Question 1

What is StratoLens?

Accepted Answer

StratoLens is a self-hosted Azure visibility platform. It scans your Azure environment to provide visibility into resources, RBAC assignments, costs, and changes over time, through a web dashboard running in your own tenant.

Question 2

How does StratoLens work?

Accepted Answer

StratoLens deploys entirely within your own Azure environment. Once installed, it automatically scans your infrastructure on a schedule you configure, storing all data in your Azure subscription. You access the dashboard through your browser, authenticating with your existing Entra ID credentials.

Question 3

Is my data safe?

Accepted Answer

Yes. StratoLens runs entirely in your Azure environment, so your data never leaves your subscription. There is no data exfiltration to external servers. You maintain full control over your data, including retention policies and access controls.

Question 4

What Azure resources are deployed?

Accepted Answer

Resource Group (contains all StratoLens resources) Container Apps Environment with Log Analytics Container App (web dashboard, scales to zero when idle) Container App Job (scheduled scanner) Cosmos DB (serverless, stores scan data) Key Vault (secrets management) User-Assigned Managed Identity

Question 5

Can I deploy to any Azure region?

Accepted Answer

Yes, you can deploy StratoLens to any Azure region that supports Container Apps and Cosmos DB. Choose a region close to your primary infrastructure for optimal performance.

Question 6

Can StratoLens scan multiple subscriptions?

Accepted Answer

Yes. A single StratoLens deployment can scan any subscriptions or management groups that the managed identity has access to. By default, during installation, the managed identity is granted Reader access to the tenant root management group, allowing it to discover your entire environment. You can modify this scope after installation if you prefer to limit access to specific management groups, subscriptions, or resource groups. Currently, each deployment supports one Azure tenant.

Question 7

Isn't self-hosted more maintenance?

Accepted Answer

No. StratoLens ships as an Azure Managed Application that keeps itself current: updates are delivered automatically in the app, so there's no patching, no upgrade windows, and no maintenance tasks. You get the data-sovereignty benefits of self-hosting without the operational overhead, and the infrastructure it runs on typically costs less than $1 per day (see "How much does it cost to run StratoLens?" below).

Question 8

How do updates work?

Accepted Answer

Updates are delivered automatically in the app. StratoLens checks for new versions and installs them on its own, with nothing to download or patch. The entire update process runs inside your tenant. If you prefer manual control, automatic updates can be disabled.

Question 9

How much does it cost to run StratoLens?

Accepted Answer

Most customers see infrastructure costs of less than $1 per day. The primary cost driver is Cosmos DB, which uses the serverless (consumption) plan, so you only pay for what you use. Actual costs depend on your environment size and scan frequency. Larger environments with more frequent scans will have higher storage and compute costs.

Question 10

How often does StratoLens scan my infrastructure?

Accepted Answer

Scan frequency is fully configurable. The recommended setting is every 4-8 hours for most environments. You can configure scans as frequently as every hour if needed. More frequent scans provide fresher data but increase costs slightly.

Question 11

How long is scan data retained?

Accepted Answer

Data retention is configurable by you. You can set retention policies for scan history, change tracking, and other data types based on your compliance and operational needs.

Question 12

How much does StratoLens licensing cost?

Accepted Answer

StratoLens starts with a 14-day free trial: every feature, no restrictions. After the trial, your plan is automatically determined by the number of Azure resources you monitor. Visit our Pricing page for full plan details and tier breakdowns.

Question 13

How do I enable or disable billing?

Accepted Answer

It's a single click. Navigate to Settings → General in the StratoLens application and toggle billing on or off whenever you need to. No support tickets, no waiting. You're in full control. See the Manage Billing quick start for a step-by-step walkthrough.

Question 14

How does billing work?

Accepted Answer

Billing occurs automatically through your Azure subscription via the Azure Marketplace. There's no separate invoice or payment method to manage. StratoLens simply appears as a line item on your regular monthly Azure bill.

Question 15

When does billing start?

Accepted Answer

Billing begins at the end of your 14-day free trial, based on the size of your environment. Billing is enabled by default; you can disable it at any time on the Settings → General page, where your upcoming price and billing date are displayed alongside the toggle.

Question 16

What happens to my data when my license expires?

Accepted Answer

If billing is enabled, your license automatically renews and StratoLens keeps scanning without interruption. If billing is disabled and your license expires, your data is still safe. All previously discovered resources, scan history, and configurations remain fully accessible in your environment. Nothing is deleted or locked away. The only feature that gets disabled is the scanner, meaning no new scans can run until you renew. Your existing data will gradually become stale, but everything discovered while your license was active stays in place and remains browsable.

Question 17

Is there a free trial?

Accepted Answer

Yes. StratoLens comes with a 14-day free trial that includes every feature, with no restrictions and no feature gates. It's fully try before you buy, so you can explore the whole platform and see the value before committing.

Question 18

Do all plans include the same features?

Accepted Answer

Yes. Every StratoLens plan includes full access to every feature. There are no feature limitations or premium add-ons. The only difference between plans is the scale of your environment (number of resources).

Question 19

How is my plan determined?

