The questions a security review asks, answered plainly.

Who in our organization must sign up?

An administrator of your Microsoft Entra tenant who holds Global Administrator or Privileged Role Administrator. The role must be active when they sign in: if it is only eligible through Privileged Identity Management, they activate it first. Personal Microsoft accounts are refused. Anyone else is asked to involve an administrator and gets a link they can share with them.

What exactly are we approving on the Microsoft consent screen?

Five read-only Microsoft Graph application permissions for the AuditGraph collector. Directory.Read.All: users, groups, applications, service principals, directory roles and the app consents your users have granted. Application.Read.All: app registrations, enterprise applications and their permissions. AuditLog.Read.All: sign-in activity and MFA registration (method types only, never phone numbers), which Microsoft returns only with Entra ID P1 or P2. RoleManagement.Read.All: Entra role definitions, assignments and Privileged Identity Management eligibility. Policy.Read.All: Conditional Access policies and security defaults; AuditGraph never creates, changes or deletes a policy. Every permission is read-only, and nothing secret is typed into AuditGraph: no password, key or client secret.

Does AuditGraph change anything in our tenant?

No, not on its own, and that is a permanent product decision. The only change is one your administrator makes at sign-up: granting AuditGraph's collector the read-only Azure Reader role, once, at the tenant root management group, so it covers every current and future subscription. The administrator can let AuditGraph make that one assignment with their own one-time sign-in, or run the copy-ready Azure CLI, PowerShell or portal steps themselves, or assign Reader only to selected subscriptions or management groups. You can remove the role at any time in Access control (IAM) at the tenant root management group. Fixes are always applied by your own team, with the steps and scripts AuditGraph provides.

• Microsoft Learn: remove an Azure role assignment

Does our administrator need elevated access at the tenant root?

Only to assign Reader there. Assigning a role at the tenant root management group needs User Access Administrator (or Owner) at the root. A Global Administrator gets it by turning on "Access management for Azure resources" in Microsoft Entra ID > Properties (Microsoft calls this elevate access); it takes effect within a few minutes. Once Reader is assigned, AuditGraph no longer needs it: turn it off again. During this step, on Microsoft's next screen, leave "Consent on behalf of your organization" unticked: AuditGraph only needs the administrator's one-time sign-in. Afterwards the administrator can also revoke the permission granted to the "AuditGraph Azure Setup" app in Enterprise applications; the Reader role stays.

• Microsoft's guide to elevate access (and remove it)
• Microsoft Learn: review and revoke permissions granted to an enterprise application

What does the free evaluation include, and what does it cost?

Evaluations open soon. Each one will be free for 14 days, with no credit card. It is read-only: you get the full identity graph, findings, attack paths and evidence for one Entra tenant, but workflow changes such as triage, risk acceptance and access reviews are not available. It includes 5 seats, the first scan and up to 3 rescans a day; there are no scheduled scans. Users sign in with their Microsoft work account; connecting your own identity provider for single sign-on needs a paid plan. Every customer will start here, and from day 10 the app shows an evaluation summary of what was found and what your team fixed.

What happens when the evaluation ends?

Unless you upgrade, the connection is closed and your data stays read-only for 7 days, with a notice when the evaluation ends and another the day before deletion. Then it is deleted automatically. To keep it, upgrade to a plan from inside the app before then. After the first scan, Plan & usage shows the identity band you would land in and its annual list price on each plan.

Can I extend my evaluation?

Ask us. Only AuditGraph staff can extend an evaluation, so if you need more time to finish your review, email auditgraph_sales@nexgenixlabs.com before the 14 days are up and we will look at it with you. There is no extension option to buy or switch on in the app.

How do I buy?

From inside the app. Every customer starts on the free evaluation; when you are ready, an Admin opens Plan & usage and chooses Upgrade on Essentials or Professional. The price is the annual list price of your own identity band, shown there from your real identity count. We send an order form and invoice you annually; no card is needed and nothing is charged automatically. For Enterprise, or more than 50,000 identities, contact sales.

Where is our data stored, and can we choose?

