Read-only, always: AuditGraph never changes your tenant on its own.

No, not on its own, and that is a permanent product decision. The only change is one your administrator makes at sign-up: granting AuditGraph's collector the read-only Azure Reader role, once, at the tenant root management group, so it covers every current and future subscription. The administrator can let AuditGraph make that one assignment with their own one-time sign-in, or run the copy-ready Azure CLI, PowerShell or portal steps themselves, or assign Reader only to selected subscriptions or management groups. You can remove the role at any time in Access control (IAM) at the tenant root management group. Fixes are always applied by your own team, with the steps and scripts AuditGraph provides.

• Microsoft Learn: remove an Azure role assignment

You will choose where your organization is created on the sign-up page, and each choice shows its residency statement before you confirm. Only regions open for sign-up are offered: the first is Microsoft Azure, Central US, and further regions open as they launch. AuditGraph stores no credential for your tenant. Questions you ask the Argus AI assistant are processed by Azure OpenAI global deployments, which may process prompts in any Azure region.

Delete or disable the AuditGraph collector enterprise application in Microsoft Entra, and remove its Reader role assignment at the tenant root management group. Once AuditGraph sees the revocation on two consecutive scans at least 6 hours apart, the connection is closed and collection stops. Removing only Reader stops Azure resource collection while Entra collection continues. Your data then stays read-only for 30 days and is deleted automatically, or an Admin chooses Delete now and a second Admin approves it.

No. Your data is never used to train AI models. The Argus assistant runs on Azure OpenAI in our own Azure subscription, which does not use customer data to train models.

Your plan sets the schedule: daily on Essentials, every 4 hours on Professional, and as contracted on Enterprise (at least every 4 hours). On-demand rescans are limited per day by plan, and the evaluation has no scheduled scans. Alerts are sent right after the scan that observes a change, so the delay is your scan cadence: AuditGraph compares scans and does not watch your directory in real time.

It reads identity and access configuration: users, guests, groups and memberships, Entra roles and assignments, app registrations, enterprise applications and service principals with their owners and permissions, credential metadata (names, key ids, expiry dates, never the values), Conditional Access policies, and sign-in activity and MFA registration where Entra ID P1 or P2 makes them available. In Azure it reads the management-group hierarchy, subscriptions, resources, role definitions and role assignments. It never reads passwords, secret values, private keys or access keys, and never reads mail, files or other business data. It needs no agent and no inbound connection.

Read-only access only: admin consent to five read-only Microsoft Graph permissions for the AuditGraph collector, and the Azure Reader role (Log Analytics Reader is optional) at the tenant root management group or at the scopes you choose. You can review and remove both in your own portal. No agent and no write permission, on any plan. AuditGraph never changes your tenant on its own: your team applies every fix with the steps and scripts AuditGraph provides, and on Professional and Enterprise each fix can be tracked as a Jira, ServiceNow or Azure DevOps ticket that AuditGraph verifies on the next scan.

Microsoft Entra ID and Azure are generally available. AWS and GCP are on the roadmap: they join your plan as they are released, and we do not sell coverage before it ships. On-premises Active Directory is planned through an outbound-only, read-only collector, starting as a pilot; it is not available yet.

Yes. AuditGraph's sign-ins appear in your Entra service-principal sign-in logs. With Microsoft Graph activity logs enabled (Entra ID P1 or higher), every Microsoft Graph call it makes is recorded too.

Through workload identity federation: the collector app trusts AuditGraph's managed identity, so there is no client secret or certificate to steal, and the short-lived tokens it obtains are held only in memory. AuditGraph holds no credential for your tenant. Platform secrets are kept in Azure Key Vault Premium (HSM-backed) with purge protection, and each scan's run manifest is signed with a Key Vault key. Secrets you choose to add for integrations, such as a Splunk token, are stored in Key Vault, never in the database.

Every tenant table is protected by forced row-level security in the database, and every query also states the organization explicitly. Your organization's scope comes from your signed-in session, never from request parameters, and cross-organization tests run on every change.

Outbound traffic leaves through NAT gateways with static public IPs, which we share on request, and is limited by network rules and an application outbound guard (HTTPS only, private and reserved networks blocked). Firewall-based egress control with an allowlist of provider APIs is planned for the production release.

Only through a time-limited access grant that your administrator approves. Staff use a separate console protected by Entra Conditional Access (phishing-resistant MFA, a compliant device and roles activated through PIM), and every access is recorded and visible to your administrators.

With single sign-on only: your Microsoft Entra work account on every plan, or your own OIDC or SAML 2.0 identity provider (for example Okta, Ping or AD FS) on paid plans. SCIM 2.0 provisioning is available from Professional. There are no AuditGraph passwords.

A purge deletes your organization's data and the secrets stored for it, verifies the deletion and records it in the audit trail. It needs two people: one Admin requests it and a different Admin approves it (where an organization has a single Admin, NexgenixLabs staff approve). Database backups that still hold the data expire under the documented backup retention of 35 days. Per-organization key shredding is planned.

We notify affected customers within 72 hours of confirming a breach that affects their data; terms are set in your agreement.

Not yet. AuditGraph has not completed a SOC 2 audit, an ISO 27001 certification or an external penetration test; SOC 2 Type II and ISO 27001 are planned. A security questionnaire, an architecture overview and our egress IPs are available on request at security@nexgenixlabs.com.

The identity risk model follows NIST SP 800-30 (likelihood and impact) and NIST SP 800-53, with CIS Controls v8 and MITRE ATT&CK for attack techniques. Evidence for compliance frameworks is described under GRC above: evidence for controls, not compliance with them.