Deploys as a managed application in your own subscription. No vendor backend, no data egress.
Flat monthly fee, billed by Microsoft.
The gap
The resource you find out is unmonitored is the one that just went down. Alert rules accumulate over years, scoped in ways that do not cover what people assume they cover, and nobody has the list of what is genuinely watched.
What it does
Weekly inventory of monitorable, production-grade resource types (SQL, storage, App Service, Cosmos DB, Key Vault, Redis, Service Bus, Application Gateway, Front Door and CDN, VMs), overridable per tenant.
Union of every metric alert and scheduled-query alert scope, compared against the inventory.
Conservative coverage model: an alert counts only when Azure Monitor genuinely evaluates that resource. It errs toward uncovered, never toward a false covered.
Multi-resource metric alerts are credited only for matching type and region; broad log alerts are surfaced as a note, never as coverage.
Coverage percentage and a per-type breakdown, worst first, posted to Teams.
The weekly scorecard: overall coverage and the worst-covered types.The blind resources by type.How each alert scope was credited.
Honest about its limits
Report-only; it never creates or edits an alert rule, so there is no dry run to flip.
Activity-log alerts are a different alert type and are not counted as metric or health coverage.
Read-only. This app reports and alerts; it changes nothing in your subscription.
How it runs, and what it needs
A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription
by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so
nothing runs until you say so. Every role it asks for, and why:
Reader
run Resource Graph queries over resources and alert rules
Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.
FAQ
Does any data leave my subscription?
No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.
How is it billed?
A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.
How do I remove it?
Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.
