Access & Security

Role Assignments

Principal-centric RBAC auditing for your entire Azure environment. View all users, groups, and service principals with their role assignments categorized by privilege level.

Start free trial Request a demo

StratoLens is a self-hosted Azure visibility platform. It runs in your own tenant; your infrastructure data never leaves it.

The Problem

Azure's native RBAC view makes it hard to answer "who has access to what":

Resource-Centric Only: You can see who has access to a specific resource, but not what a specific user can access
Manual Navigation: Auditing permissions across subscriptions requires checking each scope individually
No Risk Visibility: There's no easy way to identify over-privileged users or service principals

The Solution

StratoLens Role Assignments provides a principal-centric view of all RBAC assignments:

Principal-Centric View: Start with users, groups, or service principals and see every resource they can access
Privilege Categorization: Assignments categorized by risk level (Critical, Management, Read)
Instant Filtering: Filter by principal type, privilege level, or scope type with instant results

From the product

Inside Role Assignments

StratoLens principal-centric RBAC view showing a legacy Azure service principal with Owner role assignments across many subscriptions, flagged at Critical privilege level — The principal-centric view in the Contoso Financial demo environment opened on a legacy deployment service principal holding Owner on the root management group and a dozen subscriptions, all granted back in 2021. Shown with demo-environment data.

The estate summary categorizing every role assignment by privilege level, making the Critical slice visible at a glance.

Filtering the whole environment down to admin-level roles, the fastest way to answer who holds Owner and where.

Benefits

Key benefits

Answer "who has access to what" across all Azure resources, from one view

Identify over-privileged users with privilege-level badges

Filter by principal type (User, Group, Service Principal)

Filter by privilege level for risk-based auditing

Use cases

Common use cases

Security audits to identify over-privileged users

Service principal audit to discover apps with elevated permissions

Compliance reporting for access reviews

Self-hosted

Runs in your tenant. Reads everything, changes nothing.

StratoLens deploys from the Azure Marketplace into your own tenant and scans your subscriptions over read-only Azure APIs. The data behind Role Assignments is collected and stored inside your tenant; there is no StratoLens cloud holding a copy.

Read-only scans via Azure management APIs
Every scan at rest in your tenant, never a vendor cloud
Deployed from the Azure Marketplace in under 15 minutes

Learn more about data residency and security architecture

Want the details?

Explore our documentation to see how Role Assignments works in detail.

Read Documentation View All Features

From the Blog

Auditing Azure RBAC: Finding the Role Assignments Nobody Remembers Granting

Azure role assignments accumulate quietly and outlive their reasons. How to inventory them with Resource Graph, and where the manual audit falls short.

Read the article

Start your 14-day free trial

Every feature unlocked. Deploys to your Azure tenant. No data leaves your tenant.

When the 14 days end, billing starts on your Azure invoice at your tier. One toggle in Settings turns it off, any time.

Start free trial

Request a demo

Not ready to install anything? Browse the Azure Footguns Database: 97 documented ways Azure quietly costs money or creates risk.