Skip to main content

Assessment and Review

TL;DR​

The Azure Well-Architected Review process helps you evaluate workloads against best practices and prioritize improvements. Key components:

  • WAF Assessment Tool: Interactive questionnaire covering all pillars
  • Azure Advisor: Automated recommendations in the portal
  • Scoring: Quantify your alignment with best practices
  • Remediation Roadmap: Prioritized action plan
  • Continuous Improvement: Regular reassessment cycles

Assessment Overview​

Assessment Process​

Assessment Types​

TypeToolFrequencyScope
Self-AssessmentWAF Review ToolQuarterlySingle workload
AutomatedAzure AdvisorContinuousAll resources
Expert ReviewMicrosoft/PartnerAnnuallyEnterprise
SecurityDefender for CloudContinuousSecurity posture

Azure Well-Architected Review Tool​

Accessing the Tool​

The official assessment is available at Azure Well-Architected Review.

Assessment Structure​

Sample Assessment Questions​

Reliability Questions​

QuestionOptionsImpact
Do you have defined RTO/RPO?Yes/No/PartialHigh
Is your application deployed across availability zones?Yes/NoHigh
Do you have automated failover?Yes/No/ManualMedium
How often do you test disaster recovery?Never/Annually/QuarterlyHigh

Security Questions​

QuestionOptionsImpact
Is MFA enforced for all users?Yes/No/SomeCritical
Are secrets stored in Key Vault?Yes/No/SomeHigh
Do you use private endpoints?Yes/No/PartialHigh
Is data encrypted at rest?Yes/NoCritical

Cost Questions​

QuestionOptionsImpact
Do you use reserved instances?Yes/No/PartialHigh
Are resources tagged for cost allocation?Yes/No/PartialMedium
Do you have budget alerts?Yes/NoMedium
When did you last right-size resources?Never/6mo/MonthlyHigh

Azure Advisor​

Advisor Categories​

Accessing Advisor Recommendations​

# Get all recommendations
az advisor recommendation list --output table

# Get recommendations by category
az advisor recommendation list --category Cost --output table
az advisor recommendation list --category Security --output table
az advisor recommendation list --category Reliability --output table

# Get recommendation details
az advisor recommendation list \
    --query "[?category=='Cost'].{Name:shortDescription.problem, Impact:impact, Resource:resourceMetadata.resourceId}" \
    --output table

# Suppress a recommendation (if not applicable)
az advisor recommendation disable \
    --ids <recommendation-id> \
    --days 90

Advisor API Integration​

// C# - Fetch Advisor recommendations programmatically
using Azure.ResourceManager;
using Azure.ResourceManager.Advisor;

public async Task<List<AdvisorRecommendation>> GetRecommendationsAsync()
{
    var armClient = new ArmClient(new DefaultAzureCredential());
    var subscription = await armClient.GetDefaultSubscriptionAsync();
    
    var recommendations = new List<AdvisorRecommendation>();
    
    await foreach (var recommendation in subscription.GetAdvisorRecommendationsAsync())
    {
        recommendations.Add(new AdvisorRecommendation
        {
            Category = recommendation.Data.Category.ToString(),
            Impact = recommendation.Data.Impact.ToString(),
            Problem = recommendation.Data.ShortDescription.Problem,
            Solution = recommendation.Data.ShortDescription.Solution,
            ResourceId = recommendation.Data.ResourceMetadata.ResourceId
        });
    }
    
    return recommendations;
}

Scoring and Benchmarking​

Score Interpretation​

Score RangeStatusAction
0-40CriticalImmediate remediation required
41-60Needs ImprovementPrioritize key gaps
61-80GoodAddress optimization opportunities
81-90Very GoodFine-tune and maintain
91-100ExcellentContinue monitoring

Sample Scorecard​

Detailed Scorecard Template​

PillarScoreCritical IssuesHigh PriorityMedium Priority
Reliability75/100035
Security82/100124
Cost Optimization58/100053
Operational Excellence70/100046
Performance Efficiency85/100013
Overall74/10011521

Prioritization Framework​

Impact vs Effort Matrix​

QuadrantEffortImpactAction
Do FirstLowHighQuick wins - implement immediately
PlanHighHighStrategic investments - schedule carefully
ConsiderHighLowResource intensive - evaluate ROI
DeprioritizeLowLowLow value - defer or skip

Prioritization Criteria​

FactorWeightDescription
Risk Reduction30%How much does it reduce risk?
Business Impact25%Impact on business operations
Effort Required20%Time and resources needed
Dependencies15%Blockers or prerequisites
Cost Savings10%Potential cost reduction

