Microsoft Azure
Azure subscriptions, checked through an identity with no secret to steal.
ACSE reads your subscriptions through an app registration with a federated credential and no client secret or certificate. It checks storage accounts, network security groups, virtual machines and Entra ID, and treats each finding exactly as it treats one from AWS or Google Cloud.
Nothing to rotate
The identity ACSE uses has no client secret and no certificate. There is no credential to expire, leak or hand over.
Identity risk next to infrastructure risk
Guest access, guests in privileged roles and the number of subscription owners sit in the same queue as an open network security group.
Reader rights, and only those
The custom role holds exactly the read actions the Azure checks need, so you can show anyone what ACSE can see.
What the checks cover
13 checks where Azure exposure starts
Storage accounts
Anonymous blob access, secure transfer required and a minimum of TLS 1.2.
Network security groups
Rules that open administration or database ports to the internet.
Virtual machines
Managed disks, public IPs and customer-managed keys for disk encryption.
Entra ID and roles
Guest access and guest invitations, guests in privileged roles, custom administrator roles and how many owners a subscription has.
Connect a subscription
Federated, read-only, your scope
ACSE generates an az script and a Terraform module. They create an app registration with a federated identity credential for your ACSE runtime, a custom role with the Azure pack’s read actions, and the Microsoft Graph read permissions the identity checks need.
Choose one subscription or every subscription in your tenant. Your administrators run the setup; ACSE never sees their credentials.
- Choose the cloud and the scopeIn Setup › Connect cloud, a Tenant Admin picks the provider and what to cover. ACSE lists every permission it will need and who in your team can grant them, before anything is created.
- Run the generated setup in your cloudACSE generates a read-only setup bound to your tenant’s own runtime identity. Your team reviews and runs it. ACSE never runs it for you and never sees a key.
- Test the connection and confirm with MFATest connection checks every permission and reports exactly what is missing. The Tenant Admin confirms with MFA, and the connection settings are recorded on your evidence chain.
Scope
One account, or every account in an AWS Organization or organizational unit.
What the setup creates
- A read-only role, ACSEReadOnlyScanner, in each account in scope
- A trust policy that lets only your own ACSE runtime assume it
- A permissions boundary, so the role can never gain write access
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
Scope
One project, or every active project in a Google Cloud organization.
What the setup creates
- A workload identity pool and provider that trust your ACSE runtime
- A service account with read-only roles, which only that pool may impersonate
- No service-account keys, ever
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
Scope
One subscription, or a whole tenant.
What the setup creates
- An app registration with a federated credential for your ACSE runtime
- A custom role with exactly the read actions ACSE needs, at the scope you chose
- No client secrets or certificates
Read-only by design. ACSE delivers fixes as pull requests to your code, so the connection never needs write access to your cloud.
From finding to fix
Azure fixes go through the same review
An Azure finding follows the same path as any other: a change you can read, a person who approves it and evidence that it held.
- Find the resourceACSE names the storage account, network security group or role assignment and the check it failed.
- Propose the changeStorage account fixes, such as blocking anonymous access or requiring TLS 1.2, arrive as Terraform. Others come with a runbook.
- Approve with MFAA security approver who did not author the change decides, bound to the exact view they saw.
- Verify and recordAfter your pipeline applies the fix, ACSE re-reads the resource and adds the result to your evidence chain.
Framework coverage on Azure
Controls with a check behind them
Counts of the controls ACSE lists for each framework that at least one Azure check evaluates. The rest show as manual controls.
- CIS Microsoft Azure benchmark
- 12 of 22 tracked recommendations
- PCI DSS 4.0.1
- 8 of 48 tracked requirements
- NIST SP 800-53 Rev. 5
- 12 of 45 tracked controls
- FedRAMP Moderate
- 12 of 45 tracked controls
- CCCS Medium
- 12 of 45 tracked controls
- SOC 2
- 5 of 38 tracked criteria
- ISO/IEC 27001:2022
- 7 of 93 Annex A controls
Questions
What people ask us
Does ACSE need a client secret or certificate?
No. The app registration uses a federated identity credential that trusts your ACSE runtime. There is no secret or certificate to create, store or rotate.
What can the identity read?
Only the read actions in the Azure pack’s published permission list, plus the Microsoft Graph read permissions the Entra ID checks need. A test fails the setup generator if it would grant anything that is not a read.
Can I scan every subscription in my tenant?
Yes. Choose tenant scope and ACSE scans each subscription it can see. If some are not visible, Test connection reports a partial scope with counts.
Keep reading
Related
Read-only and keyless
ACSE connects to AWS, Google Cloud and Azure through short-lived, read-only access you create. No long-lived keys, no admin credentials, no cloud writes.
ReadPlatformApprovals and governance
Every ACSE fix needs a person’s approval with step-up MFA, bound to the exact view they saw. Authors don’t approve their own changes, and two people where policy says.
ReadFrameworksCIS Benchmarks
ACSE evaluates 51 of the 62 CIS AWS Foundations 3.0.0 recommendations automatically, and maps checks to the CIS Google Cloud and Azure benchmarks.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.