Defender for Cloud
- Which Defender plans are switched on
- Security contacts and alert notifications
- Automatic agent and vulnerability assessment settings
Free Azure security assessment
Know exactly where your Azure setup is exposed.
A storage account open to the internet or a database firewall that lets in everyone can sit unnoticed for years. We review your Azure subscriptions against recognised benchmarks and show you, in plain language, what to tighten first.
What we check
Hundreds of automated checks, grouped into six areas
Every check looks at how things are configured, never at your data. Here's what each area covers.
Storage
- Public access to blob containers
- Secure transfer and minimum TLS version
- Soft delete and key rotation
- Network restrictions on storage accounts
Networking
- Network security groups open to the internet on RDP, SSH and database ports
- Network Watcher and flow logs
- Public IPs on resources that shouldn't have them
Databases
- SQL auditing and threat detection
- Encryption at rest
- Firewall rules that allow all of Azure or the internet
- Entra ID administrators on SQL servers
Key Vault and App Service
- Key Vault purge protection and access model
- Expiry dates on keys and secrets
- Web apps enforcing HTTPS and modern TLS
- FTP disabled and managed identities in use
Identity, logging and VMs
- Global administrators and guest settings in Entra ID
- Activity log retention and diagnostic settings
- Alerts on policy and security changes
- VM disk encryption and endpoint protection
Cost check
Also included: what you're paying for but not using
A VM that was shut down from inside Windows or Linux, rather than stopped in Azure, is still billed at its full hourly rate. Using the same read-only access, we list everything that's off or idle but still charging you, with an estimated monthly cost for each.
- VMs shut down but not deallocated, still billed in full
- Disks of turned-off VMs, which keep charging
- Disks attached to nothing
- Public IP addresses reserved but unused
- App Service plans with no apps on them
- Snapshots older than six months, plus Azure Advisor's own savings tips
Standards
Mapped to the frameworks auditors use
The report shows how many checks pass for each framework. It's a readiness view, not a certification or a full audit.
- CIS Microsoft Azure Foundations Benchmark
- ISO 27001
- SOC 2
- PCI DSS
- MITRE ATT&CK
Read-only
What read-only means here
You stay in control of access the whole time, and you can remove it whenever you like.
What we can see
- How your subscriptions and resources are configured
- Security, logging and Defender for Cloud settings
- Network rules and public exposure
- Key Entra ID settings such as admin roles and guest access
What we never do
- Read data in storage, databases or Key Vault
- List storage keys or app secrets
- Change, start, stop or delete anything
- Receive any password of yours
How access works
We email your administrator a short access pack with step-by-step instructions.
They run one script on a Windows PC and choose which subscriptions we may see. It grants the built-in Reader role plus three read-only directory permissions.
The script shows a short-lived secret once. Your administrator shares it with us by phone or a one-time secure link, and it expires within 14 days.
Your administrator removes all access with one command once the report is delivered.
What you receive
A report you can act on
A graded report
An A to F grade for each area, written for the person who signs the cheques, with the technical detail attached for whoever runs IT.
Fix these first
The ten findings that matter most, each explained in plain language: what it is, why it matters, and how to fix it.
Compliance snapshot
How your settings line up against each framework we check, so you know where you stand before an audit or insurance renewal.
A 30-minute walkthrough
We go through the report with you on a call and answer questions. Any fixes are quoted at a fixed price, only if you want them.
Questions
Common questions
Is it really read-only?
Yes. The access we ask for can only read settings. It can't change anything, and it's limited to configuration, not your data. The section above lists exactly what we can and can't see.
Will it affect our workloads or costs?
No. We only read configuration through Azure's standard management APIs. Nothing is installed, and reads like these don't add noticeable cost.
Who needs to run the setup?
Someone who is a Global Administrator and an Owner of the subscriptions to be reviewed. It takes about five minutes.
Can we limit it to some subscriptions?
Yes. The setup script asks which subscriptions to include, and we only see those.
We also use Microsoft 365. Can you check both?
Yes. The same setup can cover both, and you get one combined report.
What does it cost?
The assessment is free. If you'd like help fixing what we find, each fix is quoted at a fixed price before any work starts, and you're never obliged to go ahead.
How long until we get the report?
Within two business days of your administrator finishing setup. We then book a 30-minute call to walk you through it.
Book your free Azure assessment
Tell us a little about your setup and we'll send everything your administrator needs.