Read-only Azure visibility

Read your Azure.
Never write it.

Cirrus goes past inventory. It traces network paths hop-by-hop, validates your estate against the Well-Architected Framework, simulates NSG traffic decisions, and audits against CIS Azure Benchmark — for every subscription in your tenant. All read-only. All read live from Azure.

Reader role on Azure is all it needs.Multi-tenant, Lighthouse-aware.Nothing about your estate is stored.
/inventory/virtual-machines
Virtual Machines
6 VMs · 4 running · 1 deallocated · 1 stopped
CSVPDF
NameStatusSizeRegionEst./mo
aks-runner-01runningStandard_D4s_v5eastus$182.50
sql-primaryrunningStandard_E8s_v5eastus$412.10
batch-node-02deallocatedStandard_D8s_v5westeu$0.00
jump-boxrunningStandard_B2mseastus$60.80
reporting-webrunningStandard_D2s_v5eastus$70.10
legacy-ftpstoppedStandard_A2_v2westus$44.90
22Resource views
0Write operations
ReaderAzure role required
~5 minSetup time
Beyond inventory

Not just a list of resources.

Cirrus answers the questions an inventory tool stops at — which VMs are reachable, what your architecture scores against WAF, which CIS controls fail, which RIs would pay back.

01Network path

Trace traffic hop-by-hop from source to VM

Pick any VM and Cirrus walks the network chain — NIC, subnet, NSG, effective rules, route table, public IP — reproducing the same source-to-destination trace az network watcher gives you. Then the traffic simulator evaluates a given (source, port) against every rule in priority order and shows exactly which one matched.

Traffic simulatorDENY
Source0.0.0.0/0
Port22 (SSH)
ProtocolTCP
100 · AllowVnetHttpsskip
200 · AllowSshFromVnetskip
65500 · DenyAllInboundmatch
02Well-Architected

Score your estate against Microsoft's five pillars

Cost, Reliability, Security, Operational Excellence, Performance Efficiency. Every VM, storage account, key vault, and public IP is scored against the WAF checklist with letter grades and an overall roll-up. Findings link back to the exact resource — no leaving the report to drill in.

Well-Architected ReviewOverall 72 · B
Cost
88A
Reliability
62C
Security
45F
Ops. Excellence
74B
Performance
91A
5 pillars · 47 checks3 findings · Security
03CIS Benchmark

Twelve CIS controls, run on every load

RDP, SSH, and database ports open to the Internet. Storage accounts allowing HTTP or public blobs. Key Vaults without purge protection. App Services that don't enforce HTTPS. All flagged with the CIS control ID they violate, ready to export as an audit PDF.

CIS Benchmark67% compliant
6.1RDP restricted from InternetPASS
6.2SSH restricted from InternetFAIL
3.1Storage HTTPS-onlyPASS
3.7Public blob access blockedPASS
9.2App Service HTTPS-onlyFAIL
8.2Key Vault purge protectionREVIEW
04Live spend

Real prices from the Azure Retail Prices API

Every VM cost is pulled from Microsoft's public Retail Prices API for the exact SKU and region. PAYG, 1-year RI, and 3-year RI rates arrive in the same round trip. Cached 24 hours per (SKU, region) so a 200-VM estate typically hits the API less than fifteen times.

RI vs PAYG · Live Retail Prices API
SKUPAYG3-Yr RISave
Standard_D4s_v5$192$7760%
Standard_D8s_v5$384$15460%
Standard_B2ms$61$2559%
Standard_E4s_v5$252$10160%
The guarantee

It literally can't write.

Not a policy. Not a checklist. Four defensive layers in code make mutation impossible.

1.

Every Azure call is a read

The proxy that talks to Azure only accepts read verbs. Any request that would create, change, or delete a resource is rejected before it leaves the app.

2.

The query language cannot mutate

Cross-subscription searches run through Azure's read-only query engine. It has no write primitives — there is no query text that could ever change a resource, by design.

3.

No write client exists in the code

The Azure client libraries that could theoretically perform write operations are never loaded. If a developer ever tried to add one, the app would fail its build check.

4.

Your snapshots stay in your browser

Drift snapshots are cached in your own browser and never sent to a server. Deleting a snapshot removes it locally — Azure is untouched, and there is no server copy to leak.

