stratolens.bsky.social
LightNews LightNews
stratolens.bsky.social
stratolens.bsky.social
@stratolens.bsky.social
1 followers 39 following 46 posts
Social Account for StratoLens
https://getstratolens.com/
Posts Replies Media Videos
Pinned
stratolens.bsky.social
stratolens.bsky.social @stratolens.bsky.social · Aug 6
Hi Bluesky 👋

I'm building StratoLens: a self-hosted Azure visibility platform. It maps your whole estate, tracks every change, and catches the quiet cost waste and access risks that never trip an alert, without your data ever leaving your tenant.

getstratolens.com
StratoLens | Self-Hosted Azure Visibility Platform
StratoLens catches the cost waste, access risk, and config drift across your whole Azure estate, from inside your own tenant, so your data never leaves it.
getstratolens.com
stratolens.bsky.social
Right now, somewhere in your tenant, a role assignment is granting a principal access it already has. It costs nothing and adds nothing. What it does is pad your access reviews and blur least-privilege analysis.

Learn more at getstratolens.com
StratoLens footgun card: low severity, Azure RBAC. A role assignment already covered by a broader grant adds no access, only audit noise.
September 16, 2026 at 4:00 PM
stratolens.bsky.social
Open your storage accounts right now. If shared key auth is still on, two static keys work as universal passwords across blobs, files, queues and tables. No identity attached, no conditional access, no MFA.

Learn more at getstratolens.com
StratoLens footgun card, medium severity, Azure Storage: shared key authorization lets anyone holding a storage account key bypass Entra ID entirely.
September 15, 2026 at 4:00 PM
stratolens.bsky.social
How many Owners does your subscription have, and how many have ever granted a role? Owner is Contributor plus the power to hand out access. If nobody exercises it, that is standing authority nobody is watching.

Learn more at getstratolens.com
StratoLens card: high severity Azure RBAC footgun. Owner or User Access Administrator held by principals that never manage access.
September 14, 2026 at 4:00 PM
stratolens.bsky.social
Somewhere in your tenant, a storage account has a firewall with carefully written IP and VNet allow-list rules, and every one of them is doing nothing. The account still answers from any network on the internet.

Learn more at getstratolens.com
StratoLens footgun card: medium severity, Azure Storage. A storage firewall left open to every network makes the configured IP and VNet rules meaningless.
September 13, 2026 at 4:00 PM
stratolens.bsky.social
How close is your subscription to its regional vCPU quota? Running near the cap breaks nothing, until a deploy, autoscale, or DR failover fails with QuotaExceeded. Raising the limit takes hours to days.

Learn more at getstratolens.com
StratoLens footgun card, high severity, Azure Compute quotas: regional vCPU quota fills invisibly and only surfaces when a deploy, autoscale, or DR failover cannot allocate VMs.
September 12, 2026 at 4:00 PM
stratolens.bsky.social
Go look at your reservation expiry dates right now. A term ending is not an error, so nothing breaks and nothing warns you. Every covered VM starts billing pay-as-you-go that same hour, losing a discount commonly 30-60% at list price.

Learn more at getstratolens.com
StratoLens footgun card: medium severity, Azure Reservations and Savings Plans. A reservation term ends silently and covered VMs revert to pay-as-you-go billing.
September 11, 2026 at 4:00 PM
stratolens.bsky.social
When was the last time you checked which of your IP Groups a firewall rule actually references? An unreferenced one still reads like a live allowlist. It enforces nothing. No bill, just a network-security artifact that lies to you.

Learn more at getstratolens.com
StratoLens footgun card: low severity, Azure Firewall. An orphaned IP Group looks like an active allowlist but no firewall rule references it, so it enforces nothing.
September 10, 2026 at 4:00 PM
stratolens.bsky.social
Reservation discounts are use-it-or-lose-it by the hour. A $10,000/month reservation running at 60% utilization quietly burns roughly $4,000/month (authored estimate). The bill looks perfectly normal.

Learn more at getstratolens.com
StratoLens card: high severity cost footgun in Azure Reservations and Savings Plans. An underutilized reservation burns its committed spend hour after hour.
September 9, 2026 at 4:00 PM
stratolens.bsky.social
Sort your resource groups by resource count right now. The empty ones still carry tags, role assignments, and policy scope, so every inventory and audit you run is padded with containers holding nothing.

Learn more at getstratolens.com
StratoLens card: low-severity Azure Resource Manager footgun. Empty resource groups keep tags, role assignments, and policy scope while holding no resources, cluttering inventory.
September 8, 2026 at 4:00 PM
stratolens.bsky.social
How many subnets in your VNets have nothing in them? No NICs, no private endpoints, no delegations. They cost nothing directly, but the address range stays carved out and your network plan gets harder to read.

Learn more at getstratolens.com
StratoLens card: low severity governance issue in Azure Virtual Network. An empty subnet reserves address space while serving no workload.
September 7, 2026 at 4:00 PM
stratolens.bsky.social
Go list your VNets right now. Any of them with zero subnets? That one carries no traffic, holds nothing, and still owns a CIDR range in your address plan and every network inventory you look at.

Learn more at getstratolens.com
StratoLens footgun card: low severity, Azure Virtual Network. An empty VNet does no networking but reserves an address range and clutters inventory.
September 6, 2026 at 4:00 PM
stratolens.bsky.social
How many of your NSGs are attached to absolutely nothing? An NSG with no subnets and no NICs still carries a full rule set, and those rules govern nothing. It costs no money, so it sits in inventory and quietly muddies your audit trail.

