Microsoft Azure - Prerequisites

#!/usr/bin/env bash
# === nOps onboarding qualifier ===
# Groups subscriptions by billing account -> profile, classifies each account
# EA / MCA / Reseller / CSP, shows spend, gives an onboard verdict. Read-only.
# Best run as the customer's billing admin, in their tenant.
#
# Hardened: portable (no md5sum), honest failures (n/a vs 0.00), preflight
# checks, RBAC caveat, safe arg parsing, mixed-currency flagging.
set -u
CSV=""; SKIP_COST=0; WINDOW="MonthToDate"
while [ $# -gt 0 ]; do case "$1" in
 --csv) [ $# -ge 2 ] || { echo "--csv needs a FILE argument" >&2; exit 1; }; CSV="$2"; shift 2;;
 --last-month) WINDOW="TheLastMonth"; shift;;
 --skip-cost) SKIP_COST=1; shift;;
 -h|--help) echo "Usage: $0 [--csv FILE] [--last-month] [--skip-cost]"; exit 0;;
 *) echo "unknown option: $1" >&2; exit 1;; esac; done

command -v jq >/dev/null || { echo "jq not found — install jq and retry" >&2; exit 1; }
command -v az >/dev/null || { echo "az (Azure CLI) not found — install it and run 'az login'" >&2; exit 1; }
az account show >/dev/null 2>&1 || { echo "not logged in — run 'az login' first" >&2; exit 1; }

D=$(mktemp -d) || { echo "mktemp -d failed" >&2; exit 1; }; trap 'rm -rf "$D"' EXIT; : > "$D/rows"; mkdir -p "$D/pc"

echo "Signed in as : $(az account show --query user.name -o tsv 2>/dev/null)"
echo "Tenant       : $(az account show --query tenantId -o tsv 2>/dev/null)"
echo "Note         : costs need Cost Management Reader (or Reader) at subscription scope;"
echo "               subscriptions without it show 'n/a', not 0.00."
echo "Qualifying..."

# billing accounts the signed-in identity has a billing role on (visibility flag)
az rest --method get \
 --url "https://management.azure.com/providers/Microsoft.Billing/billingAccounts?api-version=2024-04-01" 2>/dev/null \
 | jq -r '.value[]?.name' > "$D/visible" || true

BODY="{\"type\":\"ActualCost\",\"timeframe\":\"$WINDOW\",\"dataset\":{\"granularity\":\"None\",\"aggregation\":{\"totalCost\":{\"name\":\"Cost\",\"function\":\"Sum\"}}}}"

az account list --all --query "[?state=='Enabled'].{i:id,n:name}" -o tsv | while IFS=$'\t' read -r SUBID SUBNM; do
 BP=$(az rest --method get \
  --url "https://management.azure.com/subscriptions/$SUBID/providers/Microsoft.Billing/billingProperty/default?api-version=2024-04-01" 2>/dev/null)
 AG=$(echo "$BP" | jq -r '.properties.billingAccountAgreementType // ""')
 BA=$(echo "$BP" | jq -r '.properties.billingAccountDisplayName // "NO BILLING ACCESS"')
 BAID=$(echo "$BP" | jq -r '.properties.billingAccountId // ""')
 PROFID=$(echo "$BP" | jq -r '.properties.billingProfileId // ""')
 PROFD=$(echo "$BP" | jq -r '.properties.billingProfileDisplayName // "-"')
 PROFNM=$(printf '%s' "$PROFID" | sed -n 's#.*/billingProfiles/\([^/]*\).*#\1#p'); [ -z "$PROFNM" ] && PROFNM="-"

 REL=""; IND=""
 if [ "$AG" = "MicrosoftCustomerAgreement" ] && [ -n "$PROFID" ]; then
  # portable per-profile cache key (no md5sum: missing on stock macOS)
  CK="$D/pc/$(printf '%s' "$PROFID" | tr -c 'A-Za-z0-9' '_')"
  [ -f "$CK" ] || az rest --method get --url "https://management.azure.com${PROFID}?api-version=2024-04-01" 2>/dev/null \
    | jq -r '[(.properties.billingRelationshipType // ""),(.properties.indirectRelationshipInfo.displayName // "")]|@tsv' > "$CK" 2>/dev/null
  [ -s "$CK" ] && IFS=$'\t' read -r REL IND < "$CK"
 fi

 case "$AG" in
  EnterpriseAgreement)            TYPE="EA"; VR="OK";;
  MicrosoftPartnerAgreement)      TYPE="CSP"; VR="NO";;
  MicrosoftCustomerAgreement)
    if [ -n "$IND" ] || { [ -n "$REL" ] && [ "$REL" != "Direct" ]; }; then TYPE="Reseller"; VR="CHK";
    elif [ "$REL" = "Direct" ]; then TYPE="MCA"; VR="OK";
    else TYPE="MCA"; VR="CHK"; fi;;   # REL unconfirmed: could be indirect/reseller -> review, not auto-pass
  MicrosoftOnlineServicesProgram) TYPE="PAYG"; VR="CHK";;
  "")                             TYPE="?"; VR="CHK";;
  *)                              TYPE="$AG"; VR="CHK";;
 esac
 [ "$AG" = "MicrosoftCustomerAgreement" ] && [ "$TYPE" = "MCA" ] && [ -z "$REL" ] && IND="(direct/reseller unconfirmed)"

