How to Build an Azure Asset Inventory in 2 Hours

You can build an Azure asset inventory in two hours by exporting your Azure resources with Azure Resource Graph, assigning a named owner to every production system and data store, and saving the resulting spreadsheet as dated evidence. That is the practical baseline for ISO/IEC 27001:2022 Annex A control 5.9: an inventory of information and associated assets that is developed, maintained, and includes owners. This guide explains how to build an azure asset inventory in 2 hours without buying a new tool or hiring a security specialist.

What is the minimum viable definition of “compliant” for ISO 27001 control 5.9?

For an SMB, “compliant” does not mean creating a perfect configuration management database or documenting every temporary test resource on day one. For ISO 27001 control 5.9, your minimum viable outcome is a current, reviewable inventory that answers four questions:

• What assets do we have? Include Azure subscriptions, resource groups, virtual machines, app services, storage accounts, databases, key vaults, containers, and production backups.
• What information do they hold or process? Record a plain-English description such as “customer application data,” “production source code,” or “employee records.”
• Who owns each important asset? An owner is a named person accountable for business decisions about the asset, not just the person who can log into Azure.
• When was the inventory checked? Record the export date and commit to a review cadence.

The control requirement is straightforward: “An inventory of information and other associated assets, including owners, shall be developed and maintained.”[1] Your first inventory should therefore connect technical resources to accountable people. A CSV export with no owners is useful operationally, but it is not enough evidence on its own for this control.

Use one spreadsheet or Microsoft List with these fields. Do not wait for a dedicated governance platform.

Keep the inventory in a location your leadership team can access, such as a restricted SharePoint document library. Set edit access for the person maintaining it and read access for the owner or management team. Save the original Azure export alongside the cleaned inventory; this gives you a simple audit trail.

How to build an azure asset inventory in 2 hours: what happens in hours 0–4?

Hour 0–0:20: define the scope and choose one accountable inventory owner

Write down the Azure subscriptions in scope. For most small businesses, that means every active production, staging, development, and sandbox subscription under your tenant. If a former contractor’s subscription or a legacy pay-as-you-go account exists, include it rather than assuming it is irrelevant.

Choose one person to maintain the register. This can be the owner, operations manager, engineering lead, or external IT provider. They do not become responsible for every asset; they become responsible for making sure every asset has an identified owner and that the register is reviewed.

Set a practical boundary: include Azure resources that store, process, secure, transmit, or support company information. That includes Key Vault, because secrets are information assets; Log Analytics, because logs can contain customer or employee data; and backup vaults, because backups are often the only copy of critical data.

Hour 0:20–0:50: export the Azure resource list

In the Azure portal, open Resource Graph Explorer, select every relevant subscription, paste the query below, and run it. Download the results as CSV. This creates a reliable technical starting point far faster than clicking through individual resource groups.

Resources
| extend BusinessOwner = tostring(tags['Owner'])
| extend DataClassification = tostring(tags['DataClassification'])
| extend ServiceName = tostring(tags['Service'])
| project
    subscriptionId,
    resourceGroup,
    name,
    type,
    location,
    ServiceName,
    BusinessOwner,
    DataClassification,
    id
| order by subscriptionId asc, resourceGroup asc, type asc, name asc

If the result includes resources you do not recognize, leave them in the export. Unknown assets are exactly what the inventory exercise is intended to reveal. If a resource was deleted after the export, note that in the next review rather than rewriting history.

Hour 0:50–1:35: turn the export into an ownership register

Open the CSV in Excel or upload it to a Microsoft List. Filter first for high-impact resource types: Microsoft.Sql/servers/databases, Microsoft.Storage/storageAccounts, Microsoft.KeyVault/vaults, Microsoft.Web/sites, Microsoft.Compute/virtualMachines, Microsoft.ContainerService/managedClusters, and Microsoft.RecoveryServices/vaults.

For each production asset, add a business owner, technical custodian, and purpose. You can assign the same person to both fields when the business is small. What matters is that the named person understands the asset and can decide whether it should continue to exist, what information it may hold, and who should receive questions about it.

