Read-only by design
The built-in Reader role is all we ever hold. TenantThrift never writes to or deletes your resources — every fix is guidance you review and run yourself.
Swiss company · EU-hosted (Frankfurt) · read-only
Find the money Azure is quietly wasting.
Connect your tenant in minutes — no deployment, no agents, no secrets to share. Idle VMs, orphaned disks & IPs, oversized resources and missed reservations, each with the exact savings amount and the way to fix it. Not another spend dashboard; a way to actually cut the bill. Free for 14 days.
Connected in ~3 minutes · no credit card · cancel anytime.
16 built-in checks + Advisor
6 waste categories
0 agents to deploy
0 secrets to share
Built for security-conscious teams
Read-only. Minimal data. No exceptions.
One admin consent gives us a read-only identity in your tenant — you can see exactly what we store, and revoke it all in one click.
No stealable key — ever
Admin consent creates the identity in your tenant — no secrets change hands. And the key that proves TenantThrift to Azure is non-exportable: it can’t be copied out or replayed, even by us. A breach on our side still opens no door to your tenant.
Findings, not your inventory
We store findings and bounded cost aggregates in the EU (Frankfurt) — never credentials, never a full resource inventory. Deleting a connection deletes everything derived from it.
The complete list of what we store — table by table — is public: what TenantThrift stores. If it's not on that list, we don't collect it — and we never receive your credentials or a full inventory of your resources.
The dashboard · included in your trial
See the waste, then clear it.
Each scan becomes a living dashboard — findings with guidance, cost explorer, commitment comparisons and PDF reports for the whole team.
Fix it
- Exact fix guidance — the precise
azcommand for each finding, to review and run yourself - Options per finding — deallocate, Azure auto-shutdown, or tag-driven automation guides
- Ignore findings with a reason — they stay out of your numbers until you restore them
Stay ahead
- Scheduled scans — daily, weekly or monthly, at your hour
- New-waste and cost-spike alerts, sent to any recipients
- PDF report to any number of recipients after every scan
Prove the value
- Savings-over-time trend across scans
- Cost explorer — filter billed resources by type, group, subscription or tag
- Reservation & Savings-Plan comparison from your real VM usage — with a planner that turns it into a buy list: how many of each size, region & term
Bring the team
- Invite colleagues with Admin, Editor or Reader roles
- One subscription or your whole estate — MSPs connect every customer tenant
Cut license waste New
Azure isn’t the only bill with waste. The optional Microsoft 365 module finds licenses you pay for but nobody uses — and never stores a single name.
- Shelfware — bought but never assigned
- Seats on disabled or long-inactive accounts
- Overlapping SKUs — a standalone plan already inside a suite
- Counts and costs only — no names, emails or user IDs ever leave your tenant
- Deep-link into your own admin center to act
Free for 14 days
From sign-up to first report in minutes.
No deployment, no agents — a read-only connection your Azure admin approves, and one CLI command you run yourself.
Sign up (work email, no credit card), then click Connect with Microsoft. A tenant admin approves a one-time admin consent — that creates a read-only TenantThrift identity in your tenant, under your control. Nothing is installed, no secrets are exchanged.
Assign the built-in Reader role to that identity on each subscription you want scanned. The app walks you through the Azure-portal steps — no terminal needed — or use the one command below, then it verifies access with one click.
az role assignment create --assignee <app-id> --role Reader --scope /subscriptions/<subscription-id>The first scan starts right after verification and takes a few minutes. You get prioritized findings with fix guidance, the cost explorer, commitment comparisons and a PDF report — then scans continue on your schedule, with the report mailed to your team.
One-time setup, all on your side: a tenant admin approves the read-only consent once (about two minutes), then grants Reader on the subscriptions you choose. Nothing afterwards needs elevated access · by signing up you accept the Terms & Privacy Policy.
Pricing
One idle VM usually pays for the whole year.
Every plan starts with a 14-day free trial of the full product — no credit card. A single orphaned premium disk typically wastes more per month than the licence costs.
You see your real savings in the free trial — before you pay a cent.
Early access — founding prices for your first 24 months
Limited to our first 50 organizations, with 30 seats held for MSP partners — then plans move to general-availability rates.
Personal
€ 29/mo€ 19/mo
Founding rate — € 19/mo for 24 months, then € 29
For a single subscription.
- 1 Azure subscription
- The complete product — every check, priced fix guidance & PDF reports
- Microsoft 365 license optimization — optional read-only module, on every plan
- Scheduled scans, cost alerts & cost explorer
- Team access with roles, commitment comparison
Business
€ 89/mo€ 49/mo
Founding rate — € 49/mo for 24 months, then € 89
For an estate across a few subscriptions.
- Up to 5 Azure subscriptions, rolled up into one view
- Team access with roles (Admin/Editor/Reader)
- Commitment comparison from real VM usage
Enterprise
€ 249/mo€ 129/mo
Founding rate — € 129/mo for 24 months, then € 249
For one tenant with a subscription sprawl problem.
