Everything KloudRecon does, in one place
75 capabilities in 13 areas, for a company looking after its own Azure, for CSP and MSP partners, and for their customers. All of it read only.
75 capabilities
Workspace
Connect and scan
Read-only in about three minutes
Where:Settings › Connections
Guided connection
Azure portal or Azure CLI steps for one app registration with the Reader role.
Validation checklist
Shows exactly what KloudRecon can read before anything is saved.
Connection tiers
Resources, Entra ID, cost, metrics and monitoring data (numbers only), each optional.
24 scan stages
Daily at the hour you pick and on demand, with live progress and retries per stage.
Partial, never silent
A stage without permission is marked partial and says what it is missing.
Secret reminders
An email before a client secret expires; replace it without a new connection.
Workspace
Overview and inventory
Your whole estate, what matters first
Where:Overview · Inventory · Changes
KloudRecon Score
One number from six weighted pillars, tracked after every scan.
Every resource
Filters, search, sort, a drawer with properties, tags, cost and findings; CSV or Excel.
Changes and who made them
Created, modified and deleted resources with the Activity Log identity; risky changes flagged.
Time machine
Open any earlier scan, or compare two scans side by side.
Orphaned resources
Unattached disks, unused public IPs, empty plans.
Workspace
Architecture diagrams
Drawn from what is deployed
Where:Diagrams
Eight views
Network, hub and spoke, resource group, application, data flow, region, hierarchy and Draw.
KloudRecon Draw
Every NIC, disk, public IP and NSG, one box per VM, every link labelled.
Overlays
Security, cost and exposure on the drawing; attack paths highlighted.
Presentation mode and timeline
Focus, collapse, notes, and the drawing as it was after an earlier scan.
Exports
SVG, PNG, PDF and draw.io, drawn from the same layout.
Architecture document
A narrative per view, the address plan with checks, components and posture.
Workspace
Security
288 checks, attack paths and the fix
Where:Security
288 automated checks
Network, identity, Entra ID, storage, databases, Key Vault, compute, containers and more.
The fix in five formats
Portal steps, Azure CLI, PowerShell, Bicep and Terraform, plus an Azure Policy where one fits.
Attack paths
Internet to workload to identity to data, remote access, weak data services and hybrid paths.
Exposure and identity
What the internet can reach, who can do what (CIEM) and Entra ID posture.
Vulnerabilities without Defender
Missing patches, software end of life and unpinned container images.
Workflow
Assign, resolve or accept a risk until a date; SLA and time to fix are tracked.
Workspace
Compliance and governance
Mapped by control ID, in our own words
Where:Compliance · Reliability · Governance
KloudRecon Azure Baseline
58 controls in 13 domains, each tied to Microsoft cloud security benchmark IDs.
Frameworks mapped
MCSB, ISO 27001, NIST 800-53, PCI DSS, SOC 2, HIPAA and Well-Architected, by control ID.
Evidence per control
A ZIP with the checks and resources behind each control; manual controls listed.
Reliability
Well-Architected checks, service retirements and quotas.
Governance
Tags, naming, policy, locks and budgets, with your own rules in a KQL subset.
Workspace
Cost and FinOps
Forecasts, anomalies and savings
Where:Cost & FinOps · Recommendations
Cost explorer
13 months by service, resource group, location, tag or resource.
Forecast with a range
P10 to P90 bands, checked against the past, and budgets with burn-down.
Anomalies with the cause
Each spike with the resources and meters behind it.
Rightsizing and waste
From real metrics: idle, oversized and orphaned resources with their money.
Reservations and savings plans
Commitment advice and a what-if with Azure retail prices.
Showback and savings tracker
Cost by tag, team or cost center, and the savings you have already made.
Workspace
Servers and Azure Arc
Inside every server, read-only
Where:Operate › Server health · Arc servers
Read-only scripts
PowerShell or bash per server; you run it, nothing connects to your servers.
Sealed output
The script prints an encrypted block that only KloudRecon can open.
Windows in depth
30 days of events, network drops, applications, SQL Server and 14 server roles.
Linux in depth
61 sections incl. Docker, PostgreSQL, MySQL, MariaDB and Redis.
Azure Arc fleet
Status, agent version, end of support, patches and SQL Server on Arc.