Full coverage

All 22 views. Every one working end-to-end.

Inventory, cost, security, networking, monitoring, and tools — all in one shell, all read-only.

Inventory

5 views
Resource Groups
tags, location, provisioning state
Virtual Machines
size, OS, live power state, CIS/STIG hardening
App Services
HTTPS-only, plan, kind (Function detection)
Storage Accounts
public blob, HTTPS, network default
SQL Servers
version, FQDN, state

Networking

4 views
Network Security Groups
risk classifier, orphan detection
Public IP Addresses
attachment, SKU, waste alerts
Application Gateways
backend pools, WAF status
Network Flow Analyzer
effective rules + traffic simulator

Cost & Optimization

6 views
Azure Advisor (Cost)
impact-ranked recommendations
RI & Quotas
live PAYG vs 1-Yr / 3-Yr RI
Cost Attribution
tag pivots, untagged spend
VM Right-Sizing
Advisor + live price delta
Orphan Resources
waste $/mo with cleanup commands
Multi-Sub Summary
streaming cross-sub roll-up

Security & Compliance

4 views
Well-Architected Review
5-pillar scoring
CIS Benchmark Audit
12 automated controls
Blast Radius Analyzer
VM/VNet/NSG dependencies
Key Vault Audit
soft-delete, purge, network

Monitoring

3 views
VM Backups
Recovery Services Vault health
Monitor Alerts
activity log · 1h / 7d / 30d
Monitor Metrics
CPU / memory / net / disk chart

Tools

3 views
Cloud Drift Detector
snapshots stored in your browser
Resource Graph Explorer
KQL editor · 12 templates
Technical Documentation
auth, architecture, security
Sign in

Bring a Service Principal.

One command to create it, one form to sign in. Credentials are encrypted server-side for eight hours and are never readable from your browser. Logout wipes the session immediately.

# One command to create the SP
az ad sp create-for-rbac \
  --name "azure-inventory-utility" \
  --role Reader \
  --scopes /subscriptions/YOUR_SUB_ID
  • Reader on each subscription is enough — no other roles required.
  • MSPs: enable Azure Lighthouse and see every delegated tenant.
  • No agents, no policies, nothing to deploy inside your Azure.

Sign in to Cirrus

Service Principal · Reader role · Read-only

Credentials are encrypted (AES-GCM) in an HttpOnly, Secure cookie and never leave this browser session.

Built by Arunim's IT Caffe

Common questions

Answers to what people ask first

How is this different from an inventory viewer?+

Inventory is the entry point, not the product. Cirrus traces end-to-end network paths for any VM, simulates NSG traffic decisions rule-by-rule, scores your estate against the Well-Architected Framework's five pillars, audits twelve CIS controls, cross-references Azure Advisor with live Retail prices for right-sizing, and detects drift between snapshots. Inventory is what feeds those tools.

Can this app modify anything in my Azure account?+

No. Every request the app makes to Azure is a read. Any write attempt is rejected before it leaves the app, and no write client is loaded in the first place.

Where do my credentials live?+

Encrypted server-side and referenced by a session cookie your browser cannot read. The session expires after 8 hours or when you click Logout.

What data do you keep server-side?+

Nothing about your estate. VM prices are cached briefly to avoid hammering Microsoft's public price API. Drift snapshots live in your own browser and never touch a server.

Do I need to install anything in Azure?+

A Service Principal (one command with the Azure CLI) and a Reader role assignment. No agents, no policies, no workspaces.

Are the prices real or estimates?+

VM PAYG / 1-Yr / 3-Yr RI rates come from Microsoft's public Azure Retail Prices API. Disks, IPs, storage, and App Services use conservative fallback rates when usage-based cost can't be inferred from inventory alone.

Is Azure Lighthouse supported?+

Yes. Tick the Lighthouse checkbox on the login form. Every subscription your Service Principal can see is listed and marked as either HOME or delegated.

The family

More from Arunim's IT Caffe

Independent tools for cloud operators. Small, sharp, opinionated.

CirrusYou are here
Read-only Azure visibility

Inventory, cost intelligence, security posture, and compliance reporting for every subscription in your tenant. All read-only.

CloudCanvas
Cloud architecture design

Design, diagram, and share cloud architectures visually — a canvas built for the way cloud teams actually think.

cloudcanvas.co