Monitoring
Cloud monitoring
inline reads the posture, health and spend of your cloud subscriptions and turns what it sees into a prioritized list. Connecting one is a single pasted command, and the access it grants is read-only.
Connecting a subscription is an admin task, and it needs someone with Owner on the subscription itself (or User Access Administrator plus Tag Contributor, since the script tags the subscription to its connection). Everyone with cloud access can read the cloud findings.
#Connecting a subscription
Connections
Read-only links to your cloud subscriptions. Setup is one pasted command — inline never holds a credential for your tenant.
| Connection | Status | Open findings | Last scan | Next scan |
|---|---|---|---|---|
| Production subscription | active | 4 | +1 / −2 | in 6h |
| Staging subscription | active | — | +0 / −0 | in 6h |
| Sandbox subscription | pending setup | — | — | — |
Grant read-only access
az ad sp create --id "$APP_ID"
az role assignment create --assignee "$APP_ID" --role "Monitoring Reader"
az role assignment create --assignee "$APP_ID" --role "Security Reader"
Choose Connect subscription and name it.
The Display name is what you will see in the table, so name it the way your team refers to the subscription.Paste in the directory and subscription identifiers.
Directory (tenant) ID and Subscription ID, both from the Azure portal.Run the generated script in Azure Cloud Shell.
Grant read-only access gives you one command to paste. It creates the service principal and assigns Monitoring Reader and Security Reader.Choose Validate.
The connection turns active and the first scan is queued.
#Watching the connections
Each row shows its status, how many cloud findings are open, and what the last scan changed, written as how many were opened and how many resolved. Next scan says when the next one is due.
| Status | What it means |
|---|---|
| active | Connected and scanning on schedule. |
| pending setup | Created, and the script has yet to be run against it. |
| error | The last scan could not read the subscription. The row shows the reason. |
| paused | Kept, and not scanned. Turn it back on when you want it. |
#Working through cloud findings
The Cloud Findings page is everything the scanners surfaced, ordered by priority rather than by severity alone, so what to do first is what is at the top.
Filter by severity, by category and by source. The categories are security, reliability, performance, cost and operations, which is what makes this more than a posture list: the same scan tells you where a subscription is fragile and where it is wasting money.
Dismissing a cloud finding is remembered, so it stays quiet until someone reopens it and a later scan does not raise it again.
#The Cloud Overview
Connections, Resources, Open findings and AI triage spend sit across the top, with Open findings by severity and By category underneath. Needs attention is the short list worth reading first, and Recent scans says what each pass changed.
Daily spend (month to date) plots what your subscriptions are costing you month to date, which is why cost sits among the cloud finding categories alongside security.
The Cloud Resources page is the inventory behind all of it, refreshed on each scan.
Cloud monitoring is included with Enterprise. See Plans and billing.