feat: msft-win-azure-migration-discovery

[AlrightLad]

feat: msft-win-azure-migration-discovery

Standardized read-only discovery script for Azure/Entra migration SOW scoping. Companion SOP: KB 3893 (Azure Migration Discovery & SOW Development SOP), which owns the workflow: AM request → run this per server → decision tree (cloud-native / IaaS-AVD / hybrid / stay-on-prem) → SOW → AM deliverable.

What it does

• Detects run context (Physical / Hyper-V Host / Hyper-V Guest / RDS Session Host / DC) and gathers context-appropriate evidence; all sections degrade gracefully when a role/module is absent
• Identity: full AD state incl. krbtgt age, UPN/.local flags, GPO inventory, stale computers, Entra/M365 signals in AD (hybrid-join SCP, AZUREADSSOACC$, MSOL_ accounts)
• Workloads: RDS deployment + CALs + live sessions, SQL instances + DB footprint, ODBC DSNs, apps, service accounts, shares (size/recency/ACLs), print, DHCP/DNS, IIS bindings, Hyper-V host audit (VHDX actual sizes, checkpoints, SET/LBFO, VMQ)
• Dependencies both directions: listening ports→process, established outbound→process, live SMB/RDP consumers, GPP drive maps, logon scripts, hosts file
• Blockers/cost inputs: NTLM auth audit (4624), SMB1/LmCompatibilityLevel posture, firmware/boot style (Azure Gen1/Gen2), Windows activation channel (AHB eligibility), backup posture, existing Azure/hybrid agents (Arc, MARS, AVD, File Sync, App Proxy, ASR, FSLogix, Cloud Sync, Printix)

Conventions

• Non-interactive, no Read-Host; NinjaOne variables read via $env: with defaults (scanShareSizes, includeDhcpLeases, maxDnsRecords, ntlmAuditDays, saveReportToDisk)
• 64-bit self-relaunch from NinjaOne's 32-bit default; SYSTEM context
• Sectioned stdout to activity feed (Server Lifecycle audit pattern) + optional full report/transcript with rotation in C:\ProgramData\DTC\AzureMigrationDiscovery
• Read-only — makes no changes

Validation

• PSScriptAnalyzer 1.25.0: clean
• Field-tested via NinjaOne: <fill in which box(es)/context(s) you ran>
• No Pester tests included — repo currently has zero *.Tests.ps1; matched the demonstrated bar rather than introducing a test convention inside a feature PR. Happy to add if we want that as a repo standard.

Notes for review

• Base is main — origin/development was pruned, so this differs from my earlier PRs (refactor: consolidate power-management + shutdown lockdown into msft-win-uptime-lockdown.ps1 #88/feature: NinjaRMM runaway script-log purge tool #102) that targeted development
• Possible thematic adjacency with enhancement/net-assessment-collector and feature/bdr-discovery-needs-backup-detect: this script is migration-scoping (KB 3893 decision tree), not sales assessment or backup detection; flagging so it's a conscious call

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, push a new commit or reopen this pull request to trigger a review.