Azure Public Exposure Scanner

Overview

FlowLibs - Azure Public Exposure Scanner (CF-522) is a scheduled cloud flow that uses Azure Resource Manager (ARM) to continuously detect internet-facing misconfigurations across an Azure subscription. Each morning it enumerates Network Security Groups, Public IP Addresses, and Storage Accounts, flags resources exposed to the public internet (NSG rules open to 0.0.0.0/0 on sensitive ports, public IPs, storage accounts allowing public blob access), scores the risk, logs every finding to a Dataverse table, and posts the high-risk exposures to a security Microsoft Teams channel.

Why it matters: Accidental public exposure is a top breach cause. A scheduled owned scan surfaces risky configurations quickly — before an attacker finds them — without waiting for an audit cycle.

> Built API-first as a Dataverse workflow record. Ships Off. Going live requires only: authorize the Dataverse + Teams connections, set the five new environment variable values (and confirm the reused ARM service-principal env vars), and turn the flow on.

Use Case

A security / platform team wants continuous detection of internet-facing misconfigurations across the Azure estate, prioritized by a risk score, surfaced into the channels they already watch (a Dataverse findings log for trend analysis and a Teams channel for immediate triage).

Flow Architecture

Environment Variables

Connectors & Connections

Connector	API name	Actions used
Microsoft Dataverse	shared_commondataserviceforapps	CreateRecord
Microsoft Teams	shared_teams	PostMessageToConversation

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Auto-remediate

Add an Approval before tightening an offending NSG rule to a known CIDR via an ARM PUT.

Allowlist

Exclude intentionally-public resources by checking a resource tag in each loop.

Defender for Cloud

Cross-reference secure-score recommendations via ARM for richer findings.

Cadence / threshold

Change the Recurrence schedule and flowlibs_RiskAlertThreshold without touching flow logic.

More resource types

Add ARM list calls (App Services, SQL servers, Cosmos public endpoints) following the same loop pattern.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

@and(equals(toLower(rule.access),'allow'), equals(toLower(rule.direction),'inbound'), or(source='0.0.0.0/0', source='*', source='Internet'))

@if(contains(split(variables('varSensitivePorts'),','), outputs('Compose_NSG_Port')), 90, 55)

@if(greaterOrEquals(score,80),'High',if(greaterOrEquals(score,50),'Medium','Low'))

@concat(parameters('EnvVar_ArmBaseUrl'),'/subscriptions/',parameters('EnvVar_AzureSubscriptionId'))

@concat(parameters('EnvVar_ArmBaseUrl'),'/')

@greaterOrEquals(score, variables('varRiskThreshold'))

Customize & download