Azure CSPM across every subscription, from Entra ID to NSG rules
Azure cloud security posture management has to follow Azure's hierarchy — management groups, subscriptions and resource groups — or it misses the subscription nobody remembered. Onam scans the scope you grant, from Entra ID conditional access and Defender for Cloud plan settings to NSG rules and Key Vault configuration, and re-checks every resource on every scan.
One platform on Azure
Connect Azure once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every Azure resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not Azure.
Posture, identity, attack paths, workloads and compliance for Azure. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which Azure billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for Azure.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in Azure today.
Services we monitor on Azure
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: Azure Firewall, API Management, Container Registry, Data Factory, Synapse, Service Bus, Event Hubs, and more.
Compliance frameworks
Onam maps every Azure finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Register an Azure app for Onam
Create a single-tenant app registration and assign it the built-in Reader and Security Reader roles at the management-group scope. No custom roles, no elevated permissions.
Grant tenant-wide read consent
One admin consent covers every subscription under the management group. Onam traverses the hierarchy automatically and inherits access to any new subscription without re-onboarding.
Findings from the first scan
Onam authenticates via workload identity federation — no client secrets to rotate — and scans every subscription, region, and Entra ID tenant in scope.
Azure in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on Azure
Management-group hierarchy traversal
Onboard at the root management group and Onam scans every descendant subscription — inherited policies, Azure Policy assignments, and lock hierarchies included. No missed subscriptions.
Entra ID conditional access analysis
Onam parses every conditional access policy, named location, and identity-protection rule. It surfaces gaps — MFA-exempted accounts, legacy-auth allowances, and privileged roles without CA coverage.
NIC-level network exposure mapping
NSG effective-rules resolution across subnet and NIC scopes, application security groups, and Azure Firewall policy — evaluated together so you see the actual path an attacker can take.
Questions we get a lot
Azure security — related reading
How the engines behind Azure coverage work, and what the categories actually mean.
Microsoft 365, SharePoint and Entra posture on the same graph.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your Azure environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.