Cost
- Spend and forecast — daily and monthly cost from Cost Management, by service, region and subscription, and Azure’s month-end forecast
- Savings — Azure Advisor cost recommendations with Advisor’s own monthly estimate
- Idle resources — unattached disks, unused public IP addresses, orphaned network cards, stopped machines — with a monthly cost from Azure’s public price list where one exists
- Unusual days — days well above the usual for the past four weeks, overall and per service
- Budgets — your Cost Management budgets with spend so far and forecast
- Cost by team or project — spend per value of up to three tag keys you choose in Settings
Security
- Secure score and recommendations — from Microsoft Defender for Cloud, by severity
- Internet exposure — remote desktop or SSH open to the internet, storage allowing anonymous access, databases with public network access, storage allowing old or unencrypted connections, key vault settings
- Admin access — the number of owner-level role assignments, and whether Defender’s MFA checks for admin accounts pass
- Threat protection — which Defender plans are switched on
Governance
- Inventory and tags — resources by type, region and subscription, and how many carry tags (tag keys only)
- Policy compliance — Azure Policy results and the most-broken rules
- Compliance standards — passed and failing controls for the standards enabled in Defender for Cloud, exactly as Defender reports them
- Locks and logs — resource groups protected by a delete lock, and key services that send their logs somewhere
Reliability
- Backups — virtual machines protected by Azure Backup, and protected items by type
- Health — resource availability, Azure service incidents affecting you, and alerts fired in the last week
The access checklist
On each connection, every data source shows one of four states:
- Working — read successfully.
- Partly working — some subscriptions or parts could not be read; the reason says which kind.
- Needs attention — usually a role still being applied (wait ten minutes) or Defender for Cloud turned off.
- Not set up — an optional feature you haven’t enabled.
Where something can’t be measured, CloudLens shows “—” rather than guessing, and the score says how complete it is.