Who can reach what — and through which trust.
Relationships and reachability across the whole estate. Who can assume what, through which trust, to reach which resource — resolved through the full scope hierarchy, not read off a single assignment. The depth that makes every other answer credible.
Privilege inherits downward. So we resolve the whole hierarchy.
An assignment names one scope. It grants everything beneath it. Resolving that hierarchy correctly is the difference between a picture that reassures and a picture that is true.
Every edge is attributed
Direct assignment · group membership · nested group · inherited scope · federated trust · PIM-eligible activation. An edge we cannot attribute is an edge we do not draw.
Eligibility counts
A PIM-eligible role that is not currently active is still reach — it is one activation away. Treating it as zero is how standing privilege hides.
Find the reach you never granted.
A scoped assessment against your own Azure tenant. Read-only, agentless, and nothing is written to your environment — ever.
Free forever — 1 subscription, 500 identities · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available