ADR-004: Replace AzQR and AzGovViz with Native REST API Calls
| Attribute | Value |
|---|---|
| Status | Accepted |
| Date | March 2026 |
Context
The initial product concept referenced using AzQR (Azure Quick Review) and AzGovViz (Azure Governance Visualizer) as data collection tools, as these were used in prior manual assessment work.
Decision
Do not depend on AzQR or AzGovViz. Implement all data collection as direct REST API and Resource Graph calls from the CYC backend.
Rationale
AzQR and AzGovViz are CLI tools designed to run inside or adjacent to a client environment. They work by making the same REST API calls and Resource Graph queries that CYC's Data Collector already makes. They do not have access to any special Microsoft APIs unavailable to CYC.
Using them as dependencies would:
- Require deploying code or binaries into or near the client environment — exposing methodology
- Create version management and compatibility risks
- Prevent the clean "runs entirely from CYC's backend" architecture that protects IP
- Produce formatted reports rather than the structured JSON that CYC's pipeline needs
The Data Collector's four-phase collection approach replicates all data these tools collect, directly from the same Azure APIs, without the dependency.
Consequences
- CYC is not dependent on the release cadence of either tool
- No external binaries in the CYC backend
- All data collection is auditable as standard Azure REST API calls
- IP protection is maintained — no tool code or configuration visible in client tenant