01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
az account list
--query '[*].id'
02 The command output should return the requested subscription identifiers (IDs):
[
"abcdabcd-1234-abcd-1234-abcdabcdabcd",
"abcd1234-abcd-1234-abcd-abcd1234abcd"
]
03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
az account set
--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
04 Run aks list command (Windows/macOS/Linux) with custom query filters to list the name and the associated resource group for each Azure Kubernetes Service (AKS) cluster available in the selected Azure subscription:
az aks list
--output table
--query '[*].{name:name, resourceGroup:resourceGroup}'
05 The command output should return the requested AKS cluster names:
Name ResourceGroup
---------------------- ------------------------------
cc-project5-aks-cluster cloud-shell-storage-westeurope
cc-data-mining-cluster cloud-shell-storage-westeurope
06 Run aks show command (Windows/macOS/Linux) with the name of the AKS cluster that you want to examine (and the associated resource group) as identifier parameters, to determine if the Azure CNI plugin is installed on the selected AKS cluster:
az aks show
--name cc-project5-aks-cluster
--resource-group cloud-shell-storage-westeurope
--query 'networkProfile.networkPlugin'
07 The command output should return the name of the networking plugin used by the selected cluster. If the aks show command output returns "kubenet", the Audit process ends here. If the command output returns "azure", the Azure CNI plugin is installed on the selected cluster and you can continue the Audit process with the next step:
08 Run aks show command (Windows/macOS/Linux) to determine the network policy enforced by the Container Networking Interface (CNI) plugin for the selected AKS cluster:
az aks show
--name cc-project5-aks-cluster
--resource-group cloud-shell-storage-westeurope
--query 'networkProfile.networkPolicy'
09 The command output should return the name of the network policy used by the CNI plugin. If the aks show command output returns "none", the CNI plugin configured for the selected AKS cluster is not configured to enforce network policies, therefore, the Audit process ends here. If the command output returns "azure", "calico", or "cilium", you can continue the Audit process with the next step:
10 Run aks get-upgrades command (Windows/macOS/Linux) to describe the version of the Kubernetes software installed on the selected AKS cluster and the latest stable Kubernetes version(s) available for upgrade:
az aks get-upgrades
--name cc-project5-aks-cluster
--resource-group cloud-shell-storage-westeurope
--output table
11 The command output should return a table with the requested Kubernetes details:
Name ResourceGroup MasterVersion Upgrades
------- ------------------------------ --------------- --------------------------------------
default cloud-shell-storage-westeurope 1.30.9 1.31.1, 1.31.2, 1.31.3, 1.31.4, 1.31.5
The version(s) listed in the
Upgrades column represents the latest available version of Kubernetes software that can be installed on the selected AKS cluster. If the version listed for the
MasterVersion and/or
NodePoolVersion is different than the newest one available in the
Upgrades column, the selected Azure Kubernetes Service (AKS) cluster is not using the latest available version of Kubernetes. As a result, the CNI plugin installed on this cluster is outdated.
12 Repeat steps no. 6 - 11 for each AKS cluster available within the selected Azure subscription.
13 Repeat steps no. 3 – 12 for each subscription created in your Microsoft Azure cloud account.
Security 
Operational