Tools

Things I built, not things I wrote about.

Two you can log into today. The rest run inside your own tenant, source on GitHub, each one built because a client problem turned up twice.

12 tools · 11 with the source on GitHub · MIT unless noted

Open in a browser

The two you can use right now

Product · Hosted SaaS

TenantThrift

● Live

Azure Cost Management shows what you spent. TenantThrift shows where you are losing money — idle, oversized and orphaned resources, each with a euro amount and a guided fix.

Connects in minutes — admin consent, nothing to deploy, no agents
Read-only by design — Reader role, no exportable secrets
EU-hosted in Frankfurt by a Swiss company

Start free trial See the live demo

Hosted B2B SaaSBeta · 14-day trialReader role, read-onlyFrankfurt, EU

app.tenantthrift.com

The TenantThrift dashboard, showing monthly savings across a tenant scan

Free tool · No login

Least Privilege Studio

● Live

Pick the resources and actions you actually need — for Azure RBAC or Entra ID — and get back the narrowest built-in roles that cover them, plus a ready custom role definition.

Every Azure RBAC role and operation, re-synced from Azure every week
Paste Terraform or Bicep and it works out the permissions
Import an existing role or a custom JSON to compare against

Open the tool Source on GitHub

Free · no loginNothing leaves the browserAzure RBAC & Entra ID

leastprivilegestudio.com

Least Privilege Studio, picking Azure RBAC actions by resource category

Run in your tenant

Automations

Deploy once. A schedule or an event does the work after that.

Automation · Runs in your tenant

AzureInPlaceUpgrade

Preview

Windows Server 2016, 2019 or 2022 to 2025 on an Azure VM, unattended, with nobody in an RDP session.

Nineteen read-only checks and a snapshot before anything moves
One VM from your terminal, or a tagged fleet in rings

See the upgrade path Command reference PowerShell Gallery

MIT · PowerShell 7.2+ · WS2016/2019/2022 to 2025

Automation · Runs in your tenant

AzureVMCredentialRotation

Local admin passwords and SSH keys, rotated on a schedule, on the machines Windows LAPS cannot reach.

Driven by the Key Vault expiry date, nothing else
A credential somebody reads is replaced within hours

See what it deploys Command reference PowerShell Gallery

MIT · PowerShell 7.2+ · Bicep or Terraform

Automation · Runs in your tenant

VM Power Management

Preview

The alternative to Start/Stop VMs v2. A tag on the machine names its schedule, so nobody maintains a list of which VMs are in scope.

Membership is recomputed every run, not stored in a payload
Ships disarmed, and every decision is written down with its reason

See what it deploys Command reference PowerShell Gallery

MIT · PowerShell 7.2+ · Bicep

Deallocate on Activity Log

A guest shutdown stops the OS and keeps billing the VM — an activity-log alert and a Logic App deallocate it within minutes

Logic App

Get the findings

Audits

Run a script. Review the findings.

Audit · One file, nothing installed

RiskyRolesAnalyzer

Every privileged role assignment in Azure and Entra, including the ones hidden behind groups, custom roles and dormant apps.

Custom roles rated by effect, nested groups expanded to members
One self-contained HTML report, with the fix for each finding

Audit privileged access See a sample report

MIT · PowerShell 7.2+ · Read-only

Audit · One file, nothing installed

AppLifecycleAnalyzer

Every app registration with the date its credentials expire and when it was last actually used.

Secrets, certificates and federated credentials with their dates
One self-contained HTML report, with the cleanup command per row

Audit app registrations See a sample report

MIT · PowerShell 7+ · Read-only

NSG Gap Finder

Azure VMs whose NIC or subnet has no network security group attached

PowerShell

VM OS Audit

The operating systems actually running, including the forgotten ones

PowerShell

Deploy the foundation

Blueprints

One deployment stands up the whole platform.

Golden Image Builder

Gallery, image definitions, build templates and the monthly schedule

Bicep

Self-Service VM Ordering

A web form, a Logic App and a queue instead of portal access — VMs and AVD session hosts

ARM

Plus 3 Claude Code skills. They run in an editor rather than a tenant, so they are not counted above. All of them on GitHub →

azure-costCost breakdown for a resource group, or an estimate from Terraform and Bicep before you deploy it
azure-rbac-advisorThe narrowest role for a planned action or a deployment, with the actions it needs spelled out
azure-updatesService updates and retirements matched against what is actually in your environment

Want one of these run against your tenant?

Read-only, on your subscription, and the findings walked through afterwards.

Get in touch