You will choose where your organization is created on the sign-up page, and each choice shows its residency statement before you confirm. Only regions open for sign-up are offered: the first is Microsoft Azure, Central US, and further regions open as they launch. AuditGraph stores no credential for your tenant. Questions you ask the Argus AI assistant are processed by Azure OpenAI global deployments, which may process prompts in any Azure region.

Can we use our own app registration instead of AuditGraph's multi-tenant app?

Self-service sign-up uses AuditGraph's multi-tenant collector app, which trusts AuditGraph through federation and holds no secret. If your policy does not allow multi-tenant apps, contact security@nexgenixlabs.com before you start and we will go through the options with you.

How do we revoke AuditGraph's access?

Delete or disable the AuditGraph collector enterprise application in Microsoft Entra, and remove its Reader role assignment at the tenant root management group. Once AuditGraph sees the revocation on two consecutive scans at least 6 hours apart, the connection is closed and collection stops. Removing only Reader stops Azure resource collection while Entra collection continues. Your data then stays read-only for 30 days and is deleted automatically, or an Admin chooses Delete now and a second Admin approves it.

What business risk does AuditGraph reduce?

The risk that an identity can reach far more than anyone intended. AuditGraph shows which human, non-human and AI identities can reach your most sensitive systems and data, through which roles, groups and trust relationships, and the attack paths an attacker could chain together. Each finding comes with its evidence and a guided fix, so your team can remove access it did not know existed before an attacker uses it.

How fast do we see value?

The first report arrives within minutes of the first scan after consent: your Tier-0 holders, over-privileged service principals and attack paths. How long a scan takes depends on the size of your tenant.

How is it different from Entra ID Governance, Defender or a CSPM?

AuditGraph answers one question across your estate: what can each identity actually reach? It computes reach and attack paths across human, non-human and AI identities from your Entra and Azure configuration, and shows the evidence for every hop. It is read-only and configuration-based: it does not need your logs, does not run access reviews and does not detect live attacks, so it works alongside the tools you already run.

What can I show the board?

The executive briefing for each published scan: the overall verdict, the key numbers and how they moved since the previous scan, the decisions waiting on you, and what changed. Every number opens the identities and evidence behind it, and a value AuditGraph has not evidenced is never shown.

Is our data used to train AI models?

No. Your data is never used to train AI models. The Argus assistant runs on Azure OpenAI in our own Azure subscription, which does not use customer data to train models.

How is my price calculated?

By plan and identity band. Your band is set by the unique identities you own and govern, counted once across every connected cloud. Essentials starts at $9,000 a year and Professional at $15,000 a year for up to 2,500 identities; at 10,000 identities they are $24,000 and $38,000 a year. Every plan includes one environment; each additional tenant or cloud organization is $4,000 a year on Essentials and Professional. Nothing is charged per subscription, per resource or per finding, and there is no automatic overage.

Does AuditGraph make us compliant?

No. It gives you evidence for controls, not compliance with them. AuditGraph maps its identity checks to ISO/IEC 27001:2022, SOC 2, PCI DSS v4.0.1, NIST CSF 2.0, NIST SP 800-53 Rev. 5, CIS Controls v8, MAS TRM, RBI IT Directions, DORA, NIS2, the ACSC Essential Eight, HIPAA, SOX ITGC, GDPR and CCPA. For each control it states whether its evidence covers the control (evidenced), part of it (partial, with what is missing), or none of it (not observed). Your auditor decides.

Can auditors trust the evidence?

Every report is built from one dated, published scan. Each scan's run manifest is signed with an AuditGraph key held in Azure Key Vault, the raw responses behind it are kept, and the signature can be verified in AuditGraph. Each statement links to the evidence record it rests on, so an auditor can trace a conclusion back to the configuration that produced it.

What can't AuditGraph evidence?

Anything outside cloud identity configuration, for example HR processes, physical access, logging configuration, password policy and account sharing. Those controls are listed as not observed and need your own evidence. AuditGraph also does not know which systems are in your regulated scope, so its evidence covers the connected estate.

How are exceptions handled?

As a risk acceptance in AuditGraph: the requester gives a reason and an expiry date, and a second, different member approves or declines it. Every request and decision is kept in the audit history. Risk acceptance is part of guided remediation on every paid plan; the evaluation is read-only.

