Skip to main content

Review Checklists: Best-Practice Coverage

Overview​

Review Checklists in Spotto scan selected Azure subscriptions for best-practice coverage and surface the gaps that matter. They combine automated checks with effort estimates, business context, and manual verification so you can run consistent reviews across teams and environments.

How it works​

Spotto checks every item in the checklist against each selected subscription, then lets you confirm or override the result.

To run a review: 1. choose one of 18 checklists, such as WAF, Azure Landing Zone, Cost Optimization or AKS; 2. pick subscriptions, all from one cloud account; 3. select Scan All, which queues one scan per subscription. For each item in each subscription: if the item's service is not in the subscription, the result is Not Applicable (nothing to check). If the item has no automated check, it is Unverified and needs manual verification. Otherwise its Azure Resource Graph query runs: any non-compliant resource makes it Open and lists those resources; otherwise any compliant resource makes it Fulfilled; otherwise, or if the query failed, it is Unverified because no matching resources were found. Then you review: set any status (Open, Unverified, Fulfilled, Not required, Not Applicable) and add comments for the selected subscriptions; your status replaces the scan result and stays after later scans. Results across subscriptions: each item shows its worst status across the selected subscriptions, in the order Open, Unverified, Fulfilled, Not required, Not Applicable. From the results you can add items to the Kanban Board or export to CSV or Word.To run a review: 1. choose one of 18 checklists, such as WAF, Azure Landing Zone, Cost Optimization or AKS; 2. pick subscriptions, all from one cloud account; 3. select Scan All, which queues one scan per subscription. For each item in each subscription: if the item's service is not in the subscription, the result is Not Applicable (nothing to check). If the item has no automated check, it is Unverified and needs manual verification. Otherwise its Azure Resource Graph query runs: any non-compliant resource makes it Open and lists those resources; otherwise any compliant resource makes it Fulfilled; otherwise, or if the query failed, it is Unverified because no matching resources were found. Then you review: set any status (Open, Unverified, Fulfilled, Not required, Not Applicable) and add comments for the selected subscriptions; your status replaces the scan result and stays after later scans. Results across subscriptions: each item shows its worst status across the selected subscriptions, in the order Open, Unverified, Fulfilled, Not required, Not Applicable. From the results you can add items to the Kanban Board or export to CSV or Word.

Why use this? (Jobs, pains, gains)​

Jobs to be done​

  • When I need a WAF or landing-zone review, I want a repeatable checklist that shows coverage across subscriptions, so I can report on readiness and risk.
  • When I see an open item, I want to know the likely effort and why it matters, so I can prioritize work.
  • When checks cannot be automated, I want a place to document manual verification, so the review is still auditable.

Common pains​

  • Reviews get trapped in spreadsheets and never stay consistent across subscriptions.
  • Best-practice guidance is scattered across docs, and context is missing when you need it.
  • Manual checks are hard to track and easy to lose.

Turn the evidence into a decision​

After selecting a checklist, select the labelled briefcase Business Value button beside Notes. The brief combines live open/unverified, fulfilled, high-priority, and non-compliant results with a priority body of work.

Live results are not replaced by AI. Generate tailors only the narrative and saves it for that checklist and exact subscription scope, so another checklist retains its own brief. Clear removes only that checklist's saved narrative and immediately restores its standard Business Value content without deleting Customer Context or changing live results. Regenerate when evidence changes. Above 100 subscriptions, the curated live brief remains available without tailoring.

Current position and priority work​

Resolve high-severity open or unverified findings that affect foundational controls or multiple services. Classify the remaining items as remediation, accepted trade-off, or deferred work and sequence them against the delivery roadmap.

Business outcomes​

A review makes architecture trade-offs explicit before more workloads depend on them. WAF reviews test workload decisions across the five pillars, while Landing Zone reviews validate the identity, networking, policy, security, and operations foundation used by the wider estate.

Cost of delay​

Unreviewed foundations can lead to inconsistent controls, slower delivery, audit gaps, hidden resilience problems, and retrofit work that is more expensive and disruptive later. Not every failed item warrants remediation; some are legitimate, documented trade-offs.

Decision required​

Agree which findings will be remediated, accepted, or deferred, with an owner and target date for every priority group.

Validate with stakeholders​

When you can manage Company Notes, select any question in the portal to retain the answer in the relevant Customer Context note.

  • Which business outcome, audit, migration, or growth event prompted the review?
  • Which findings represent accepted design trade-offs or compensating controls?
  • Who can accept residual risk and fund the agreed improvements?

Key capabilities​

Where to find it​

In the Spotto Portal, open your company and navigate to Generate -> Generate -> Review Checklists.

Checklist catalog​

Besides WAF, Azure Landing Zone, Cost Optimization and AKS, the catalog includes API Management, Front Door, SQL, Azure Virtual Desktop, SAP, Azure Arc and other platform and workload checklists.

Track scan coverage​

The subscription scan status summary shows each subscription's scan status (such as Queued, Running, Completed, Failed or Not run) and when it last ran.

Review items​

Results are aggregated by checklist item. The overview charts show status by severity and services by Well-Architected pillar. The table can be searched, filtered by Category and Status, and sorted by fields like Pillar, Service, or Severity. The status filter also lists Error; current scans record a failed check as Unverified instead.

Effort and business context​

Each item can include an effort estimate (hours) and a short explanation of what drives that effort, plus a plain-language headline and summary for stakeholder reviews.

Manual verification and comments​

Items without an automated check say Manual verification required. Items whose check was written with AI say so, because AI can make mistakes. Update status and comments in the item's detail view. If the selected subscriptions have different values, saving overwrites them all. Comments support @mentions, which notify the people you mention.

Item details list compliant and non-compliant resources, with search and direct links to resource details, plus links to supporting documentation or training modules when available. Export the displayed items to CSV or to a branded Word report for audit trails, customer review, or follow-up work.

How it differs from cloud-native reviews​

Cloud-native assessments often live in separate portals or spreadsheets. Spotto keeps the review in one place and adds cross-subscription roll-ups, effort estimates with rationale, and manual verification and comments as first-class data.

Limitations (honest, boring, useful)​

  • Not real-time: results appear after a scan completes.
  • Single cloud account per scan: subscriptions must belong to the same cloud account to run a scan.

Troubleshooting​

Scan button is disabled​

What you're seeing: Scan All is disabled.

Likely causes:

  • No checklist selected.
  • No subscriptions selected.
  • Selected subscriptions belong to multiple cloud accounts.
  • Your role lacks scan permissions.

How to fix:

  1. Select a checklist from the catalog.
  2. Select subscriptions from a single cloud account.
  3. Ensure your assigned role includes review checklist scan permission.

No results yet​

What you're seeing: The page shows an empty state or pending scan banner.

Likely causes:

  • A scan has not been run yet.
  • The scan is still processing.

How to fix:

  1. Run Scan All and wait a few minutes.
  2. Check the subscription scan status summary to confirm progress.
  3. Refresh the page after the scan completes.

Manual verification required​

What you're seeing: A checklist item says manual verification is required.

Likely causes:

  • No automated check exists for that item.

How to fix:

  1. Verify the item manually.
  2. Update status and comments in the detail view.
Optimize Your Azure Environment

Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?

Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.

Book a Free Consultation