Accepted Answer

Your plan is automatically determined based on the number of Azure resources that StratoLens discovers during its regular scans. There's nothing to configure. Your billing tier always reflects the actual size of the environment you're monitoring.

Question 20

Can I filter which subscriptions StratoLens monitors to reduce my billing tier?

Accepted Answer

Yes. You choose which Azure subscriptions StratoLens monitors: from the Settings screen, select or deselect individual subscriptions. You're only billed for the resources StratoLens actively monitors. Resources in subscriptions you filter out won't count toward your plan limits. This means you can start with just the subscriptions that matter most and adjust at any time as your needs change.

Question 21

Can I change my plan?

Accepted Answer

Plans are automatically determined by the size of your monitored environment, so there's no manual upgrade or downgrade process.

Question 22

What happens if I exceed my plan limits?

Accepted Answer

You'll be automatically upgraded to the next tier that fits your environment. There's no disruption to your service. StratoLens keeps running, and your billing adjusts to reflect the new plan.

Question 23

What permissions does StratoLens require?

Accepted Answer

StratoLens follows the principle of least privilege. The managed identity requires: Reader access to scan your Azure resources (read-only, no write access) Contributor access only to its own Container Apps (for self-updates) Microsoft Graph read permissions for user and group information (for RBAC analysis) Access is always read-only for your infrastructure. StratoLens cannot modify your resources, with the exception of its own containers for self-updating purposes.

Question 24

Can I limit what StratoLens can see?

Accepted Answer

Yes. By default, the managed identity is given Reader access at the tenant root management group, allowing it to discover your entire environment. However, you can scope this down to specific management groups, subscriptions, or even resource groups. StratoLens will automatically discover and scan only what it has access to.

Question 25

What identities are created during installation?

Accepted Answer

Three identities are created: User-Assigned Managed Identity: Used by the scanner to read your Azure resources and store data. Has no interactive login capability. App Registration: Enables users to sign in to the StratoLens dashboard using their Entra ID credentials. The installing user is automatically granted access. Notifications App Registration: Used for sending email notifications from StratoLens.

Question 26

How do users access StratoLens?

Accepted Answer

Users authenticate using their existing Entra ID credentials. The administrator who installs StratoLens is automatically granted access and can then grant access to other users or groups through the StratoLens admin interface.

Question 27

What information does StratoLens collect from my Azure environment?

Accepted Answer

StratoLens only scans the control plane of Azure: the metadata and configuration of your resources. It never accesses the data plane, meaning it never reads or stores the actual data inside your resources. All collected data remains in your Azure subscription. What StratoLens collects: Resource names, types, locations, and configurations RBAC role assignments and permissions Cost and billing metadata Network topology and connectivity Tags and resource group organization What StratoLens never collects: Files or blobs inside Storage Accounts Data stored in databases (SQL, Cosmos DB, etc.) Contents of managed disks or virtual machines Secrets, keys, or certificates from Key Vault Any property flagged as a secret by Azure (VM passwords, storage account keys, connection strings, etc.) In short: StratoLens sees what resources you have and how they're configured, but never the data inside them.

Question 28

What data does StratoLens send externally?

Accepted Answer

StratoLens communicates with our licensing system to validate your installation. The following information is transmitted: Data Description Installation ID Unique anonymous identifier for your StratoLens installation (UUID) Tenant ID Your Azure tenant identifier (UUID) Subscription Count Number of Azure subscriptions in your environment (count only) Resource Count Total number of resources discovered (count only, determines your billing tier) Last Successful Scan Timestamp of your most recent scan completion StratoLens Version Version of StratoLens you are running Company Name Your company name (if configured in Settings) Contact Email Your contact email (if configured in Settings) Billing Contact Your billing contact email (if configured in Settings) No infrastructure data is transmitted: no resource names, no subscription names, no resource group names, no configuration details. Your actual Azure environment data stays entirely within your subscription.

Question 29

Does StratoLens collect usage metrics or send error reports?

Accepted Answer

By default, StratoLens collects anonymous usage metrics and sends error reports to help us improve the product and identify issues. Usage metrics include aggregated feature usage patterns and performance data, never any identifying information about your Azure resources or infrastructure. Error reports are sent to our licensing server when issues occur. Due to the nature of how Azure reports these errors, they may occasionally include subscription IDs, but never contain sensitive data such as resource configurations, secrets, or any data plane information. We also collect scanner performance metrics to help identify and resolve performance bottlenecks. This includes how long each scanning phase takes (in milliseconds), the count of items processed in each phase, and whether each phase completed successfully. This data contains no identifying information: no subscription IDs, resource names, or tenant details. Only aggregate durations and counts are collected. If you prefer to opt out, all usage metrics and error reporting can be disabled system-wide with a toggle on the Settings page. For a full breakdown of all data collected, see our Application Privacy Policy.

Question 30

How do I get help?

Accepted Answer

Support is provided via email at contact@getstratolens.com. We read every message and aim to respond as quickly as possible.

Question 31

Is there a community forum or chat?

Accepted Answer

Yes. Join our Discord community to compare notes with other operators and talk directly with the founders. It's the fastest way to reach us.

Frequently Asked Questions

General

Deployment & Infrastructure

Costs

Pricing & Billing

Permissions & Security

Support