Azure PowerShell Script - Audit Recovery Plans for Missing Protected Items

Azure doesn't have a great way at the moment to report on items in a Recovery Vault that are Replicated Items but not yet assigned to a Recovery Plan. That's what this script does - list out all items in a vault and what plan (if there is one) that they're assigned to.

This is a bit complicated because the GUIDs assigned to the protected item aren't necessarily the same as what was assigned as the "group protected item" ID.

In this scenarios, we'll

Part 1

1. Collect the vault, on-prem config server, and query the service fabric.
2. Get all of the protected servers
3. Get the recovery plans in the vault 

Part 2

1. Loop through the plans, getting the groups
2. Loop through the groups in the plan, dumping a complete list of protected items in the plan 
3. Add all protected items in the plan to an array with the recovery plan and group name

Part 3

1. Add protected items to the array that weren't found in a recovery plan. Leaving the plan and group blank

######################################################

Connect-AzAccount
$ResourceGroup = "RGNAME"
$VaultName = "VAULTNAME"
$configServer = "CONFIGSERVERNAME"

# Get the ASR vault
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $ResourceGroup -Name $VaultName

# Set the context of the vault. This is required for all future commands
Set-AzRecoveryServicesAsrVaultContext -Vault $vault

# Fabric is essentially a configuration server
# FriendlyName is the name of the config server. You can just run Get-AzRecoveryServicesAsrFabric to list all the config servers to get the right name
$asrfabric = Get-AzRecoveryServicesAsrFabric -FriendlyName $configServer

# Get the fabric container. It holds the replication policies and type of replication
$asrcontainer = Get-AzRecoveryServicesAsrProtectionContainer -Fabric $asrfabric

# List all the items that are in a protected state by friendly name and resource ID
$ProtectedVMs = Get-AzRecoveryServicesAsrProtectableItem -ProtectionContainer $asrcontainer | ? { $_.ProtectionStatus -eq 'Protected' } | Select FriendlyName,ReplicationProtectedItemId | sort FriendlyName

# List all recovery plans
$RecoveryPlans = Get-AzRecoveryServicesAsrRecoveryPlan | select -expand name

# Array to house the protected items missing recovery plans
$missingRP = New-Object Collections.ArrayList

# Array to house the protected items missing recovery plans
$ObjectArray = New-Object System.Collections.Generic.List[System.Object]

foreach($recoveryplan in $recoveryplans)
{
    $plandetails = Get-AzRecoveryServicesAsrRecoveryPlan -Name $recoveryplan

    # This will list out the replicated items that are in the recovery plan by resource ID. This may need to be broken out into multiple foreach loops b/c I only tested with a single VM in the recovery plan.
    foreach($group in $plandetails.Groups)
    {
        foreach ($groupprotecteditem in $group.ReplicationProtectedItems)
        {
            $VMmatch = Get-AzRecoveryServicesAsrProtectableItem -ProtectionContainer $asrcontainer | where { $_.ProtectionStatus -eq 'Protected' -and $_.ReplicationProtectedItemId -eq $groupprotecteditem.id} | Select -expand FriendlyName           
            $tempArray = New-Object System.Object
            $tempArray | Add-Member -MemberType NoteProperty -Name "VMName" -Value $VMmatch
            $tempArray | Add-Member -MemberType NoteProperty -Name "RecoveryPlan" -Value $recoveryplan
            $tempArray | Add-Member -MemberType NoteProperty -Name "Group" -Value $group.name
            $tempArray | Add-Member -MemberType NoteProperty -Name "ProtectedItem" -Value $groupprotecteditem
            $tempArray | Add-Member -MemberType NoteProperty -Name "ID" -Value $groupprotecteditem.id
            $ObjectArray.add($tempArray)
        }
    }    
}

foreach($vm in $ProtectedVMs)
{
    $status = $ObjectArray.VMname.contains($vm.FriendlyName)
    if($status -eq $false)
    {
        $tempArray = New-Object System.Object
        $tempArray | Add-Member -MemberType NoteProperty -Name "VMName" -Value $vm.FriendlyName
        $ObjectArray.add($tempArray)
    }
}

$ObjectArray | Out-GridView



######################################################