Azure security posture, with receipts
Turn Azure security findings into client-ready evidence.
Track what changed, coordinate fixes, and show the supporting evidence across every client tenant. Read-only checks on Azure and Entra, mapped to CIS, SOC 2, HIPAA, HITRUST and ISO 27001, packed with the raw facts and a verify link.
Mapped to CIS Azure Foundations, SOC 2, HIPAA, HITRUST CSF and ISO 27001, not certified against them. HITRUST references here are the public CSF v9.2 control ids Microsoft documents; a formal assessment needs a licensed CSF.
Honest pricing
$0
Try it on your own subscription.
- 1 Azure subscription
- On-demand runs
- Live dashboard, every check, every family
- Dismiss and accept a risk
- The full requirements matrix, read-only
$49/mo
For proving posture to an auditor or an insurer.
7-day trial, then $49/mo.
- Up to 3 Azure subscriptions
- Evidence pack export (manifest, per-check JSON, printable report)
- Full run history and drift between runs
- Weekly scheduled runs
- Entra identity checks (MFA, Conditional Access, privileged roles)
- Track manual requirements, attach evidence, ship one binder
$199/mo
For an MSP proving posture across client tenants.
7-day trial, then $199/mo.
- Unlimited Azure subscriptions
- Everything in Pro
Every control, not just the Azure ones
Track the policies and records an auditor asks for, attach the evidence, and ship one pack.
What auditors and insurers actually ask
Real questions from a SOC 2 or HIPAA auditor's request list, an ISO 27001 assessor's evidence request, or a cyber insurance application, and the ProofKit check that answers each one.
"Is multi-factor authentication enforced for all users?"
id.mfa_registration and id.ca_require_mfa show
who has no MFA method registered and whether a Conditional Access policy requires it.
"Are administrative accounts limited and monitored?"
id.global_admins and id.privileged_no_mfa count
Global Administrators and flag any without MFA.
"Is remote management access restricted to known sources?"
net.nsg_open_mgmt_ports finds network security group rules
that leave SSH, RDP, WinRM or database ports open to the internet.
"Is data encrypted in transit and at rest?"
sto.min_tls, sto.https_only and
data.sql_tde check transport and storage encryption directly.
"Do you have centralized logging and alerting?"
log.activity_log_export, log.la_workspace and
log.security_contact confirm activity logs are exported and someone gets
alerted.
"Are backups and patching in place?"
comp.vm_no_backup and comp.automatic_updates
check backup coverage and automatic patching on your VMs.
"Is ePHI encrypted at rest and in transit?" (HIPAA)
data.sql_tde and data.postgres_ssl check
database encryption at rest and required secure transport, mapped to HIPAA Security
Rule 164.312(a)(2)(iv) and 164.312(e)(1).
"Do you have a vulnerability management process?" (ISO 27001)
data.sql_vuln_assessment confirms scheduled vulnerability
scanning is on, mapped to ISO/IEC 27001 Annex A.8.8.
Frequently asked
Can ProofKit change anything in my Azure subscription?
No. Every call ProofKit makes is a read: ARM GET, Resource Graph query, or Microsoft Graph GET. The app registration you create needs only the built-in Reader role and, if you opt in to identity checks, a handful of Graph read permissions. ProofKit never writes, deletes, or changes a setting. Read-only, always, and we never change anything.
What is an evidence pack?
A zip built at the moment you run ProofKit: a manifest listing every check and a hash of its evidence, the full evidence for each check as JSON, a printable HTML report, and a short README explaining how to verify the hashes with one command. It also carries the whole requirements matrix per framework and every evidence file you attached to a manual control, hashed the same tamper-evident way. Each run's manifest hash chains to the one before it, so an auditor can prove the pack was not altered after the fact.
Do I need to connect Microsoft Entra?
No, it is optional. Connecting the subscription alone runs every network, storage, data, logging, compute and Defender check. Identity checks (MFA registration, Conditional Access, privileged roles) need a handful of Microsoft Graph read permissions and are a Pro feature.
What counts as one subscription on the free plan?
One connected Azure subscription with on-demand runs and the full live dashboard. Pro adds evidence pack export, run history and drift, weekly scheduled runs, identity checks, and room for up to 3 Azure subscriptions. MSP adds nothing further except an unlimited subscription count, for an MSP proving posture across client tenants.
What happens if I go over 3 subscriptions?
On Pro you can connect up to 3 Azure subscriptions. A 4th is refused with a message pointing you at MSP. If you are on MSP and downgrade back to Pro with more than 3 subscriptions connected, nothing is deleted: your 3 oldest subscriptions keep running on schedule, and the newer ones are paused (their evidence and run history stay put) until you either upgrade again or delete an older subscription to make room.
How is this different from Microsoft Defender for Cloud's secure score?
Defender for Cloud gives you a percentage. ProofKit gives you the underlying resource facts behind each check, timestamped and hash-chained, packaged the way an auditor or insurer actually wants to receive it. ProofKit's own Defender family also surfaces your secure score and top unhealthy assessments directly, labeled "Azure says."
Read-only, always
ProofKit only ever reads. We never change a setting, a resource, or a policy in your Azure subscription or Entra tenant.
Evidence, not just a score
Every check keeps the raw resource facts it examined, hashed and timestamped, so a pass or fail is provable, not just asserted.
Runs are kept
Every run is stored, so the next audit shows drift since the last one: what started failing, what got fixed, and exactly which resources changed.