools table, releases, upstream list and posts are regenerated every Monday by a workflow from the tools catalogue, GitHub and the blog.