How long is history kept?

14 days on the evaluation, 90 days on Essentials, 1 year on Professional, and as contracted on Enterprise (at least 1 year). Your organization's audit history (sign-ins, member and settings changes, exports) is kept for 400 days.

Can AuditGraph alert us to risky changes?

Yes. After each scan it can alert you when a privileged role is assigned or removed, an account is disabled or re-enabled, a new identity appears with access, a guest gains privileged access, or a new credential is added to a privileged identity. Alerts go to email, Slack, Microsoft Teams or a webhook, on every plan including the evaluation.

How often does AuditGraph scan, and how quickly do alerts arrive?

Your plan sets the schedule: daily on Essentials, every 4 hours on Professional, and as contracted on Enterprise (at least every 4 hours). On-demand rescans are limited per day by plan, and the evaluation has no scheduled scans. Alerts are sent right after the scan that observes a change, so the delay is your scan cadence: AuditGraph compares scans and does not watch your directory in real time.

Do we need to send AuditGraph our logs or connect a SIEM?

No. AuditGraph reads configuration through read-only APIs and needs none of your logs. If you want its findings in your own tools, Professional and Enterprise export them to Azure Monitor and Microsoft Sentinel, Splunk, Datadog, Elastic and Sumo Logic.

Is AuditGraph an incident detection tool?

No. It shows risky configuration: who can reach what, and how. Where your licensing allows, it adds observed sign-in activity and keeps the two apart, so a dormant identity with standing access is reported as risk, not as an incident. Keep your detection tools for live attacks.

Can AuditGraph tell us who made a change?

Not today. Change alerts say what changed and in which scan it was observed, not who made it: that needs your directory audit log. Your Entra audit logs remain the source for the actor.

What does AuditGraph read, and what does it never read?

It reads identity and access configuration: users, guests, groups and memberships, Entra roles and assignments, app registrations, enterprise applications and service principals with their owners and permissions, credential metadata (names, key ids, expiry dates, never the values), Conditional Access policies, and sign-in activity and MFA registration where Entra ID P1 or P2 makes them available. In Azure it reads the management-group hierarchy, subscriptions, resources, role definitions and role assignments. It never reads passwords, secret values, private keys or access keys, and never reads mail, files or other business data. It needs no agent and no inbound connection.

How are attack paths computed?

From grants and relationships in the collected configuration: role assignments, group membership, ownership, app permissions and trust relationships. A versioned rule set defines each hop an identity can take to gain another identity's access, and AuditGraph chains hops up to 4 deep. Every hop shows the evidence it rests on. Paths are labelled as candidates derived from configuration: AuditGraph does not claim a path was used or tested.

Does it handle groups, inheritance and PIM?

Yes. Access is resolved whether it is direct, derived from group membership, or inherited from a higher scope such as a management group. Entra role eligibility through Privileged Identity Management (which needs Entra ID P2) is shown separately from active assignments. Azure resource PIM eligibility, deny assignments and Azure Policy are not collected yet, so for Azure AuditGraph can show more access than Azure would allow, never less.

Can we test a fix before we make it?

Yes, on Professional and Enterprise. The what-if simulator models a change, for example removing a role assignment, and recomputes the attack paths with the same rules to show which ones it would close. The result is labelled modeled, and nothing changes in your tenant.

Which clouds and directories are supported?

Microsoft Entra ID and Azure are generally available. AWS and GCP are on the roadmap: they join your plan as they are released, and we do not sell coverage before it ships. On-premises Active Directory is planned through an outbound-only, read-only collector, starting as a pilot; it is not available yet.

What access does AuditGraph need?

Read-only access only: admin consent to five read-only Microsoft Graph permissions for the AuditGraph collector, and the Azure Reader role (Log Analytics Reader is optional) at the tenant root management group or at the scopes you choose. You can review and remove both in your own portal. No agent and no write permission, on any plan. AuditGraph never changes your tenant on its own: your team applies every fix with the steps and scripts AuditGraph provides, and on Professional and Enterprise each fix can be tracked as a Jira, ServiceNow or Azure DevOps ticket that AuditGraph verifies on the next scan.

