Cookies on ScriptPreflight

We use strictly necessary storage to sign you in, take payments and keep the site secure. With your permission we also count visits, without cookies, to see which pages help. We don't run marketing tags. Cookie policy

Use case · Azure

Know which subscription a script will change before it changes it.

Az PowerShell for resource groups, Key Vault and RBAC.

Run a free preflightSee a sample report

No card required. Your script is never executed.

Three patterns we flag

  • Deletes every resource group in the subscription

    Get-AzResourceGroup | Remove-AzResourceGroup -Force

  • Gives Owner at subscription scope

    New-AzRoleAssignment -RoleDefinitionName Owner -Scope "/subscriptions/$sub"

  • Opens Key Vault secrets to everyone in a group

    Set-AzKeyVaultAccessPolicy -VaultName $kv -ObjectId $group -PermissionsToSecrets all

Sample: restart-servers.ps1

Real pattern, synthetic script. Unfiltered tenant-wide target.

Try this sample in the free checker

What we check

  • Subscription and resource-group scope
  • RBAC role assignments
  • Key Vault access policies
  • -Force on destructive cmdlets

What we can't know

  • · How many objects match in your environment when it runs
  • · The current state of your environment
  • · Which permissions the account running it actually holds

The script is never run and we never connect to your environment, so every report states what it could not determine.

Check the next script before it runs.

Run a free preflightSee a sample report