- Unlimited Azure subscriptions in your tenant
- Grant Reader once at the management group — every subscription beneath it is covered
- Priority support
Every plan is the complete product — every check, priced fix guidance, PDF reports, scheduled scans, cost alerts, the cost explorer, team roles, commitment comparison and the optional Microsoft 365 license module. The plan decides how much you connect, never which features you get.
For partners
Running Azure for other people?
Connect every client tenant, put your own brand on the reports, bill them your rate and keep the difference. And because a new tenant is free for its first 30 days, you can scan a prospect and show them what you found before it costs you anything.
- 10 client tenants included, unlimited subscriptions in each
- Every new tenant free for 30 days — win the deal first, pay after
- White-label reports — your logo, name & colour per customer tenant
- Resell it — bill your clients your own rate, keep the margin
MSP
€ 198/mo€ 99/mo
+ € 9 per tenant beyond 10
Founding rate — for 24 months, then € 198/mo + € 18 per tenant
Try MSP freeOn MSP, tenants beyond the ten included are added per connected tenant and any change takes effect at your next billing period. Cancel anytime; your data stays readable, scans pause at the end of the paid period. Prices exclude VAT. Founding prices run for 24 months from the day you subscribe, after which the plan bills at its regular price — shown next to every founding rate above, so there is nothing to discover later. Cancel or switch plans at any point before then. By subscribing you agree to our Terms, Privacy Policy and DPA.
Why not just use the built-in tools?
Azure tells you what you spent. Not what you're wasting.
Cost Management reports the bill. Advisor lists generic suggestions with no price tag. TenantThrift prices every finding from your real Azure Cost Management data — not list prices, not guesses — and shows you how to fix it.
| Capability | Cost Management | Azure Advisor | TenantThrift |
|---|---|---|---|
| Shows what you spent | ✓ | — | ✓ |
| Findings priced from your real costs | — | partly | ✓ |
| Orphaned disks, IPs, NICs & snapshots | — | some | ✓ |
| Real VM runtime vs 24/7 billing | — | — | ✓ |
| Reservation / Savings-Plan comparison from real usage | — | generic | ✓ |
| Microsoft 365 license waste (shelfware, inactive, overlap) | — | — | ✓ |
| Exact fix command for every finding | — | — | ✓ |
| Scheduled PDF report to your inbox | — | — | ✓ |
| Read-only against your tenant | ✓ | ✓ | ✓ |
Advisor findings are still included — TenantThrift surfaces them alongside its own checks, de-duplicated and priced.
FAQ
The questions teams ask first.
What exactly do you store about our environment?
Findings (with resource names), bounded cost aggregates, tenant and subscription IDs, your scan schedule and report recipients, plus one PDF per scan — hosted in the EU (Frankfurt). Never credentials, never metrics or logs, never a full resource inventory. The complete table-by-table list is in the cloud docs.
Do we have to share any secrets or credentials?
Never. Admin consent creates a service identity in your tenant that points at our app — nothing is generated by or collected from you. Revoke it anytime by deleting the enterprise app or removing the Reader assignment.
Can TenantThrift change or delete our resources?
No. The only role it ever holds is built-in Reader. Every fix is guidance — the exact command shown for you to review and run yourself, with options like Azure's native auto-shutdown where they exist.
Does the Microsoft 365 license module need extra access?
Yes — it’s optional and off by default. Turning it on grants a separate read-only Microsoft Graph consent (subscribed SKUs, license assignments, sign-in and usage reports), kept apart from your Azure connection so it’s only ever asked for in tenants that opt in. It stores counts and costs only — no names, emails or user IDs. See how to enable it.
What happens when we cancel or delete the account?
Cancel: scans pause at the end of the paid period, your data stays readable. Delete a connection or the whole organization: findings, scans and stored PDF reports are removed immediately — and the identity in your tenant stops working the moment you revoke it on your side.
Where are you based, and where does our data live?
TenantThrift is an independent Swiss product (Simon Vedder, registered near Zurich). Your data is hosted in the EU (Frankfurt) and handled under the GDPR and Swiss data-protection law (revDSG) — two of the strictest privacy regimes there are. A real company with a named founder and a public imprint, not an anonymous platform.
How accurate are the savings numbers?
Every finding is priced from your real Azure Cost Management data — not list prices or generic estimates. VM runtime savings come from actual usage metrics, not assumptions. You review each finding before acting, and can ignore any that don’t apply so they stay out of your totals.
Do you support AWS or GCP too?
Azure only — on purpose. TenantThrift goes deep on Azure’s specific waste patterns and commitment options rather than spreading thin across three clouds. If your spend is on Azure, that focus is the point.
Who’s behind it
Built by someone who did this by hand.
I’m Simon — an Azure engineer working in cloud security, who’s spent years cutting cloud bills across real estates. Every check in TenantThrift is one I used to run by hand: idle VMs, orphaned disks, the reservation math nobody has time for. I built the tool I always wished I had.
Because security is my day job, safety was the starting point, not a bolt-on — read-only, least-privilege, revocable in one click. And it’s an independent Swiss product, not a faceless platform: email support and you reach me — no ticket queue, no call center.
— Simon Vedder, founder · simonvedder.com
See what your tenant is wasting.
Connect it, run one free scan, read the report.
Start free trial Explore the live demo