Chapter 3 of 6
Confirm these prerequisites:
- The management group IDs in the estate scope record are the ones the governance team is accountable for.
- The operator has the Reader role at each of those management groups. Resource Graph returns only what the caller can read, so a missing assignment shows up as a smaller estate, not as an error.
- The platform baseline records the owner, cost, and environment tag keys used across the AI estate, and those exact keys go into
requiredTagKeys. - The approved regions match the processing-location decision recorded in the model governance and lifecycle control.
- The Azure CLI is installed and signed in, and the
resource-graphextension is available:az extension add --name resource-graph. - Python 3 is installed. The paired PowerShell and Bash entry points use the same local report helper.
- The workbook deployment operator has Workbook Contributor or Contributor on the approved workbook resource group.
- The operator has a path outside this repository for the report file, if one is kept.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Record | artifacts/estate-scope.json | The platform inventory owner and the estate report scripts |
| Runtime | artifacts/queries/foundry-accounts.kql | The estate report scripts and Azure Resource Graph Explorer |
| Runtime | artifacts/queries/service-health-retirements.kql | The estate report scripts and Azure Resource Graph Explorer |
| Runtime | artifacts/queries/advisor-retirement-findings.kql | The estate report scripts and Azure Resource Graph Explorer |
| Deployment | artifacts/infra/deploy-workbook.json | The workbook deployment operator and Azure portal deployment route |
| Deployment | artifacts/monitoring/estate-lifecycle-workbook.json | The shared Azure Workbook |
Resolve the scope values in the approved private configuration path, then run preflight in Implement › 1. Complete the estate scope record. It rejects every unresolved decision, checks that the owner and cost tag keys also appear in the required tag list, checks that every recorded exception has an owner and expiry, and confirms Resource Graph read access at each management group. When you pass the workbook subscription and resource group, preflight also runs a resource-group what-if. It must contain only the tagged Microsoft.Insights/workbooks resource.