Governance & hygiene · Storage Hygiene Scorecard

Grade every Azure storage account on access security, daily

Q: Where do I get support?

support@llmgraph.ai, or the support page on katabarwalabs.dev.

Anonymous blob access, shared-key auth, TLS floor, SAS policy, network default action: each account scored, the gaps named, the systemic ones ranked.

Deploy from the Azure Marketplace Read the background

Deploys as a managed application in your own subscription. No vendor backend, no data egress. Flat monthly fee, billed by Microsoft.

The gap

One storage account with anonymous blob access left on is a breach. Across dozens of accounts created by different teams over years, nobody has the recurring view. The portal shows one account at a time and the checks are spread across five blades.

What it does

Daily score for every account: anonymous blob access disabled, HTTPS only, minimum TLS 1.2, shared-key auth disabled, SAS expiration policy set, network default action Deny, public network access restricted.
Reports the estate average, the accounts below your threshold with their specific gaps, and the most common systemic gaps.
Reads management-plane configuration only, never account keys or data.
Skips its own runtime storage account (tagged storage-hygiene-self=true), which cannot score 100 because the Functions runtime requires shared-key auth.
Posted to Teams as an Adaptive Card.

The scorecard: estate average and the accounts below threshold.

Honest about its limits

It grades configuration; it does not change it. Remediation is yours, and some checks (shared-key off, network Deny) can break workloads if applied blindly.
Read-only. This app reports and alerts; it changes nothing in your subscription.

How it runs, and what it needs

A serverless function on a schedule, with a system-assigned managed identity, deployed into your subscription by the Azure Marketplace. Roles are granted by you after deployment with the one-line script in the package, so nothing runs until you say so. Every role it asks for, and why:

Reader

read storage account configuration

Alerts go to the Teams webhook you configure. Nothing is sent anywhere else.

FAQ

Does any data leave my subscription?

No. The function runs in your subscription and writes only to your configured alert destination. Katabarwa Labs operates no backend and receives nothing.

How is it billed?

A flat monthly fee on your Azure bill through the Marketplace, plus the small consumption cost of the function itself. No per-resource or per-user pricing.

How do I remove it?

Delete the managed application from the Azure portal. Its resource group and identity go with it, and any role you granted can be removed the same way.

Where do I get support?

support@llmgraph.ai, or the support page.

Deploy Storage Hygiene Scorecard in your subscription.

Anonymous blob access, shared-key auth, TLS floor, SAS policy, network default action: each account scored, the gaps named, the systemic ones ranked.

Deploy from the Azure Marketplace