For example, Northstar Metrics is a 22-person SaaS company running its customer portal on Azure App Service, storing tenant data in Azure SQL, and keeping deployment secrets in Key Vault. Its engineering lead exports the resources, while the founder spends 20 minutes confirming that the Head of Product owns customer-data systems and the Finance Manager owns the Azure subscription used for billing exports. That short conversation resolves the ownership gap that a technical export cannot solve.

Hour 1:35–2:00: prioritize unknowns and save evidence

Do not try to investigate every unfamiliar resource immediately. Mark unclear rows as Owner pending and create a small follow-up list. Before you stop, make sure every production database, storage account, key vault, backup vault, and externally reachable application has a named owner or a documented pending decision.

Save three items: the raw Resource Graph CSV, the completed inventory, and a short note stating the subscriptions searched, date of export, and person who performed the review. This is sufficient evidence to show a sensible baseline during an ISO 27001 readiness review.

Hours 2–4: make the quick inventory easier to maintain

The title’s two-hour target gets you to a defensible baseline. If you have another two hours, add Owner, Service, and DataClassification tags to your most important resources. Tags make the next Azure inventory refresh much faster and expose unowned resources before they become a problem.

Start with resource groups if your team deploys related services together, then tag individual exceptions such as a shared Key Vault or central logging workspace. Use consistent values such as a person’s work email address for Owner; avoid values like “IT,” “DevOps,” or “the founders,” because they do not identify an accountable individual.

What should you do during days 1–7 after the initial inventory?

During the first week, convert the one-time spreadsheet into a lightweight operating process. Your goal is maintenance, because ISO 27001 control 5.9 requires the inventory to remain current.

1. Resolve pending owners. Ask whoever requested, pays for, or deploys an unknown resource to identify the business owner. If nobody can justify it, investigate whether it can be removed.
2. Add non-Azure information assets. Include Microsoft 365 tenant data, GitHub or Azure DevOps repositories, SaaS backups, domains, and critical third-party systems used to deliver your service.
3. Set a monthly calendar reminder. Re-run the Resource Graph query, compare new or deleted resources, and ask owners to confirm significant changes.
4. Add ownership to your change workflow. When someone creates a new production service, require an owner, purpose, and data classification before the work is marked complete.
5. Review access separately. Your inventory will identify assets; it does not prove that permissions are appropriate. Treat Azure RBAC review as related work, not a reason to delay the inventory.

At Northstar Metrics, the engineering lead adds the inventory update to the first Monday deployment review. New App Service plans and storage accounts must include tags in the infrastructure-as-code pull request. The founder receives a monthly list of assets missing an owner and resolves exceptions in under ten minutes.

What have you intentionally deferred, and why is that OK?

You have intentionally deferred automated discovery across every cloud and SaaS tool, formal configuration management, financial chargeback, detailed data-flow diagrams, and a comprehensive asset lifecycle process. Those are valuable mature practices, but none should prevent you from meeting the immediate intent of 5.9: knowing what matters, who owns it, and when the list was last checked.

You have also deferred classifying every low-risk Azure component individually. A network interface, public IP address, and diagnostic setting can remain linked to its parent service at first. Record them individually later if they are independently managed, internet-facing, costly, or security-sensitive.

The important distinction is between deferred and ignored. Keep a short backlog of exclusions, unowned resources, and systems outside Azure. That record demonstrates that you understand the gaps and have chosen a proportionate sequence for closing them.

When should you upgrade from a quick-start inventory to a mature process?

Upgrade when the manual process starts failing: your Azure estate changes weekly, multiple people deploy resources, owners regularly leave the company, you operate more than one cloud, or customers and auditors request repeatable evidence. At that point, use Azure Policy to require tags, deploy tag inheritance at resource-group level, schedule Resource Graph exports, and connect the results to a CMDB or ticketing workflow.

A mature Azure asset inventory also tracks lifecycle status, criticality, supplier dependencies, data retention, and relationships between applications, databases, identities, and backups. You may eventually automate alerts for resources without an Owner tag and require a review before deployment. But the two-hour Azure asset inventory is still the foundation: automation only works after you decide what an owner and an asset mean in your business.

[1] ISO/IEC 27001:2022, Annex A, control 5.9, Inventory of information and other associated assets.

Set a two-hour calendar block this week, export your Azure resources, and assign owners to your production assets before the list gets any harder to untangle.