KloudRecon, in pictures
What goes in, what comes out, and how to use every part: for a company looking after its own Azure, for its team, for CSP and MSP partners, and for their customers.
- scan stages, read-only
- 24scan stages, read-only
- security and configuration checks
- 288security and configuration checks
- compliance frameworks mapped
- 8compliance frameworks mapped
- architecture diagram views
- 8architecture diagram views
- months of partner billing read
- 13months of partner billing read
- reasons that explain every cost change
- 12reasons that explain every cost change
One engine, read-only from end to end
Everything KloudRecon shows starts as a read-only call to a Microsoft service or a script you run yourself. Nothing is ever written back.
What KloudRecon reads
The KloudRecon engine
Reads, never writes
- 24 read-only scan stages
- 288 checks with fixes
- Security graph and attack paths
- FinOps and billing engines
- AI that cites its sources
What you get
Pick who you are, follow the steps
Each path names where to click and how long it takes. You can come back to this page from the account menu in the app.
Sign up
2 minutesStart the free trial with your work email (we send a one-time code) or with your Microsoft or Google account, then fill in a short profile.
Where:kloudrecon.com › Start free trial
Approval
Usually one business dayWe review every new organization to keep the platform safe. You get an email the moment your account is approved.
Where:Your inbox
Connect Azure read-only
About 3 minutesFollow the portal or Cloud Shell steps on screen: one app registration with the Reader role. Paste the tenant ID, client ID and secret, press Validate, and the checklist shows exactly what KloudRecon can read. The secret goes straight into Azure Key Vault.
Where:Settings › Connections › New connection
First scan
MinutesThe first scan starts by itself and you can watch every stage live. After that KloudRecon scans daily at the hour you pick, and Scan now is always there.
Where:The progress drawer in the top bar
See what matters and act
The Overview gives your KloudRecon Score, top risks, attack paths and savings. Open a finding for the fix as portal steps, Azure CLI, PowerShell, Bicep or Terraform, plus an Azure Policy to keep it fixed. Assign it, resolve it, or accept the risk until a date.
Where:Overview · Security › Findings · Recommendations
Share and stay ahead
Make PDF or Word reports with your logo, schedule them by email, send alerts to email, Teams or Slack, and invite colleagues with the role they need.
Where:Reports · Settings › Alerts · Settings › Team
Your first session, as you will see it
Six steps from the sign-in to a report that goes out by itself. The window plays them in order; pick a step to stop on it.
Step 1 of 6
A code, not a password
Start the free trial with your work email: we send a one-time code. Or continue with Microsoft or Google.
What happens when a scan runs
A scan reads your subscriptions in 24 stages, grouped here in seven steps. The light shows the order they run in.
- 1
Connect
- Sign in read-only
- Subscriptions and management groups
- 2
Map
- Every resource
- How resources connect
- Role assignments
- Changes and who made them
- 3
Signals
- Defender for Cloud
- Azure Advisor
- Azure Policy
- Configuration
- Entra ID
- 4
Cost
- 13 months of cost
- Forecast and anomalies
- Usage metrics
- Reservations and savings plans
- Quotas
- 5
Hybrid
- Monitoring data
- Azure Arc servers
- 6
Analyze
- 288 checks
- Patches and lifecycle
- Attack paths
- Risk and score
- 7
Draw and finish
- Diagrams
- Snapshot and alerts
24 stages in all. Each one is read-only, can be retried on its own, and shows live in the progress drawer. A stage without permission is marked partial, never failed silently.
From one setting to a higher score
Follow a single finding through KloudRecon: the setting in Azure, the check that reads it, how it is rated, the fix, the scan that closes it and the score that moves.
Step 1 of 6 · In your Azure
One setting
A storage account still allows anonymous read access to its blobs.
Example resource and numbers.
How the KloudRecon Score adds up
One number for the whole estate, built from six pillars with fixed weights, so a change in the score always has a reason you can open.
- Security30%Exposure, identity, data protection, attack paths
- Cost20%Waste, rightsizing, commitments
- Reliability20%Backups, zones, retirements, quotas
- Governance15%Tags, policies, naming, locks
- Operations10%Monitoring, diagnostics, updates
- Performance5%Sizes and limits
Each pillar is scored from its failed checks, weighted by severity. A finding counts more when its resource is reachable from the internet, on an attack path, privileged, holds sensitive data or runs in production. The score is tracked after every scan, so you see it move as you fix things.
How a dollar of usage becomes a paid statement
From what Microsoft charges you to what your customer pays, every step is explained, priced at your price book and kept for the audit.
Usage at list price
$1,000
From Partner Center
Your cost
$850
After 15% earned credit
Your price
$1,050
Price book: list + 5%
Their currency
€966
ECB rate, frozen
Statement
Final
PDF, Excel, NetSuite
Paid
12 days
Ageing and reminders
Margin$200 on this example (19%), per customer, service and reseller.
Volume tiersFor example −1% above 10,000 and −2% above 50,000 a month.
Shared costsOne hub or backup subscription shared between customers by percent.
Example numbers. Customers never see your cost or margin.
The map of the app
Point at a card to light up where it lives. The menu on the left of the app follows the same order.
- OverviewScore, top risks, savings, recent changes
- ExploreEvery capability with your numbers, setup steps
- InventoryEvery resource, filters, export, time machine
- DiagramsEight views with overlays and exports
- SecurityFindings, attack paths, exposure, identity
- ComplianceControls mapped, evidence packs
- Server healthWindows, Linux and Arc servers
- Cost & FinOpsExplorer, forecast, budgets, waste
- RecommendationsOne backlog in priority order
- ReportsPDF and Word, scheduled by email
- SettingsConnections, team, alerts, branding
- Ask KloudReconThe assistant on every page, with sources
What to look at, and when
KloudRecon does the reading every day. This is the short routine that keeps you ahead of it.
Every day
- The scan runs by itself at the hour you pick
- Alerts reach email, Teams, Slack or a webhook
- Partners: work the Today list from the top
Every week
- Work new findings and recommendations
- Look at Changes: who changed what
- Partners: renewals and cancel windows coming up
Every month
- Scheduled reports reach your inbox
- Check the cost trend, budgets and savings
- Partners: make statements, record payments
Faster with the keyboard
The whole app works from the keyboard. These four save the most time.
Ctrl+K
Jump to any page, setting or resource
Ctrl+J
Ask KloudRecon a question
Esc
Close a drawer or dialog
Tab
Every control works from the keyboard
What KloudRecon never does
A partner’s customers see their own tenant and their bill, never more:
- Their own tenant: overview, inventory, security, diagrams, compliance and reports
- “Your bill”: this month so far, last month and every month, at the prices you set
- The statements you finalized, as PDF
- Your logo and colours when white label is on
- Never: your cost, margin or Partner Earned Credit
- Never: other customers, or anything in the Partner Console
- Never: draft statements
- Change, stop, buy or delete anything in Azure, Microsoft 365, Partner Center or Pax8
- Read data inside your services: files, blobs, database rows, messages, secrets or keys
- Keep a secret or sign-in anywhere but Azure Key Vault
- Connect to your servers: you run the read-only script and paste the sealed result
- Show a partner’s cost or margin to their customers
- Let the AI assistant change anything: it can only read