AzClean: read-only Azure cost and security tools
These came out of consulting work rather than a product plan. Each one exists because the same job kept coming up on someone else's estate, and doing it by hand a fourth time stopped being defensible.
Every tool shares one rule: they read, they never write. Each is a single download with the full licence terms inside, and updates for the lifetime of the product.
Why read-only is the whole design
A script that can delete things needs a conversation before it runs. A script that only looks does not. That difference matters most at the start of an engagement, when nobody has decided how much to trust you yet, and it matters again when a client hands you access to a subscription neither of you fully understands.
The second design rule is less obvious and more important: the scripts exit non-zero when they cannot reach Azure. A cost tool that loses its token and prints "no findings" has produced a clean report from an empty search, which is worse than crashing because it looks like good news. "Found nothing" and "could not look" have to be different outcomes, and only one of them should let a scheduled job go green.
Minimum permissions to run the toolkit are Reader at the scopes you want covered, plus directory read for the credential and RBAC checks. Nothing needs Contributor. If a script asks you for write access, it is not one of ours.
AzClean Toolkit
Ten scripts covering the checks that account for most avoidable spend and most quiet risk in a small estate: orphaned resources, idle VMs, stale snapshots, NSG rules, public storage, stale RBAC, expiring credentials, tag compliance and spend by tag.
Cost figures come from the Azure Retail Prices API per region rather than a hardcoded table, and managed disks are priced by provisioned tier rather than consumed gigabytes. That distinction is the single most common source of wrong numbers in Azure cost work: a 128 GB Premium SSD bills as a P10 whatever is on it, and a flat per-GB estimate understates it by roughly 3.7x. There is a longer note on disk tier pricing if you want the arithmetic.
Scope is a parameter, so you can point it at one subscription, several, or all of them.
More on the AzClean Toolkit or get it on Gumroad
AzClean Detections
Twelve Sentinel analytics rules for configuration drift and privilege escalation, with a validator that proves every query runs in your own workspace before you deploy it.
The validator is the part worth paying for. Copied KQL fails quietly: a table that does not exist in your workspace because the connector was never enabled, a schema that changed, a column renamed. A rule that cannot run does not raise an alert saying so. It simply never fires, and you find out during the incident it was written for.
More on AzClean Detections or get it on Gumroad
AzClean Baselines
Intune configuration as code. Export policy to JSON, commit it, and get told exactly which property drifted, however deeply nested.
Settings catalog policies are where this earns its keep. A change three levels into a nested object is invisible in the portal unless you already know where to look, and the portal will not tell you when it happened or who did it. A diff against a committed baseline will. That output also doubles as configuration management evidence, which matters if anyone is asking you for it.
More on AzClean Baselines or get it on Gumroad
AzClean Reporting
Turn toolkit CSV exports into a client-ready HTML report, a Markdown summary for tickets, and a Teams or Slack digest. White-label it as your own.
Three formats because three audiences. Stakeholders want the HTML with the caveats visible and the findings ranked by monthly cost. Whoever does the work wants Markdown they can paste into a ticket. The channel wants four lines and a number. Sending one audience another audience's format is how good findings get ignored.
The white-labelling is there because consultants and managed service providers were the people asking for it, and a report with someone else's brand on it is not much use when you are billing for the work.
More on AzClean Reporting or get it on Gumroad
Orphaned Resource Finder, free
One script, free for internal use. Finds the disks, NICs, public IPs and load balancers nobody remembered to delete, priced by provisioned tier.
This is the honest sample rather than a crippled demo. It does one of the ten jobs in the toolkit properly, with the same pricing logic and the same read-only guarantee. If it finds nothing, that is a real answer and worth knowing.
More on the free finder or download it
Licensing
Each product ships its licence terms inside the download, so the terms travel with the file rather than living on a page that might change. Consultant redistribution is covered explicitly: the tiers differ on whether you may run the tools against client estates and hand deliverables to those clients, which is the question people actually need answered before buying.
Updates are for the lifetime of the product on every tier.
What these are not
They are not a cost management platform, and they will not replace Azure Cost Management for actual spend. Cost Management tells you what you were charged last month. These tell you what you are still being charged for and why, which is a different question and the one you need in order to decide what to delete.
They are not a compliance product either. The Detections and Baselines output is useful evidence, but evidence is not a control operating, and no script will maintain a risk register for you.
The design decisions, written up
Everything on Gumroad if you would rather browse the listings, or the notes if you want to see the reasoning behind a specific check before buying anything.