Find the Azure resources nobody remembers creating.
Cloud Manager scans your subscription every morning, lists the resources that are costing you money for no reason, and puts a number on each one. Read-only by default. Setup is one role assignment.
What it looks for
Seven detectors run against the Azure Resource Graph on every scan. Each finding carries the resource, its resource group, why it was flagged, and an estimated monthly cost.
- Unattached managed disks. The VM is long gone; the disk is still billing every hour.
- Unassociated public IP addresses. Reserved, not pointed at anything, still charged.
- Orphaned network interfaces. Left behind by deleted VMs and easy to miss.
- Empty App Service plans. A paid plan with no app left on it.
- Stopped but not deallocated VMs. The most expensive mistake in Azure: "Stopped" in the portal still bills for compute. Only "Stopped (deallocated)" does not.
- Resources with no owner tag. You cannot ask anyone about a resource nobody is attached to.
- Resources inactive for 90 days. Checked against real Azure Monitor metrics, not guesswork.
And three things beyond the scan
Daily spend, by resource group
A cost snapshot is recorded every day from the Azure Cost Management API, in your own billing currency, so you can see the day a number started climbing instead of finding out on the monthly invoice.
Test environments on a timer
Register a set of VMs as a test environment with a schedule — weekdays 9 to 7, say — and Cloud Manager deallocates them outside those hours. Access tokens for an environment can be given an expiry date, so a short-lived environment stops being reachable on its own.
Fixes you approve
Every finding comes with a remediation. The reversible ones — deallocating an idle VM, deleting an unattached disk — can be applied with one click from the console, and each action is written to an audit trail. Anything destructive stays report-only.
Getting set up
-
Admit the app to your tenant
One consent screen, done by an admin. This creates the Husknode service principal in your directory — it grants no access to resources on its own.
-
Assign the Reader role
One command, or three clicks in the portal under Access control (IAM). Reader is read-only: Cloud Manager can list and inspect resources, and nothing else.
-
Run the first scan
It starts immediately and usually finishes in under a minute. After that it runs itself every morning.
Optional, and only if you want it
Granting Virtual Machine Contributor as well lets Cloud Manager deallocate idle VMs for you rather than just listing them. Skip it and the product works exactly the same, minus the one-click fixes.
What it does not do
- It does not delete anything without you clicking a button. There is no autonomous destructive mode, by design.
- Cost estimates for idle resources are based on published Azure list prices, so they will not match an enterprise agreement with negotiated discounts exactly.
- It reads one subscription at a time. Management-group-wide scanning is not built yet.
- It covers Azure only — not AWS or Google Cloud.
Free while we are in early access
Tell us your subscription size and we will get you scanning the same day.