Coverage & risk · Backup Auditor

Prove every Azure VM, database, and file share is backed up

Q: Where do I get support?

support@llmgraph.ai, or the support page on katabarwalabs.dev.

Azure never alerts that a resource is in no backup policy. Backup Auditor cross-references the inventory against every vault daily and reports the gaps.

Deploy from the Azure Marketplace Read the background

Deploys as a managed application in your own subscription. No vendor backend, no data egress. Flat monthly fee, billed by Microsoft.

The gap

Show me proof that everything is backed up. Every auditor asks it, and the honest answer in most subscriptions is a shrug, because the new VM from last month was never added to a policy and nothing said so.

What it does

Daily inventory of backupable resources (VMs, SQL databases, Azure Files shares) through Resource Graph.
Reads protected items across every Recovery Services vault in the subscription.
Classifies each resource as unprotected, failing (last backup not healthy), or stale (newest recovery point older than your threshold).
Posts a coverage percentage and the itemised gaps to Teams.
Read-only; it never changes backup configuration.

The coverage card: percentage protected, and the unprotected, failing, and stale lists.

Per-resource status with the vault and last recovery point.

Honest about its limits

Azure SQL databases use built-in point-in-time restore rather than vaults, so they are excluded from the vault check rather than reported as unprotected.
Azure Files shares are matched through their parent storage account's protection.
Read-only. This app reports and alerts; it changes nothing in your subscription.

How it runs, and what it needs

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Reader	inventory resources
Backup Reader	read protected items and job health in every vault

Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.

FAQ

Does any data leave my subscription?

No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.

How is it billed?

A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.

How do I remove it?

Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.

Where do I get support?

support@llmgraph.ai, or the support page.

Deploy Backup Auditor in your subscription.

Azure never alerts that a resource is in no backup policy. Backup Auditor cross-references the inventory against every vault daily and reports the gaps.

Deploy from the Azure Marketplace