What can this identity actually reach?
GANot what its role is called. Not what scope string it was assigned. What it can reach once inheritance, group nesting, federation, and PIM eligibility have all resolved.
A scope string names one thing.
It grants far more.
Give an identity Owner at a subscription and the assignment names exactly one object: the subscription. Every resource group beneath it, and every resource beneath those, is now reachable — and none of them appear anywhere in the assignment.
A graph that draws an edge only where an assignment literally names a resource is inheritance-blind. It will show you a handful of nodes for an identity that can in fact reach thousands. The picture looks reassuring precisely because it is incomplete.
AuditGraph resolves the scope hierarchy before it draws anything. Reach is computed, not transcribed.
Illustrative structure. Databricks and SQL rarely appear in an assignment by name — they arrive by inheritance, which is exactly why they get missed.
Expandable, attributed, and honest about its edges.
Radial, expandable exploration
Start at any identity and open the estate outward one ring at a time — subscription, resource group, resource. The graph does not dump ten thousand nodes and call it visibility.
Peer counts at every scope
Each node carries how many other identities reach it. Not summed from the layer below — computed at that scope, because overlapping reach does not add up.
How they got in, not just that they did
Every edge is attributed: direct assignment, group membership, inherited scope, federated trust, or PIM-eligible activation. An unattributed edge is not drawn.
Resource-type aware
Storage, SQL, Key Vault, Databricks, Cognitive Services, and the rest of the tiered type catalog — classified by what a compromise of each would actually cost.
Non-human and AI identities are first class
Service principals, managed identities, workload and CI/CD identities, and AI agents appear on the same canvas as humans, with the same reach maths applied.
Every node drills to evidence
From any node: the assignment, the scope string, the role definition, the classification source. The graph is the evidence layer — the conclusion lives above it.
The graph is the evidence.
Never the headline.
A competitor can compute a reachability graph. Reachability is hard engineering, but it is not a moat — it is table stakes that most products have not yet paid.
The part that is difficult to copy is the layer above: turning a traversal into a business conclusion a CISO can act on and an auditor can check. So the graph never leads. It is what you open when you want to know why we said what we said.
Bring your own tenant.
The fastest way to see whether your current picture is inheritance-blind is to compare it against a resolved one. That is what the assessment does.
Free forever on a bounded estate · 30-day trial unlocks everything · No credit card
Read-only access · No agents · No log ingestion · Azure generally available