Idle resources
Unattached disks, public IPs and network cards, empty App Service plans, old snapshots, stopped-but-billed VMs, load balancers or gateways with nothing behind them, and private endpoints that lead nowhere or duplicate each other.
For Azure teams without a FinOps department
Find the Azure spend you don't need. Prove every euro of it.
SistaGuard reviews your Azure subscriptions with read-only access. It finds idle resources, oversized VMs, missed licence savings and backup gaps, and calculates each saving from your real costs. AI explains the findings in plain language. It never invents the numbers.
- Read-only Reader role
- Data stored in the EU
- 14-day free trial, no card
Example scan · Contoso3 open
- Spend this month
- €3,240
- Potential savings
- €122/ month≈ 4% of spend
Top actions
Resize vm-reporting-01 to D2s v5€61 / month
CPU peaked at 18% and memory at 41% over 30 days.Also flagged by Azure AdvisorDelete 2 unattached managed disks€38 / month
Based on what these disks actually cost in the last 30 days.Yearly backups kept 5 years, your limit is 1€23 / month
Compared with the retention limits set for your organisation.How it works
From sign-in to a ranked list in minutes
- 01
Connect
Sign in with Microsoft and give SistaGuard the Reader role on the subscriptions you choose. It can look, never change. Then prove each subscription is yours: add a sistaguard-verify tag with the code SistaGuard shows you and choose Verify access. You can remove the tag afterwards.
- 02
Scan
Run your first scan with one click. Every resource is checked against fixed rules, using 30 days of usage, your actual costs and Azure Advisor's findings. After that, scans run on a schedule.
- 03
Act
Get one prioritised list with calculated savings and a clear next step for each item. Mark items as in progress or resolved as your team works through them.
What it checks
The places Azure money quietly leaks
Right-sizing
30 days of CPU and memory usage per VM. Idle machines and oversized ones get a concrete smaller size, priced from Azure's public price list.
Licensing
Windows VMs, scale sets and SQL workloads that could use the Azure Hybrid Benefit licences you may already own.
Backups
Failed or outdated backups, paused protection and VMs with no backup at all. Geo-redundant vaults you may not need.
Security and access
Too many or too few subscription owners, over-privileged service principals, wildcard custom roles, open Key Vaults, and secrets, keys or certificates about to expire.
Cost outlook
This month's spend so far, Azure's month-end forecast against your budgets, and days when a service cost far more than usual.
Beyond Azure's own tools
Azure gives you four separate tools. SistaGuard gives you one list.
Azure's tools are good, and SistaGuard works alongside them. Each one answers a different question and expects someone with the time and expertise to put the answers together. SistaGuard does that for you.
Azure Advisor
General best-practice recommendations, with savings estimated from list prices.
SistaGuard imports Advisor's cost recommendations into the same list and marks where both agree. It adds its own checks, such as backup retention against your limits and gateways with nothing behind them, and calculates savings from what each resource actually cost you.
Azure Cost Management
Shows what you spend, forecasts the month and tracks budgets.
It tells you how much. SistaGuard tells you which resources to fix and what each fix is worth, and shows the forecast, your budgets and unusual cost days next to those fixes.
Microsoft Defender for Cloud
A full security posture and threat protection product.
SistaGuard doesn't replace it. It adds a few access and governance checks that often fall between teams, such as subscription owners, over-privileged service principals and expiring Key Vault items, and puts them in the same list as your costs.
Azure Policy
Enforces rules that you write and maintain.
Policy needs someone to decide the rules, write them and keep them current. SistaGuard tells you which basic policies are missing, which resources break the ones you have, and which exceptions never end. Its checks work from the first scan with no setup, and only report. They never block or change anything.
Numbers you can defend
Rules decide. AI only explains.
Every finding comes from a fixed, testable rule, and every saving shows how it was calculated. When there isn't enough data to put a number on it, SistaGuard says so instead of guessing.
- Actual cost
- What the resource really cost you in the last 30 days.
- Licence share
- The Windows or SQL licence part of the price, from Azure's public price list.
- Resize difference
- Current size minus the recommended size, at your region's prices.
- Not estimated
- Shown plainly when the data isn't there yet. No made-up figures.
