Contractor identities outlive the contracts that created them.
Public-sector systems have long lifetimes and short staffing cycles. Contractors, integrators and inter-agency partners are onboarded as guests and federated principals — and offboarding is a contractual event that rarely reaches the tenant.
The frameworks that ask you to account for this data. Not certifications we hold.
Four things your team already knows — and cannot currently prove.
Guest and contractor sprawl
Every integrator engagement leaves behind guest accounts and app registrations. The contract ended; the role assignment did not.
Systems outlive their architects
A system built in 2014 still runs, still holds citizen data, and no current employee can say what its service account reaches.
Continuous monitoring means logs you may not have
NIST AC controls assume telemetry. Legacy and air-gapped-adjacent workloads produce little of it, leaving control families evidenced by assertion.
Inter-agency federation is unmapped
Trust relationships between agencies grant reach nobody has drawn end to end.
The same graph, pointed at your regulated data.
Every guest and federated principal, resolved
Guests, external tenants and federated credentials are first-class identities in the graph, with the reach each one actually holds.
Verdicts for identities with no activity
ORPHANED, STALE and GHOST_MSI verdicts are derived from configuration, so dormant contractor access is found without a single log line.
Control-family evidence, per snapshot
AC-2, AC-3, AC-6 and AC-17 posture tied to identity facts rather than to a policy document.
Long-lifetime estates handled by design
Snapshots are comparable across years, so drift is measured rather than remembered.
What the platform guarantees.
Lineage verdicts assigned to every identity, continuously, with no telemetry dependency.
Write scopes requested. Nothing is ever changed in your tenant.
Provenance bases on every value — including "unknown", which is never shown as green.
These are properties of the platform, not findings from your estate. What a first snapshot surfaces in your tenant is the point of the walkthrough.
Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless, and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available