Built for Microsoft Azure
NewSource code on GitHubConnect Azure read-only in about three minutes. Get a full inventory, architecture diagrams, attack paths, compliance mapping and cost savings in one place.
Follow every click in the Azure portal, then watch KloudRecon validate the connection and map your estate. Spoken guide with captions.
The Azure portal screens in this guide are simplified illustrations drawn by KloudSchool, not screenshots. Azure is a trademark of the Microsoft group of companies.
Six views from one read-only connection. Pick one, or let them play.
Attack path · Critical
Security, architecture and cost in one consistent, read-only view.
Real internet exposure from NSG and load balancer rules, attack paths to sensitive data, identity analysis and 280+ configuration checks.
Reference-quality diagrams with Microsoft's Azure architecture icons, generated from what is really deployed.
Actual and amortized cost, forecasts with confidence bands, anomalies with root cause, and rightsizing from real metrics.
Executive one-pagers, a full assessment as an editable Word document, compliance evidence packs and architecture documents. Every top finding comes with fix steps, an Azure Policy to keep it fixed and the Microsoft Learn page behind it. White-label for consultants, scheduled email delivery and evidence export per control.
Ask questions about your environment in plain language. Answers cite the resources and findings they are based on. Read-only by design.
75 capabilities in all, for your own Azure and for CSP and MSP partners.
280+
Our own Azure Baseline, mapped to MCSB, ISO 27001, NIST, PCI DSS, SOC 2, HIPAA.
Read-only, Reader role. No agents. Security overview
Actual and amortized cost, forecasts with confidence bands, anomalies with root cause, and rightsizing from real metrics.
Savings tracker
Realized savings
Azure is only part of the estate. Check Windows and Linux servers from the inside with a read-only script, see your Azure Arc-enabled servers from the outside, and read both next to your Azure subscriptions in one report.
One script, run by your administrator, reads the server from the inside: capacity, patches, 30 days of events and the roles it runs.
The same depth for Ubuntu, Debian, Red Hat, Rocky, AlmaLinux, SUSE and more, with a component card for every service it finds.
Servers in your datacenter, on VMware or Hyper-V, or in AWS and Google Cloud, seen through Azure Arc with the same read-only connection.
KloudRecon puts three views side by side: what the script finds inside each Windows and Linux server, what Azure Arc knows about its connection, agent, patches and protection, and the Azure around it all, from virtual machines and networks to security, cost and diagrams.
Sign in once with your Partner Center account. KloudRecon reads every customer, subscription and licence read-only, tells you why each bill went up or down, and turns it into statements at your prices. Buying through Pax8? Connect it too.
Every customer and subscription, 13 months of billing, and twelve reasons that add up exactly to each rise and fall.
Price books with tiers, fees, margin per customer, statements in the customer's currency, exports to QuickBooks, Xero, NetSuite and PSA tools.
Microsoft 365 renewal calendar, 7-day cancel windows with the hours left, and unused seats priced before they renew for a year.
GDAP relationships and end dates, Partner Earned Credit that stopped, and signs of crypto mining or fraud on a customer subscription.
Payments, ageing and overdue reminders, charges you never billed, late charges, and each Microsoft invoice checked against the data.
A full KloudRecon workspace per customer, and a portal where their people see "Your bill" at your prices, never your cost.
Today
What needs you, in money order
Cancel window closes in 19 hours
Fabrikam · 25 seats added by mistake
12 unused seats renew in 9 days
Woodgrove Bank · Microsoft 365 E3
Earned credit stopped 3 days ago
Contoso · Azure plan
Customer access ends in 6 days
Tailspin Toys · GDAP relationship
Why the bill went up
All customers · sampleFrom zero to a prioritized action plan without installing anything.
Read how every part worksCreate an app registration with the Reader role and paste three values. About three minutes, no agents.
KloudRecon reads inventory, relationships, RBAC, Defender, Advisor, Policy, metrics and cost data.
Fix the risks that matter first, cut waste, and share audit-ready reports with your team.
Consultants and MSPs, IT and cloud managers, security leads, and FinOps and finance teams.
Inventory across all subscriptions with change history
Attack paths and real internet exposure
Compliance mapping with evidence export
Architecture diagrams with Azure architecture icons
Cost forecast, anomalies and rightsizing
One prioritized backlog of risks and savings
Windows, Linux and Azure Arc server health in one place
Client-ready PDF reports in minutes
Every CSP customer's bill explained, priced and turned into statements
Start with a free 14-day trial. Upgrade when you are ready.
27 answers about access, data, features, partners and plans. New here? Read how KloudRecon works or the security overview.
It connects to Azure read-only and shows, in one place, what you have, how secure it is, what it costs, how reliable it is and what to fix first: inventory and changes, architecture diagrams, security findings and attack paths, compliance mapping, cost and savings, server health, recommendations, reports and an AI assistant. CSP and MSP partners also get the Partner Console for every customer's billing.
Connecting takes about three minutes. The first scan usually finishes within minutes, and you can follow it live. After that KloudRecon scans every day at the hour you choose, and you can press Scan now at any time.