Security
Exactly what SistaGuard can see, and how to take it back
Permissions: read-only
You sign in with Microsoft Entra ID and give SistaGuard the built-in Reader role on the subscriptions you choose, and only those. Reader can list and read. It cannot create, change, start, stop or delete anything. SistaGuard reaches Azure through a federated identity, so there is no password or client secret to leak.
Before the first scan, you add a sistaguard-verify tag with a one-time code to the subscription. Only someone who can change the subscription can add it, so nobody else can connect your subscription by typing its ID.
Where your data is stored
In Microsoft Azure, West Europe region. The database sits on a private network with no public access and is encrypted with a customer-managed key. The plain-language explanations are written by Anthropic's Claude, which receives resource names, types, sizes and the facts behind a finding, never tags, IP addresses or secret values.
What we collect
- Your resource inventory: names, types, regions, sizes, tags and configuration
- Daily costs per service, the month-end forecast and your budgets
- 30 days of CPU and memory usage for virtual machines
- Backup policies, jobs and protected items
- Role assignments on the subscription (IDs and role names)
- Key Vault item names and expiry dates
- Azure Advisor recommendations
- Your team's names and email addresses, and a log of actions in SistaGuard
What we never see
- The values of your secrets, keys or certificates
- Data inside your VMs, databases or storage accounts
- Your passwords
- Anything outside the subscriptions you connect
How to revoke access, at any time
- 1In the Azure portal, open the subscription, then Access control (IAM), and remove SistaGuard's Reader role.
- 2In Microsoft Entra ID, open Enterprise applications, select SistaGuard and delete it.
- 3Delete your data yourself in SistaGuard (Billing → Delete organization), or email support@sistaguard.com and we delete it within 30 days.
After step 1, SistaGuard can no longer read your subscription, usually within minutes. You don't need to ask us first.
Pricing
Every check in every plan
Plans differ only in how much you connect and how often it's checked. Start with a 14-day free trial, no card needed.
Starter
€99 / month
- 1 Azure tenant, up to 3 subscriptions
- Automatic scan once a day
- All checks and the cost outlook
- Unlimited team members
- Email support
Business
Recommended€349 / month
- Up to 3 Azure tenants and 15 subscriptions
- Automatic scan every 4 hours
- All checks and the cost outlook
- Unlimited team members
- Priority email support
Partner
€799 / month
- Unlimited tenants, up to 50 subscriptions
- Automatic scan every hour
- All checks and the cost outlook
- Unlimited team members
- Onboarding call and priority support
Prices exclude VAT. Run a scan by hand at any time on every plan. More than 50 subscriptions? Email support@sistaguard.com.
FAQ
Questions we get asked
Can SistaGuard change anything in my Azure?
No. It only has the Reader role, which can't create, change, start, stop or delete resources. Every fix is yours to make.
How is this different from Azure Advisor?
SistaGuard includes Advisor's cost recommendations, adds its own checks for backups, idle networking and licensing, and calculates savings from your actual costs instead of list prices. Everything appears in one prioritised list.
Where is my data, and who can see it?
In Azure West Europe, in an encrypted database on a private network. Only the people you invite to your organisation can see it in SistaGuard.
What does the AI do with my data?
It turns a finding into a plain-language explanation. It receives resource names, types, sizes and the facts behind the finding, never tags, IP addresses or secret values. It doesn't decide what's wrong or how much you save. Fixed rules do that.
How long does the first scan take?
Usually a few minutes for a typical subscription.
How long do you keep my data?
Scan history and findings for 12 months, daily cost data for 13 months, the history of resource changes (created, modified, deleted) for 13 months, records of resources deleted in Azure for 13 months, the audit log for 2 years, and team invitations for 30 days after they are used or expire; the newest scan of each subscription is always kept. If a trial or subscription ends, everything is deleted 90 days later. An admin can delete it all at once at any time, and backups are overwritten within 7 days.
How do I disconnect?
Remove SistaGuard's Reader role from the subscription and delete the SistaGuard enterprise application in Entra ID. Then delete your data in Billing → Delete organization, or email us. See "How to revoke access" above.
See what your subscription is costing you for nothing
Connect with read-only access and get your first results in minutes.
Run your first scan