Learn more at getstratolens.com
StratoLens footgun card, low severity, Azure Virtual Network: an orphaned network security group protects nothing and clutters the audit trail.
September 5, 2026 at 4:00 PM
stratolens.bsky.social
A Private Endpoint in Disconnected or failed state still holds its private IP, and DNS may still point at it. Traffic to the storage account or database behind it just never arrives. Azure stays quiet.

Learn more at getstratolens.com
StratoLens card: medium severity reliability footgun in Azure Private Link. A disconnected or failed Private Endpoint keeps billing while private traffic silently fails.
September 4, 2026 at 4:00 PM
stratolens.bsky.social
Pull up your subscription role assignments right now. Every Owner or User Access Administrator sitting there permanently is a live blast radius, and most of them outlived the reason they were granted.

Learn more at getstratolens.com
StratoLens footgun card, high severity, Azure RBAC and Entra ID: privileged roles like Owner held as standing access for months leave a permanent blast radius.
September 3, 2026 at 4:00 PM
stratolens.bsky.social
A public IP attached to a NIC or load balancer front end moves that resource from private-only to reachable by the entire internet. The attachment is the exposure, and Azure treats it as a routine config change.

Learn more at getstratolens.com
StratoLens footgun card: medium severity, Azure Public IP. A newly attached public IP quietly moves a private resource onto the public internet.
September 2, 2026 at 4:00 PM
stratolens.bsky.social
Open your Application Gateways right now and check the backend pools. If one is empty, every request hitting that listener comes back as a 502, and the gateway keeps billing by the hour while it serves nothing.

Learn more at getstratolens.com
StratoLens footgun card: high severity, Azure Application Gateway. An empty backend pool makes every request return a silent 502 while the gateway keeps billing hourly.
September 1, 2026 at 4:00 PM
stratolens.bsky.social
Somewhere in your tenant, a VM sits at single-digit CPU with memory to spare, billing the full hourly rate for a SKU the workload never grows into. The gap between a D8s v5 and a D2s v5 runs ~$210/month at list price.

Learn more at getstratolens.com
StratoLens footgun card: high severity, Azure Virtual Machines. An oversized VM runs at single-digit CPU while billing for a SKU the workload never uses.
August 31, 2026 at 4:00 PM
stratolens.bsky.social
Open your Load Balancers right now and check the backend pools. An empty one still shows a healthy frontend IP, live rules and probes, but every inbound connection is dropped on the floor.

Learn more at getstratolens.com
StratoLens card: medium severity reliability footgun in Azure Load Balancer. An empty backend pool silently drops all inbound traffic.
August 30, 2026 at 4:00 PM
stratolens.bsky.social
A resource in your tenant stepped up to a higher cost baseline on some Tuesday months ago and has billed at that level every day since. Because the new spend is stable, it reads as normal operation and never gets questioned.

Learn more at getstratolens.com
StratoLens footgun card, medium severity, Azure Cost Management: a resource settles into a permanently higher cost baseline and the step-up goes unquestioned.
August 29, 2026 at 4:00 PM
stratolens.bsky.social
Check the minimum TLS version on your storage accounts, SQL servers, and App Services right now. If any of them dropped back to 1.0 or 1.1, your data-plane endpoints are accepting deprecated handshakes and weak ciphers again.

Learn more at getstratolens.com
StratoLens footgun card: high severity security issue on Azure Storage, SQL, and App Service, where minimum TLS version is lowered from 1.2 back to 1.0 or 1.1.
August 28, 2026 at 4:00 PM
stratolens.bsky.social
Pull up daily spend per resource in your tenant right now. One resource can jump way above its normal run rate, keep working fine, and stay invisible to your subscription budget alert for weeks.

Learn more at getstratolens.com
StratoLens footgun card, medium severity, Azure Cost Management: one resource's daily spend spikes above baseline while the subscription budget stays quiet.
August 27, 2026 at 4:00 PM
stratolens.bsky.social
Go look at your Key Vaults right now. If soft-delete is off, a deleted secret, key, or certificate is gone the instant someone hits delete. No recovery window, no restore, no undo.

Learn more at getstratolens.com
StratoLens footgun card: high severity Azure Key Vault issue. A vault with soft-delete disabled makes deleted secrets, keys, and certificates unrecoverable.
August 26, 2026 at 4:00 PM
stratolens.bsky.social
An Azure Container Registry with no pushes or pulls costs exactly what a busy one does. Idle registries bill a fixed daily rate: roughly $5/month Basic, $20 Standard, $50 Premium at list price. Azure stays quiet about it.

Learn more at getstratolens.com
StratoLens card: low severity cost footgun in Azure Container Registry. An idle registry with no pushes or pulls still bills its tier's fixed daily rate.
August 25, 2026 at 4:00 PM
stratolens.bsky.social
Somewhere in your tenant there's a Key Vault with a carefully built IP allow-list and VNet rules that are doing nothing. The firewall is still accepting traffic from every network, and the portal shows the rules as configured.

Learn more at getstratolens.com
StratoLens footgun card: high severity, Azure Key Vault. A firewall left open to all networks makes your IP and VNet allow-lists decorative.
August 24, 2026 at 4:00 PM
stratolens.bsky.social
I’ve been building an #Azure Observability platform for over a year now. Change tracking, access optimization, cost tracking and saving, security recommendations, and much more!

Entirely self hosted and read only - no data leaves your tenant!

Interested? Please reach out!

getstratolens.com
StratoLens | Self-Hosted Azure Visibility Platform
StratoLens catches the cost waste, access risk, and config drift across your whole Azure estate, from inside your own tenant, so your data never leaves it.
getstratolens.com
August 24, 2026 at 2:09 AM