Collection Phases
Data collection executes in four sequential phases. Phase order is fixed. Management group structure must be resolved before subscriptions can be enumerated, and subscriptions must be enumerated before per-subscription calls can execute in parallel.
| Phase | Name | Execution | Estimated API calls |
|---|---|---|---|
| 1 | Tenant Structure | Sequential | 5–20 |
| 2 | Resource Graph (B1 Items) | Batched | 10–20 batches |
| 3 | REST API (B2 Foundation + Sentinel) | Async parallel | 100–350 |
| 4 | Microsoft Graph (Entra ID) | Sequential | 4–6 |
Phase 1 — Tenant Structure
Establishes the complete tenant scope for all subsequent phases. Must complete before any other phase begins.
GET /providers/Microsoft.Management/managementGroups
GET /providers/Microsoft.Management/managementGroups/{id}/descendants [per MG]
GET /subscriptions
GET /subscriptions/{id}/locations [per subscription]
GET /subscriptions/{id}/resourceGroups [per subscription]
GET /subscriptions/{id}/tagNames [per subscription]
Phase 2 — Resource Graph Queries (B1 Items)
Executes all graph queries extracted from the CYC checklist inventory. Each query returns a list of Azure resource IDs with a compliant boolean per resource. Results are aggregated to item-level compliance status.
| Checklist | B1 items | Highest graph coverage | Primary resource types |
|---|---|---|---|
| Azure Landing Zone (ALZ) | 49 | Network — 34% | VNet, Firewall, ExpressRoute, NSG |
| AKS | 23 | Network — 37% | Managed clusters, node pools |
| App Delivery Networking | 10 | Network — 25% | App Gateway, Front Door, Load Balancer |
| SAP | 20 | Mgmt Groups — 62% | VMs, storage accounts, availability zones |
| AVD / Cost / Multitenancy | 0 | — | All items are B2 or B3 |
Item-level aggregation rules:
| Condition | item_status |
|---|---|
| All resources compliant | compliant |
| One or more non-compliant | non_compliant |
| No resources returned | not_applicable |
| Query execution error | error — logged to collection_errors |
Phase 3 — REST API Collection (B2 Foundation)
Collects structured environment data required by the Assessment Engine to evaluate B2 checklist items. Calls execute asynchronously per subscription using Python asyncio.
Core REST API Domains
| Domain | API calls | Scope |
|---|---|---|
| Policy assignments | policyAssignments, policyDefinitions | Per subscription + MG |
| RBAC | roleAssignments, roleDefinitions | Per subscription |
| Management groups | managementGroups, descendants | Tenant root |
| Subscriptions | subscriptions, locations, resourceGroups, tagNames | Per subscription |
| Defender for Cloud | secureScores, assessments, pricings, autoProvisioningSettings | Per subscription |
| Monitoring / Insights | diagnosticSettings, activityLogAlerts, scheduledQueryRules | Per subscription |
| Log Analytics | workspaces | Per subscription |
| Cost Management | CostManagement/query, budgets, reservationRecommendations | Per subscription |
Conditional Sentinel Block
If the client indicated Microsoft Sentinel is deployed in the intake questionnaire and the Sentinel Reader role was granted during OAuth consent, a conditional block executes after core REST API calls.
Detection step — always executed:
GET /subscriptions/{id}/providers/Microsoft.OperationsManagement/solutions
If Sentinel confirmed deployed:
GET /subscriptions/{id}/providers/Microsoft.SecurityInsights/alertRules
GET /subscriptions/{id}/providers/Microsoft.SecurityInsights/dataConnectors
GET /subscriptions/{id}/providers/Microsoft.SecurityInsights/automationRules
GET /subscriptions/{id}/providers/Microsoft.SecurityInsights/incidents?$filter=status eq 'Active'&$top=100
The incidents call retrieves a count and severity distribution of open incidents only. Incident titles, descriptions, entities, and alert details are not collected. CYC assesses whether Sentinel is operationally active — not the content of client security events.
Phase 4 — Microsoft Graph (Entra ID)
Collects identity and access configuration using the Graph API endpoint. Required for evaluating ALZ Identity and Access Management checklist items.
GET /v1.0/identity/conditionalAccess/policies
GET /v1.0/directoryRoles
GET /v1.0/policies/authorizationPolicy
GET /v1.0/subscribedSkus