No agents. You create one app registration in the Azure portal or Cloud Shell, and KloudRecon does the rest. Only the optional server health check uses a script, which your administrator runs and can read line by line.
We review every new organization to keep the platform safe for everyone. Most accounts are approved within one business day, and you get an email as soon as it happens.
Yes. View live demo on the home page opens a read-only tour of a sample company with made-up data. No sign-up needed.
Only the built-in Reader role on the subscriptions or management group you choose. Optional read-only Microsoft Graph permissions unlock Entra ID posture. We never need write permissions, and we warn you if we detect them.
No. Every connection is read-only. Fix steps, scripts and Azure Policy definitions are shown for your team to run when you decide to. Nothing is created, changed, stopped or deleted by KloudRecon.
No. Reader cannot read secrets, keys, app settings or data inside your services. KloudRecon collects metadata, configuration, metrics and cost only.
Only in Azure Key Vault, accessed with a managed identity. Our database stores the secret name, never the value, and the value is never shown again after you save it.
Every table that holds customer data is protected by row-level security in the database, so one organization can never read another's rows, even through a bug in a page. Inside a partner, staff access limits each account manager to their own customers.
The AI features are optional. When they are on, the model receives the summarized facts it needs, with names and IP addresses masked if you choose, and every number in its answer is checked against your data before you see it. AI text is always labelled, and the assistant can only read, never change.
Yes. KloudRecon's source code is on GitHub at github.com/chathu2017/KloudRecon under the PolyForm Noncommercial License 1.0.0, so your team can see how it is built before you connect anything. It is free for personal use, study, research and noncommercial organizations. Business use needs a KloudRecon plan or a commercial licence from KloudSchool.
From Microsoft's public guidance: the Microsoft cloud security benchmark, the Azure Well-Architected Framework and the Azure service security baselines. Every check cites the Microsoft Learn page it is based on and is tested with passing and failing examples before release. Reports also point to free tools from Microsoft and the open-source community for a second opinion.
No, and it does not certify you. KloudRecon is a technical assessment: it maps its checks to framework control IDs to help you prepare and to give your auditor evidence for the technical controls. Certification and audit opinions come from accredited auditors. KloudRecon is not affiliated with or endorsed by any standards body.
Yes. Servers connected with Azure Arc, in your datacenter, on VMware or Hyper-V, or in another cloud, are read with the same Reader role. For a deeper look, the read-only Windows and Linux health scripts check disks, patches, event logs, roles and databases from the inside.
Seven PDF reports (executive, full, security, compliance, FinOps, architecture, changes), an editable Word assessment report with a sign-off page, and a Word report per server. Add your own logo and colours, download them, or have them emailed on a schedule.
Yes. Alert rules for new critical risks, attack paths, risky changes, cost anomalies, budget forecasts, failed scans and expiring secrets can go to the in-app bell, email, Microsoft Teams, Slack or a signed webhook.
The Partner Console: every customer, subscription and licence from one Partner Center sign-in, 13 months of billing with the reason behind every rise and fall, price books, margin and monthly statements, renewals and 7-day cancel windows, unused seats, customer access (GDAP) health, earned credit and misuse watch, payments and billing leakage, budgets and alerts, and a full KloudRecon security workspace for each customer.
Sign in on the CSP & MSP tab with a Partner Center user who is an Admin agent or Billing admin, with multi-factor sign-in. Microsoft asks once for read-only access to Azure billing data. Optional read-only Microsoft Graph permissions add Microsoft 365 licence lines and GDAP relationships without uploading files.
No. Partner Center, Microsoft 365, Azure and Pax8 are read only. KloudRecon shows renewal dates, cancel windows with the hours left and unused seats, so you can make the change yourself in Partner Center before it is too late.
Never. Customers you invite see their own tenant and "Your bill" at the prices from your price book, plus the statements you finalized. Your cost, margin, earned credit and other customers stay in the Partner Console.
It makes one statement per customer per month at your prices, as PDF and Excel, and can email it to the customer's billing contacts. Your accounting system stays the place of record: export the month to QuickBooks, Xero, NetSuite, a PSA tool or CSV.
Yes. Connect Pax8 with a read-only API key pair from the Pax8 portal. Companies, licence subscriptions and invoices then flow into customers, renewals, statements and margin, next to what Partner Center provides.
Yes. Each customer can have its own statement currency, converted with a fixed rate you set or the European Central Bank reference rate of the month. The rate used is printed on the statement, and your customer's portal shows the bill in the same currency.
Yes, 14 days with the full product. No card is needed to start. The plan is confirmed when your account is approved.
Nothing is deleted. After a failed payment there is a grace period. If the trial ends or a payment stays overdue, the organization becomes read-only: everything stays visible, but new scans, AI answers, reports and changes pause until a plan is active again.
Yes. The owner can delete the organization under Settings, Billing & plan. Every stored secret is deleted at once, everyone is signed out and all data and files are purged.
Start with a free 14-day trial. Upgrade when you are ready.