Libre DevOps Helpers

ldo: importable Python helpers and a fast CLI for day-to-day DevOps and security work.

ldo is a fast, read-only command line for day-to-day security and platform work across Microsoft (Entra ID, Defender XDR, Intune, Azure, Graph, PIM, Logic Apps) and ServiceNow. It signs in as you, through the Azure CLI by default, and can read only what you can. The Python sibling of the LibreDevOpsHelpers PowerShell module, and importable as a library too.

Commands

Every command takes -p for a profile and -o table|json|csv|tsv, lists take --sort and --unique by column, and lists of names come from arguments, stdin, a text file, or a column of a CSV or Excel workbook.

Install

From PyPI:

uv tool install libre-devops-helpers     # the ldo command, in an environment of its own
pipx install libre-devops-helpers        # the same, with pipx
uv pip install libre-devops-helpers      # into the current environment, to use it as a library
pip install libre-devops-helpers         # the same, with pip
uv tool upgrade libre-devops-helpers     # later, to the newest release

Add the keychain extra ("libre-devops-helpers[keychain]") to keep sign-ins in the macOS Keychain or the Linux Secret Service. A tagged release installs straight from GitHub too: uv tool install git+https://github.com/libre-devops/python-helpers@v0.6.1.

Or run the container image, which has the Azure CLI inside: podman run --rm -it ghcr.io/libre-devops/python-helpers:latest --help (see Container images). Each release is also in the GitLab copy's package and container registries (how).

Quickstart

Sign in with the Azure CLI, and ldo works as you at once, in the tenant and subscription az is using. Nothing else is needed.

az login
ldo az whoami                                   # who ldo reads as, and where
ldo devices check web01,web02                   # in Entra and onboarded to Defender?
ldo xdr alerts --since 24h --severity high

A profile for each tenant or subscription you work in is optional: ldo config init, then see Configuration.

Checking a change from its plan

Give it the plan: the workbook, the sheet, the column of names, and which rows to take. Here, the servers changing today, which should end up in two Entra groups:

ldo devices check -f plan.xlsx --sheet "Ring 1" --column FQDN --where "Scheduled Date=today" \
  --group "Linux servers" --group "Linux pilot"
ldo devices watch -f plan.xlsx --sheet "Ring 1" --column FQDN --where "Scheduled Date=today" \
  --group "Linux servers" --group "Linux pilot" --interval 5m --timeout 4h

check looks once; watch looks again every --interval until every server meets every expectation, and exits 0 then, or 3 when --timeout comes first. Each row says how many checks the server meets (MET): --sort met:desc puts the complete ones first. --where takes a day (25/09/2026, tomorrow) or a span (last 7d, 2026-09-01..2026-09-14); see lists of names and check and watch.

More:

ldo devices av-signature -f plan.xlsx --column FQDN   # Defender Antivirus versions
ldo entra devices -f plan.xlsx --column FQDN --group "Linux pilot"
ldo azure automation logs aa-ops --runbook Rotate-Keys    # the newest run's logs
ldo azure resource-graph "resources | summarize count() by type"
ldo keyvault expiry kv-app-prd --within 30d

Incidents, Graph hunting and PIM for Entra roles need scopes the Azure CLI's token never has: sign in through your own app registration for those. Permissions lists what each command needs.

Documentation

• Configuration: profiles, common options, environment variables, exit codes
• Proxies and certificates: corporate proxies, cntlm, TLS inspection
• Signing in and Permissions
• Container images
• Using it as a library and Rebranding for your organisation
• Development: just recipes, tests, CI and releasing
• AI.md: the instructions for AI coding assistants (Claude Code, Copilot, Codex, Kiro)

Contributions are welcome: see CONTRIBUTING.md, and SECURITY.md to report a vulnerability. Licensed under MIT.