Access Optimization

Find out who actually uses their permissions and who just has them. StratoLens correlates every role assignment with up to 365 days of Activity Log data, resolves Entra ID group memberships down to individual users, and flags exactly where access can be tightened.

StratoLens is a self-hosted Azure visibility platform. It runs in your own tenant; your infrastructure data never leaves it.

The Problem

RBAC assignments pile up over time, and nobody cleans them. The result is a growing security and compliance risk that's invisible until an auditor asks about it:

Permission Sprawl: Users collect roles across projects and never lose them
Stale Access: Former team members and contractors keep access long after they should
Over-Privileged Users: People have Owner or Contributor when Reader would do
Hidden Group Access: Users inherit permissions through nested group memberships that are hard to trace
No Usage Evidence: You can see who has access, but not who actually uses it

The Solution

See which permissions are actually being used and which are just sitting there:

Unused Access: Zero activity in the selected time window, flagged for review.
Stale Permissions: No recent activity beyond a configurable threshold
Over-Privileged Roles: Critical roles (Owner/UAA) with no corresponding RBAC operations
Over-Scoped Assignments: Activity only in a small portion of the assigned scope
Excessive Sprawl: Same role duplicated across multiple subscriptions
Redundant Permissions: Duplicate access from hierarchy inheritance or group overlap

See It In Action

Key Benefits

Detect completely unused access with zero activity in customizable time window

Identify stale permissions with configurable activity thresholds

Find over-privileged users with critical roles (Owner/UAA) but no RBAC operations

Discover over-scoped assignments

Track excessive role sprawl (same role across multiple subscriptions)

Flag redundant assignments from hierarchy inheritance, role supersession, or group overlap

Resolve group memberships to identify individual users with access through groups

View nested group chains showing the whole permission inheritance path

Common Use Cases

Quarterly security audits to identify and remediate over-privileged access before auditors arrive

Compliance reporting for least-privilege enforcement and access certification

User offboarding verification, including group memberships

Continuous access reviews to maintain least-privilege as teams and projects evolve

Group membership cleanup to identify users who should be removed from Entra ID groups

Want the Details?

Explore our documentation to see how Access Optimization works in detail.

Read Documentation View All Features

Start Your 28-Day Free Trial

Every feature unlocked. Deploys to your Azure tenant. No data leaves your tenant.

Available now on the Azure Marketplace.

Start free trial

Not ready to install anything? Browse the Azure Footguns Database: 55+ documented ways Azure quietly costs money or creates risk.

Request a demo

StratoLens catches the cost waste, access risk, and config drift across your whole Azure estate, from inside your own tenant, so your data never leaves it.