Priority Scoring Example​

RecommendationRiskBusinessEffortDepsCostTotalPriority
Enable MFA30201815588P1
Add geo-redundancy25251010070P2
Right-size VMs51016151056P3
Update documentation551815043P4

Remediation Roadmap​

Roadmap Structure​

Roadmap Template​

PhaseTimelineFocus AreaKey Deliverables
Phase 1: CriticalWeeks 1-2Security, ReliabilityMFA, encryption, backups
Phase 2: FoundationWeeks 3-6Operations, SecurityMonitoring, IaC, RBAC
Phase 3: OptimizationWeeks 7-10Cost, PerformanceRight-sizing, caching
Phase 4: ExcellenceWeeks 11-12All pillarsAutomation, documentation

Action Item Template​

## Action Item: [Title]

**Pillar:** Reliability
**Priority:** P1 - Critical
**Owner:** Platform Team
**Due Date:** 2024-02-01

### Description
Brief description of what needs to be done.

### Current State
- No geo-redundancy configured
- Single region deployment
- Manual failover process

### Target State
- Active-passive geo-redundancy
- Automated failover with < 5 min RTO
- Regular DR testing

### Implementation Steps
1. [ ] Design geo-redundancy architecture
2. [ ] Configure database replication
3. [ ] Set up Traffic Manager
4. [ ] Implement health probes
5. [ ] Test failover procedure
6. [ ] Document runbook

### Success Criteria
- [ ] Failover completes in < 5 minutes
- [ ] Zero data loss (RPO = 0)
- [ ] Successful DR drill completed

### Resources Required
- 2 engineers, 3 weeks
- Additional Azure resources (~$500/month)

Continuous Improvement​

Improvement Cycle​

Assessment Cadence​

Assessment TypeFrequencyTrigger
Full WAF ReviewQuarterlyScheduled
Advisor ReviewWeeklyAutomated
Security ReviewMonthlyScheduled
Post-IncidentAs neededIncident
Pre-ReleasePer releaseDeployment
Annual Deep DiveAnnuallyScheduled

Progress Tracking​

// KQL - Track WAF score improvements over time
WafAssessments
| where TimeGenerated > ago(365d)
| summarize 
    ReliabilityScore = avg(ReliabilityScore),
    SecurityScore = avg(SecurityScore),
    CostScore = avg(CostScore),
    OpsScore = avg(OpsScore),
    PerfScore = avg(PerfScore)
    by bin(TimeGenerated, 30d)
| render timechart

Improvement Metrics​

MetricBaselineTargetCurrentStatus
Overall WAF Score658578On Track
Open Critical Issues501At Risk
Advisor Score70%95%88%On Track
MTTR4 hours1 hour1.5 hoursOn Track
Deployment FrequencyMonthlyWeeklyWeeklyComplete

Integration with Azure Services​

Defender for Cloud Secure Score​

Combining Assessment Sources​

SourcePillar CoverageAutomationDepth
WAF Review ToolAll 5 pillarsManualDeep
Azure AdvisorAll 5 pillarsAutomatedMedium
Defender for CloudSecurityAutomatedDeep
Cost ManagementCostAutomatedDeep
Service HealthReliabilityAutomatedMedium

Assessment Checklist​

Before Assessment​

  • Define workload scope and boundaries
  • Identify stakeholders and schedule time
  • Gather architecture documentation
  • Collect current metrics and SLAs
  • Review recent incidents

During Assessment​

  • Complete all pillar questionnaires
  • Document assumptions and context
  • Note areas of uncertainty
  • Capture additional observations
  • Identify quick wins

After Assessment​

  • Review and validate scores
  • Prioritize recommendations
  • Create remediation roadmap
  • Assign owners and deadlines
  • Schedule follow-up review

Assessment Questions Summary​

Key Questions by Pillar​

PillarTop Assessment Questions
ReliabilityRTO/RPO defined? Redundancy at each tier? DR tested?
SecurityMFA enforced? Data encrypted? Least privilege?
CostResources tagged? Reservations used? Right-sized?
OperationsIaC used? CI/CD automated? Monitoring complete?
PerformanceAuto-scaling configured? Caching implemented? Load tested?

Key Takeaways​

  1. Regular assessments: Conduct WAF reviews at least quarterly
  2. Use multiple sources: Combine manual and automated assessments
  3. Prioritize ruthlessly: Focus on high-impact, achievable improvements
  4. Track progress: Measure and report on improvement metrics
  5. Continuous improvement: Assessment is ongoing, not one-time

Resources​