Read-only by design
The built-in Reader role is all we ever hold. TenantThrift never writes to or deletes your resources — every fix is guidance you review and run yourself.
Read-only · EU-hosted · revoke anytime
Find the money Azure is quietly wasting.
Connect your tenant in minutes — no deployment, no agents, no secrets to share. Idle VMs, orphaned disks & IPs, oversized resources and missed reservations, each with the exact savings amount and the way to fix it. Not another spend dashboard; a way to actually cut the bill. Free for 14 days.
Connected in ~3 minutes · no credit card · cancel anytime.
16 built-in checks + Advisor
6 waste categories
0 agents to deploy
0 secrets to share
Built for security-conscious teams
Read-only. Minimal data. No exceptions.
One admin consent gives us a read-only identity in your tenant — you can see exactly what we store, and revoke it all in one click.
No secrets to share
Admin consent creates the identity in your tenant — no client secrets, passwords or keys change hands, ever. Delete the enterprise app and access is gone.
Findings, not your inventory
We store findings and bounded cost aggregates in the EU (Frankfurt) — never credentials, never a full resource inventory. Deleting a connection deletes everything derived from it.
The complete list of what we store — table by table — is public: what TenantThrift stores. If it's not on that list, we don't collect it — and we never receive your credentials or a full inventory of your resources.
The dashboard · included in your trial
See the waste, then clear it.
Each scan becomes a living dashboard — findings with guidance, cost explorer, commitment comparisons and PDF reports for the whole team.
Fix it
- Exact fix guidance — the precise
azcommand for each finding, to review and run yourself - Options per finding — deallocate, Azure auto-shutdown, or tag-driven automation guides
- Ignore findings with a reason — they stay out of your numbers until you restore them
Stay ahead
- Scheduled scans — daily, weekly or monthly, at your hour
- Budget alerts per subscription, resource group, tag or total
- PDF report to any number of recipients after every scan
Prove the value
- Savings-over-time trend across scans
- Cost explorer — filter billed resources by type, group, subscription or tag
- Reservation & Savings-Plan comparison against your real VM usage
Bring the team
- Invite colleagues with Admin, Editor or Reader roles
- One subscription or your whole estate — MSPs connect every customer tenant
Free for 14 days
From sign-up to first report in minutes.
No deployment, no agents — a read-only connection your Azure admin approves, and one CLI command you run yourself.
Sign up (work email, no credit card), then click Connect with Microsoft. A tenant admin approves a one-time admin consent — that creates a read-only TenantThrift identity in your tenant, under your control. Nothing is installed, no secrets are exchanged.
Assign the built-in Reader role to that identity on each subscription you want scanned — in the Azure portal or with one CLI command. The app walks you through it and verifies access with one click.
In the Azure portal — no terminal needed:
- Open the subscription → Access control (IAM) → Add → Add role assignment.
- On the Role tab pick Reader (in the Job function roles list).
- On the Members tab choose User, group, or service principal → Select members → search for TenantThrift and select it.
- Review + assign — then click Verify access back in the app.
Or with the CLI — Cloud Shell works too:
az role assignment create --assignee <app-id> --role Reader --scope /subscriptions/<subscription-id>The first scan starts right after verification and takes a few minutes. You get prioritized findings with fix guidance, the cost explorer, commitment comparisons and a PDF report — then scans continue on your schedule, with the report mailed to your team.
The consent needs a Global Administrator (or Privileged Role Admin) once; the Reader assignment needs Owner or User Access Administrator on the subscription · by signing up you accept the Terms & Privacy Policy.
Pricing
One idle VM usually pays for the whole year.
Every plan starts with a 14-day free trial of the full product — no credit card. A single orphaned premium disk typically wastes more per month than the licence costs.
Personal
€ 19/mo
For a single subscription.
- 1 Azure subscription
- The complete product — every check, priced fix guidance & PDF reports
- Scheduled scans, budget alerts & cost explorer
- Team access with roles, commitment comparison
Business
€ 39/mo
For an estate across a few subscriptions.
- Up to 5 Azure subscriptions, rolled up into one view
- The same full product as Personal — nothing held back
- Team access with roles (Admin/Editor/Reader)
- Commitment comparison from real VM usage
MSP
€ 99/mo
For managing many customer tenants.
- Unlimited tenants & subscriptions
- The full product across every customer you connect
- A separate report & recipients per customer tenant
- Priority support
Same full product on every plan — you pay for how much you connect, not for features. Cancel anytime; your data stays readable, scans pause at the end of the paid period. Prices exclude VAT. By subscribing you agree to our Terms, Privacy Policy and DPA.
Why not just use the built-in tools?
Azure tells you what you spent. Not what you're wasting.
Cost Management reports the bill. Advisor lists generic suggestions with no price tag. TenantThrift prices every finding from your actual costs — and shows you how to fix it.
| Capability | Cost Management | Azure Advisor | TenantThrift |
|---|---|---|---|
| Shows what you spent | ✓ | — | ✓ |
| Findings priced from your real costs | — | partly | ✓ |
| Orphaned disks, IPs, NICs & snapshots | — | some | ✓ |
| Real VM runtime vs 24/7 billing | — | — | ✓ |
| Reservation / Savings-Plan comparison from real usage | — | generic | ✓ |
| Exact fix command for every finding | — | — | ✓ |
| Scheduled PDF report to your inbox | — | — | ✓ |
| Read-only against your tenant | ✓ | ✓ | ✓ |
Advisor findings are still included — TenantThrift surfaces them alongside its own checks, de-duplicated and priced.
FAQ
The questions teams ask first.
What exactly do you store about our environment?
Findings (with resource names), bounded cost aggregates, tenant and subscription IDs, your scan schedule and report recipients, plus one PDF per scan — hosted in the EU (Frankfurt). Never credentials, never metrics or logs, never a full resource inventory. The complete table-by-table list is in the cloud docs.
Do we have to share any secrets or credentials?
Never. Admin consent creates a service identity in your tenant that points at our app — nothing is generated by or collected from you. Revoke it anytime by deleting the enterprise app or removing the Reader assignment.
Can TenantThrift change or delete our resources?
No. The only role it ever holds is built-in Reader. Every fix is guidance — the exact command shown for you to review and run yourself, with options like Azure's native auto-shutdown where they exist.
How is this different from Azure Advisor or Cost Management?
Cost Management shows what you spent; Advisor lists generic recommendations with no price tag. TenantThrift prices every finding from your actual costs, catches what the native tools miss, and gives you the exact command to fix each one — the comparison table above has the details.
What happens when we cancel or delete the account?
Cancel: scans pause at the end of the paid period, your data stays readable. Delete a connection or the whole organization: findings, scans and stored PDF reports are removed immediately — and the identity in your tenant stops working the moment you revoke it on your side.
See what your tenant is wasting.
Connect it, run one free scan, read the report.
Start free trial Explore the live demo