Access & Security

Access Optimization

Find out who actually uses their permissions and who just has them. StratoLens correlates every role assignment with up to 365 days of Activity Log data, resolves Entra ID group memberships down to individual users, and flags exactly where access can be tightened.

Start free trial Request a demo

StratoLens is a self-hosted Azure visibility platform. It runs in your own tenant; your infrastructure data never leaves it.

The Problem

RBAC assignments pile up over time, and nobody cleans them. The result is a growing security and compliance risk that's invisible until an auditor asks about it:

Permission Sprawl: Users collect roles across projects and never lose them
Stale Access: Former team members and contractors keep access long after they should
Over-Privileged Users: People have Owner or Contributor when Reader would do
Hidden Group Access: Users inherit permissions through nested group memberships that are hard to trace
No Usage Evidence: You can see who has access, but not who actually uses it

The Solution

See which permissions are actually being used and which are just sitting there:

Unused Access: Zero activity in the selected time window, flagged for review.
Stale Permissions: No recent activity beyond a configurable threshold
Over-Privileged Roles: Critical roles (Owner/UAA) with no corresponding RBAC operations
Over-Scoped Assignments: Activity only in a small portion of the assigned scope
Excessive Sprawl: Same role duplicated across multiple subscriptions
Redundant Permissions: Duplicate access from hierarchy inheritance or group overlap

From the product

Inside Access Optimization

StratoLens access optimization dashboard showing Azure RBAC findings grouped by type, including over-privileged Owner access and stale permissions — The access optimization overview in the Contoso Financial demo environment, with findings grouped by type and an over-privileged Owner assignment surfaced at the top. Shown with demo-environment data.

Detail view of a service principal holding Owner at the root management group with zero recorded operations in the analysis window.

A former contractor account, visibly external from its #EXT# sign-in name, still holding Contributor on a production subscription and flagged as stale after months without activity.

Product demo

See it in action

Benefits

Key benefits

Detect completely unused access with zero activity in customizable time window

Identify stale permissions with configurable activity thresholds

Find over-privileged users with critical roles (Owner/UAA) but no RBAC operations

Discover over-scoped assignments

Track excessive role sprawl (same role across multiple subscriptions)

Flag redundant assignments from hierarchy inheritance, role supersession, or group overlap

Resolve group memberships to identify individual users with access through groups

View nested group chains showing the whole permission inheritance path

Use cases

Common use cases

Quarterly security audits to identify and remediate over-privileged access before auditors arrive

Compliance reporting for least-privilege enforcement and access certification

User offboarding verification, including group memberships

Continuous access reviews to maintain least-privilege as teams and projects evolve

Group membership cleanup to identify users who should be removed from Entra ID groups

Self-hosted

Runs in your tenant. Reads everything, changes nothing.

StratoLens deploys from the Azure Marketplace into your own tenant and scans your subscriptions over read-only Azure APIs. The data behind Access Optimization is collected and stored inside your tenant; there is no StratoLens cloud holding a copy.

Read-only scans via Azure management APIs
Every scan at rest in your tenant, never a vendor cloud
Deployed from the Azure Marketplace in under 15 minutes

Learn more about data residency and security architecture

Want the details?

Explore our documentation to see how Access Optimization works in detail.

Read Documentation View All Features

Start your 14-day free trial

Every feature unlocked. Deploys to your Azure tenant. No data leaves your tenant.

When the 14 days end, billing starts on your Azure invoice at your tier. One toggle in Settings turns it off, any time.

Start free trial

Request a demo

Not ready to install anything? Browse the Azure Footguns Database: 97 documented ways Azure quietly costs money or creates risk.