Can we see what AuditGraph does in our tenant?

Yes. AuditGraph's sign-ins appear in your Entra service-principal sign-in logs. With Microsoft Graph activity logs enabled (Entra ID P1 or higher), every Microsoft Graph call it makes is recorded too.

How does AuditGraph authenticate to our tenant, and what credentials does it hold?

Through workload identity federation: the collector app trusts AuditGraph's managed identity, so there is no client secret or certificate to steal, and the short-lived tokens it obtains are held only in memory. AuditGraph holds no credential for your tenant. Platform secrets are kept in Azure Key Vault Premium (HSM-backed) with purge protection, and each scan's run manifest is signed with a Key Vault key. Secrets you choose to add for integrations, such as a Splunk token, are stored in Key Vault, never in the database.

How are customers kept apart?

Every tenant table is protected by forced row-level security in the database, and every query also states the organization explicitly. Your organization's scope comes from your signed-in session, never from request parameters, and cross-organization tests run on every change.

How is outbound traffic controlled?

Outbound traffic leaves through NAT gateways with static public IPs, which we share on request, and is limited by network rules and an application outbound guard (HTTPS only, private and reserved networks blocked). Firewall-based egress control with an allowlist of provider APIs is planned for the production release.

Can NexgenixLabs staff see our data?

Only through a time-limited access grant that your administrator approves. Staff use a separate console protected by Entra Conditional Access (phishing-resistant MFA, a compliant device and roles activated through PIM), and every access is recorded and visible to your administrators.

How do our users sign in to AuditGraph?

With single sign-on only: your Microsoft Entra work account on every plan, or your own OIDC or SAML 2.0 identity provider (for example Okta, Ping or AD FS) on paid plans. SCIM 2.0 provisioning is available from Professional. There are no AuditGraph passwords.

How is our data deleted?

A purge deletes your organization's data and the secrets stored for it, verifies the deletion and records it in the audit trail. It needs two people: one Admin requests it and a different Admin approves it (where an organization has a single Admin, NexgenixLabs staff approve). Database backups that still hold the data expire under the documented backup retention of 35 days. Per-organization key shredding is planned.

Will you tell us about a breach?

We notify affected customers within 72 hours of confirming a breach that affects their data; terms are set in your agreement.

Is AuditGraph certified?

Not yet. AuditGraph has not completed a SOC 2 audit, an ISO 27001 certification or an external penetration test; SOC 2 Type II and ISO 27001 are planned. A security questionnaire, an architecture overview and our egress IPs are available on request at security@nexgenixlabs.com.

Which frameworks is the risk model based on?

The identity risk model follows NIST SP 800-30 (likelihood and impact) and NIST SP 800-53, with CIS Controls v8 and MITRE ATT&CK for attack techniques. Evidence for compliance frameworks is described under GRC above: evidence for controls, not compliance with them.

We run Azure, AWS and GCP. Do we pay per cloud?

No. Price depends only on identity count, and an identity that appears in more than one cloud counts once. Every plan includes one Entra tenant, and one AWS organization and one GCP organization as those connectors are released. Plans are Azure and Entra ID today; we sell AWS and GCP coverage only once it ships.

What happens if we exceed our band?

Discovery keeps running and no finding is hidden. Your admin sees the count and the rule used, and you get 60 days or until renewal, whichever is later. Any band change is agreed with you; we never charge automatically.

Can we buy through Azure Marketplace?

Not yet. Today we contract directly. An Azure Marketplace private offer is planned once the purchase route and MACC eligibility are confirmed; ask us if it matters for your procurement.

Do renewal prices go up?

Renewal increases are capped at 5% a year, excluding band changes you agree to. If your identity count falls, you move down a band at renewal.

Is there a monthly option?

No. Plans are annual and invoiced upfront, with an order form; there is no card payment. Multi-year terms are discounted: 8% off for 2 years and 15% off for 3 years, invoiced annually.

Do you offer nonprofit or education pricing?

Yes. Nonprofit and education organizations get 20% off list price.