The platform One graph. Every question you'd otherwise ask eight tools.
AuditGraph is not a collection of tools that happen to share a login. Every surface renders
the same canonical facts, produced once, by one owner. If two screens disagree, that is a
defect — not a perspective.
01
Human
Employee, admin, contractor
02
Service Principal
App registration
03
Managed Identity
System or user-assigned
04
AI Agent
A subtype of NHI
05
Model
Cognitive Services
06
Classified Data
PHI · PCI · PII
How it works Read-only consent to ranked decision in four steps.
01
Grant read-only access
Microsoft Graph and ARM, read scopes only. No agent is installed. No write permission is ever requested — the product is architecturally incapable of changing your tenant.
02
Discovery builds the graph
Every identity across every class — human, service principal, managed identity, workload, CI/CD, PAT, OAuth app, AI agent — with role assignments, scopes, federated credentials, and PIM state.
03
Engines compute consequence
Reachability, blast radius, attack paths, and data exposure — derived from configuration, not inferred from behavior. Each identity receives a lineage verdict.
04
One ranked decision
Ranked by business consequence — never by population or node count — with the evidence trail attached, ready to hand to an auditor.
Capabilities Every capability — and exactly how mature it is.
Maturity below is copied from our internal feature catalog, not written for this page.
GA ships and reconciles. Alpha is usable but not yet
trustworthy for a buying decision. We would rather you know.
Decision Center
What is the biggest identity risk to the business today, and what is the one move?
GA Executive Summary
The one-minute decision story. One decision, above the fold.
GA Risk Center
The ranked risk landscape, with drill-through to evidence.
GA Risk Reduction Planner
Programs and their projected outcomes — tracked as reduction, not tasks.
GA Argus
Natural-language query over the graph. Answers reconcile to canonical facts or it declines to answer.
Identity Security
Who and what exists, what do they hold, and when was it last used?
GA Identity Estate — All / Human / NHI / AI
The discovered estate by class. The substrate everything else is computed from.
GA Identity Investigation
The canonical per-identity investigation: story, one recommendation, evidence.
GA Privileged Access
Standing privilege, PIM eligibility, and activation reality.
GA Identity Hygiene
Credential age, expiry, secret and certificate posture.
Investigations
How would an attacker get from here to something that matters?
GA Identity Graph
Relationships and reachability. The moat and the evidence.
GA Attack Simulator
Attack-path and blast-radius analysis, computed before exploitation.
Governance
Where is privilege excessive, and who signs off on reducing it?
GA Role Mining / Role Optimization
Find and reduce excess and standing privilege at scale.
GA Entitlements
What an identity truly holds once scopes resolve.
GA Toxic Access
Privilege combinations that enable escalation when held together.
GA Access Reviews
Reviewer-driven certification with a defensible trail.
Data Security
Who can reach our regulated data, and by what path?
GA Data Trust Zones
PHI / PCI / PII classification — the value anchor every exposure number depends on.
GA Data Reachability
Which identities reach which classified data. The core business-risk link.
GA Resource-first exposure
Start at a storage account, a database, a dataset — and see every identity that can reach it.
AI Security
What AI is running in our tenant, and what can it reach?
GA AI Findings
AI-identity risk surfaced as identity risk, on the same graph.
ALPHA AI Runtime
The AI-identity runtime surface — the fastest-growing identity class.
ALPHA Model Registry
Inventory of models and AI workloads discovered in the tenant.
ALPHA Supply Chain
Federation and provenance trust for AI and non-human identities.
Compliance
Can we prove this to an auditor?
GA Compliance Posture
Framework-by-framework rollup per control family.
GA Compliance Evidence
Evidence-first control posture tied to identity facts.
GA Auditor Pack
The artifact you hand to an auditor, reconciled to the same canonical numbers.
Operations
Is what I am looking at fresh, and what changed?
GA Findings
The operational backlog where investigation meets action.
GA Drift Analysis
Change between snapshots. Requires at least two — and says so when it has one.
GA Operations Center
Discovery and producer health. Freshness you can verify rather than assume.
What we cannot do yet What we don't do yet, in writing.
Prove reduction. Recomputing reachability with a remediation applied — the counterfactual engine — is on the roadmap. Until it ships, we show projected outcomes labeled as projected, never as measured.
AWS and GCP discovery. Both are documented extension points with stub connectors. Azure is the generally available provider.
Owner inference. We do not guess who owns an identity. Unowned identities display as unowned.
Per-object event history. Where we do not model an event timeline, the timeline is empty rather than filled with something plausible.
WCAG AA certification. The product is keyboard-operable and theme-aware; a formal audit and VPAT are pending.
This list lives at Trust → Known limitations
and is maintained alongside the product, not the marketing.
Get started Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless,
and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available