AI-Powered · Azure Marketplace

Azure waste, found
and ranked in minutes

A read-only AI agent that scans your Azure subscription, ranks daily spend, and produces typed recommendations — downsize, change tier, reserve, decommission — each backed by verbatim evidence from Cost Management, Resource Graph, and Log Analytics. Nothing in your subscription is ever mutated.

Deploy from Marketplace How it works
17+
Resource types
covered
3
Radars: cost · capital
intensive · compliance
0
Writes to your
subscription
100%
Stays in your
Azure tenant
Core capabilities
🔒
Read-Only by Design
Every action is advice plus evidence. The agent reads Cost Management, Resource Graph, and Log Analytics — it never writes, deletes, or changes a resource in your subscription.
📊
17+ Resource Recommenders
VMs, App Service Plans, AKS, Container Apps, SQL & Cosmos DB, Storage, AI Foundry, Cognitive Services, Search, GPU pools, networking, idle resources, reservations — each with its own typed analyser.
🎯
Three Specialised Radars
Cost Radar (daily spend & waste), Capital-Intensive Radar (commitments & reservations), Compliance Radar (tag, policy, & governance drift) — each a structured pipeline returning a typed result.
💬
Conversational Agent
Ask in natural language. The translation agent converts your question into KQL against Resource Graph, Activity Log, or Cost Management — then merges the results into a single answer.
🧾
Evidence-Backed Findings
Every recommendation links back to the metrics, billing rows, or activity log entries that triggered it. If a recommender skips a resource, the diagnostic reason is surfaced — no silent gaps.
⚡
Azure AI Foundry Inside
Backed by your own Azure AI Foundry / OpenAI deployment. Bring an existing instance or let the template provision a fresh one. Compute and prompts never leave your tenant.
How it works
01 —
Deploy from the Marketplace
A 5-step wizard provisions a Container Apps environment, a managed identity, Log Analytics, and an Azure AI Foundry deployment into a resource group in your subscription. The container image is pulled from our ACR using a scoped read-only token baked into the template.
02 —
Grant the managed identity subscription-scope reader roles
Run the supplied assign-subscription-roles.sh script once as a subscription Owner. It assigns Reader, Cost Management Reader, and Monitoring Reader so the agent can query your data. Idempotent — safe to re-run.
03 —
Sign in with Microsoft
Open the Container App URL from the deployment outputs and authenticate via Microsoft Entra ID. Easy Auth (if enabled during the wizard) or the SPA MSAL flow gates access using your app registration — no new accounts, no shared passwords.
04 —
Run a radar scan
Trigger Cost, Capital-Intensive, or Compliance radar from the dashboard. The orchestrator fans out across resource types in parallel: each tracker collects evidence from Resource Graph, Cost Management, and Log Analytics; each recommender analyses the status and emits a typed recommendation.
05 —
Review and act on the report
Findings are ranked by estimated savings, colour-coded by confidence, and accompanied by the exact metric or billing evidence that produced them. Share with finance, platform, or the resource owner. Nothing is changed in your subscription — every action remains your decision.
Recommendation severity
Green Optimised. Utilisation and configuration are healthy for the assessed resource. No action required, though usage patterns should be reviewed periodically.
Yellow Tuning opportunity. Resource is sized or tiered above the observed need, or a reservation / autoscale change would lower cost. Review and confirm before changing.
Red Significant waste detected. Idle or critically underused resource, abandoned snapshot, orphan disk, or zero-traffic plan. High-confidence saving — action recommended.
Architecture overview
deployment-topology.txt
Frontend
React 19 TypeScript Vite MSAL React Runtime config
Backend
Python 3.12 FastAPI Azure SDK DefaultAzureCredential Container App
AI Layer
Azure AI Foundry GPT-class model NL→KQL agent Recommendation agent
Azure data sources
Resource Graph Cost Management Log Analytics Activity Log Azure Monitor
Platform
Container Apps Managed Identity Entra ID Bicep IaC Managed App
Technical foundation
Backend
Python 3.12 · FastAPI · Azure SDK · async I/O
Frontend
React 19 · TypeScript · Vite · MSAL
Authentication
Microsoft Entra ID · Easy Auth or MSAL · Managed Identity
AI
Azure AI Foundry · GPT-class default + recommendation models
Data sources
Resource Graph · Cost Management · Log Analytics
Infrastructure
Container Apps · Bicep IaC · Managed App package
Get started
Deploy into your Azure subscription
Available as an Azure Managed Application from the Service Catalog.
Deploys into your tenant — your billing and resource data never leave your environment.
Deploy from Marketplace
Before deploying — you will need
①
Entra App Registration
Create a new app registration in your tenant. Note the Application (client) ID, Tenant ID, and a client secret. They are pasted into the deployment wizard.
②
Azure subscription (Owner)
Owner or User Access Administrator on the target subscription — required to grant the three subscription-scope reader roles after deployment. Contributor alone is not enough.
③
Azure AI Foundry
Connect an existing Azure AI Foundry / OpenAI account during the wizard, or let the template provision a fresh one with the default + recommendation model deployments.
After deploying — first-time setup
1
Open the deployment outputs and copy the Container App URL
In the Azure portal, go to the managed application → Overview → Outputs. Copy the value of containerAppUrl — it looks like https://ca-<name>-<env>.<region>.azurecontainerapps.io. Also note the identityPrincipalId — you'll need it next.
2
Grant the managed identity three reader roles at subscription scope
Required
The managed-app provisioning engine cannot write subscription-scope role assignments, so this is done after deployment by an Owner / User Access Administrator. Until this step is complete, the UI loads but every cost scan returns empty.
Run the helper script
a. Sign in: az login as a subscription Owner or User Access Administrator.
b. Run: ./scripts/assign-subscription-roles.sh --principal-id <identityPrincipalId>
The script assigns three built-in roles at subscription scope: Reader Cost Management Reader Monitoring Reader
Optional: assign Log Analytics Reader on your workspace to unlock the metrics-driven recommenders (most utilisation-based findings depend on this).
Idempotent — existing assignments are skipped, so it is safe to re-run.
3
Add the Container App URL as a redirect URI on your app registration
In the Azure portal, open Microsoft Entra ID → App registrations → your app → Authentication.
Under Web, click Add URI and add <containerAppUrl>/.auth/login/aad/callback for the Easy Auth sign-in flow.
Under Single-page application, click Add URI and paste the bare containerAppUrl — required by the MSAL SPA flow when Easy Auth is disabled.
Add the URL under the platform you intend to use — Web for Easy Auth, SPA for MSAL. Adding it to the wrong platform produces an AADSTS50011 redirect-mismatch error on sign-in.
Click Save.
4
Grant the managed identity access to your existing AI Foundry
Only if using existing Foundry
If you connected an existing Azure AI Foundry account during deployment, the managed identity needs permission to call the AI models. The template does not automatically set this up on resources outside the managed resource group.
Steps in Azure portal
a. Open your Azure AI Services resource → Access control (IAM) → Add role assignment.
b. Assign all three roles to the managed identity (id-<appName>-<env>) found in the managed resource group: Cognitive Services OpenAI Contributor Cognitive Services User Azure AI Developer
c. RBAC propagation can take up to 5 minutes. Restart the Container App afterwards.
5
Open the Container App URL and run your first scan
Navigate to the containerAppUrl in your browser. Sign in with your Microsoft Entra account, choose a radar (Cost / Capital-Intensive / Compliance), and trigger the scan. If sign-in fails with a redirect error, double-check the URI was added to the correct platform in step 3. If results come back empty, confirm step 2 has been completed.