 ACCTSEG=$(printf '%s' "$BAID" | sed -n 's#.*/billingAccounts/\([^/]*\).*#\1#p')
 VIS="vis"; [ -n "$ACCTSEG" ] && ! grep -qxF "$ACCTSEG" "$D/visible" 2>/dev/null && VIS="hidden"

 if [ "$SKIP_COST" = 0 ]; then
  Q=$(az rest --method post \
   --url "https://management.azure.com/subscriptions/$SUBID/providers/Microsoft.CostManagement/query?api-version=2025-03-01" \
   --headers "Content-Type=application/json" --body "$BODY" 2>/dev/null)
  # empty COST = "couldn't read cost" (no access / API error), distinct from a real 0.00
  if [ $? -ne 0 ] || [ -z "$Q" ] || printf '%s' "$Q" | jq -e '.error' >/dev/null 2>&1; then
   COST=""; CUR="n/a"
  else
   COST=$(echo "$Q" | jq -r '(.properties.columns//[]) as $c|([ $c|to_entries[]|select(.value.name=="Cost" or .value.name=="PreTaxCost")|.key ]|first // 0) as $i|(.properties.rows[0][$i] // 0)' 2>/dev/null)
   CUR=$(echo "$Q" | jq -r '(.properties.columns//[]) as $c|([ $c|to_entries[]|select(.value.name=="Currency")|.key ]|first) as $i|(if $i!=null then (.properties.rows[0][$i] // "-") else "-" end)' 2>/dev/null)
   [ -z "$COST" ] && { COST=""; CUR="n/a"; }
  fi
 else COST=""; CUR="-"; fi

 printf "%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n" \
  "$BA" "$BAID" "$TYPE" "$VR" "$PROFD" "$PROFNM" "$SUBNM" "$COST" "$CUR" "$IND" "$VIS" >> "$D/rows"
done

read -r OKA CHKA NOA <<<"$(awk -F'\t' '!s[$2]++{if($4=="OK")o++;else if($4=="NO")n++;else c++}END{print o+0,c+0,n+0}' "$D/rows")"
if [ "$OKA" -gt 0 ] && [ "$NOA" = 0 ] && [ "$CHKA" = 0 ]; then H="PASS — onboardable";
elif [ "$OKA" -gt 0 ]; then H="PARTIAL — some accounts onboardable, review the rest";
elif [ "$NOA" -gt 0 ] && [ "$OKA" = 0 ] && [ "$CHKA" = 0 ]; then H="FAIL — CSP/partner-billed, not supported";
else H="REVIEW — couldn't confirm billing control"; fi
echo; echo "VERDICT: $H"
echo " by billing account: OK $OKA onboardable   CHK $CHKA review   CSP/other $NOA unsupported"
echo

LC_ALL=C sort -t$'\t' -k2,2 -k6,6 -k8,8rn "$D/rows" | awk -F'\t' '
function cf(x, s,n,ip,d,sg,r,i,c){ s=sprintf("%.2f",x+0); n=index(s,"."); ip=substr(s,1,n-1); d=substr(s,n);
 if(substr(ip,1,1)=="-"){sg="-";ip=substr(ip,2)} r="";c=0; for(i=length(ip);i>=1;i--){r=substr(ip,i,1) r;c++; if(c%3==0&&i>1)r="," r} return sg r d }
function spend(seen,v,cur){ return (seen?cf(v):"n/a") (cur!=""?" " cur:"") }
BEGIN{ S="\001"; ca=S; cp=S }
{
 if($2!=ca){
  if(ca!=S){ printf "  profile spend: %s\n",spend(pseen,ps,pcur)
             printf " ACCOUNT SPEND: %s\n\n",spend(aseen,as,acur) }
  v=($4=="OK")?"✓ onboard":(($4=="NO")?"✗ not supported":"⚠ review")
  f=""; if($11=="hidden") f=f" (billing acct not visible to you)"
  if($3=="Reseller" && $10!="") f=f" via "$10
  if($3=="MCA" && $10!="") f=f" "$10
  idf=$2; sub(/^.*\/billingAccounts\//,"",idf); if(idf=="") idf="(no access)"
  printf "BILLING ACCOUNT: %s [%s] %s%s\n   id: %s\n",$1,$3,v,f,idf
  ca=$2; as=0; acur=""; aseen=0; cp=S
 }
 if($6!=cp){ if(cp!=S) printf "  profile spend: %s\n",spend(pseen,ps,pcur)
  printf " profile: %s\n",($6=="-"?$5:$6); cp=$6; ps=0; pcur=""; pseen=0 }
 printf "  %-40s %14s %s\n",substr($7,1,40),($8==""?"n/a":cf($8)),($8==""?"":($9=="-"?"":$9))
 if($8!=""){ ps+=$8; as+=$8; pseen=1; aseen=1;
  if($9!="-"&&$9!="n/a"){ if(pcur!=""&&pcur!=$9)pcur="MIXED"; else if(pcur!="MIXED")pcur=$9;
   if(acur!=""&&acur!=$9)acur="MIXED"; else if(acur!="MIXED")acur=$9 } }
}
END{ if(ca!=S){ printf "  profile spend: %s\n",spend(pseen,ps,pcur); printf " ACCOUNT SPEND: %s\n",spend(aseen,as,acur) } }'

if [ -n "$CSV" ]; then
 { echo "billing_account,billing_account_id,type,verdict,profile,profile_id,subscription,cost,currency,partner_or_note,visibility"
  LC_ALL=C sort "$D/rows" | awk -F'\t' 'BEGIN{OFS=","}{for(i=1;i<=NF;i++){gsub(/"/,"\"\"",$i); if($i~/[",]/)$i="\""$i"\""} print}'
 } > "$CSV"; echo; echo "CSV written to $CSV"
fi