Fleet by role
Every server grouped by what it does, with a Word report.
Workspace
Reports, AI and alerts
Shareable answers, on time
Where:Reports · Ask KloudRecon · Settings › Alerts
PDF and Word reports
Executive, full, security, compliance, FinOps, architecture, changes and an editable assessment.
Your branding
White label, scheduled delivery by email and signed download links.
Recommendations hub
Security, cost and reliability actions in priority order, with Jira or Azure DevOps tickets.
AI summaries
Executive and analyst summaries whose numbers are checked against your data.
Ask KloudRecon
Chat on every page (Ctrl+J) with read-only tools and citations.
Alerts
Critical risks, attack paths, risky changes and budgets to email, Teams, Slack or a signed webhook.
Partner Console
Partner billing insight
Every customer’s bill, explained
Where:Partner Console › Dashboard · Organizations
Partner Center sign-in
No app registration: one read-only sign-in with MFA finds every customer.
13 months of cost
Every customer, subscription and meter, then the last 7 days again every day.
Twelve reasons that add up
New subscriptions, usage, prices, reservations, credits, earned credit, exchange rate and more.
Today
What needs you first, in money order, each item linked to the page that fixes it.
Three price views
What you pay, what customers pay and list price, on every chart and export.
FOCUS 1.0 exports
Cost lines in the open FinOps format, as Excel or CSV.
Partner Console
Prices, statements and money in
From Microsoft’s cost to a paid statement
Where:Partner Console › Prices & margin · Statements · Payments
Price books
Rules by service, meter, region or subscription, from list price or your cost, with volume tiers.
Statements in their currency
ECB reference rate, Microsoft’s rate or fixed rates, frozen on the statement.
Shared costs and late charges
Split one subscription by percent; usage that arrives late goes on the next statement once.
Accounting exports
QuickBooks, Xero, NetSuite, PSA tools and plain CSV.
Money in
Payments, ageing, credit risk, billing leakage and a check against Microsoft’s invoices.
Reseller summariesNew
One monthly summary per reseller from its customers’ final statements, emailed to the reseller.
Partner Console
Licences, renewals and access
Microsoft 365 and GDAP, ahead of time
Where:Partner Console › Licences · Renewals · Customer access
Licence lines
From Microsoft Graph every day, from the reconciliation file, or from Pax8.
Renewals and cancel windows
Renewal dates, unused seats before a renewal and the hours left to cancel.
GDAP and seat use
Relationships ending soon, customers without one, seats bought against assigned.
Earned credit watch
The day Partner Earned Credit stopped, what it costs and the likely cause.
Misuse watch
GPU machines for the first time, new regions and sudden compute growth.
Pax8
Companies, licence subscriptions and invoices from your distributor.
Partner Console
Customers and operations
Your customers, their portal, your tools
Where:Partner Console › Customers · Budgets · API access
Customer workspaces
The full KloudRecon for each customer tenant, scanned read-only through your sign-in.
Customer portal
“Your bill” at the customer’s prices and in its currency, with a shared budget ring.
Staff accessNew
Account managers limited to their customers, or to every customer of a reseller.
Budgets, alerts and commitments
Per customer or for all, with reservations and savings plans on a 12-month ruler.
Reports and the assistant
A monthly partner report, a customer review pack in Word, and partner questions answered.
Read-only partner API
Tokens for PSA, accounting and BI tools: customers, cost lines, statements, renewals.
Trust
Trust
Read only, by design
Where:Every page
Read only
No write permission is ever requested in Azure, Microsoft 365, Partner Center or Pax8.
Secrets in Azure Key Vault
Never in the database, logs, emails or the browser; logs redact secrets.
Separated by row-level security
Every customer table is isolated in the database itself.
Honest wording
Compliance is mapped by control ID, never claimed; AI text is labelled and checked.
Teams, roles and audit log
Owner, admin, member and viewer; every sensitive action is logged.
KloudRecon’s source code on GitHub
Read how KloudRecon is built before you connect anything. Free for noncommercial use.
Every releasePublished source code
The code is public at github.com/chathu2017/KloudRecon, so your security team can read it.
A clear licence
PolyForm Noncommercial 1.0.0: free for personal use, study, research and noncommercial organizations. Business use needs a KloudRecon plan or a commercial licence.