A complete suite for your Azure cloud

Posture (CSPM)

Security audit of your Azure subscription from a scan of its inventory.

Interactive network topology and Internet-exposed resources.
Findings by severity and category, each with its remediation.
Compliance against CIS Azure, ISO 27001, NIST 800-53 and GDPR.
Complete, exportable inventory.
A copilot that knows that audit's data: 'what should I fix first?'.

Who it's for: Security leads, MSPs and consultancies auditing Azure subscriptions.

How it works, an example and FAQ

How it works

You connect a Service Principal with the Reader role (read-only) and the subscription's inventory is scanned: network, identities, storage, encryption and logs.
Calma Cloud applies its rule catalog and builds the dashboard: network topology, Internet-exposed resources, findings by severity and category, and compliance per framework.
Each finding carries its severity, rule, affected resource and recommended remediation; the copilot answers questions about that specific data.

An example

You scan a subscription with 240 resources. In a couple of minutes you see that 3 SQL Servers accept 0.0.0.0/0, which CIS Azure controls are failing and, in compliance, exactly which ones fail. You ask the copilot 'what should I fix first?' and it prioritizes by severity and impact.

Frequently asked questions

Does it change anything in my Azure?

No. It's read-only (Reader role): it never modifies, deploys or deletes any resource.

What do I need to run a scan?

A Service Principal with the Reader role on the subscription. Nothing to install on your resources.

Which compliance frameworks does it cover?

CIS Azure Foundations, ISO 27001, NIST 800-53 and GDPR, mapped to each finding.

Where does my data stay?

The scan is processed in your own instance; credentials live in your local configuration and are never committed.

Cost (FinOps)

Your real Azure cost, resource by resource: budgets, monthly comparison and what changed.

Real spend per resource (Azure Cost Management) crossed with your inventory: type, project, environment and resource group.
Super filterable: instantly find which resources, projects or types spend the most, and their end-of-month projection.
Your Azure budgets with their spend and a recommended limit so they don't blow again.
Monthly comparison: a matrix by project, type or RG with trend and growth ranking.
“What changed”: top risers and fallers, new resources and those that stopped billing.
Navigate months and years, group and export to CSV; data is saved and served instantly.

Who it's for: FinOps, budget owners and executives who need cloud-spend visibility.

How it works, an example and FAQ

How it works

You connect the subscription with the same Reader Service Principal as Posture; Calma Cloud reads the real cost from Azure Cost Management.
It crosses that cost with your inventory and breaks it down by resource, type, project (tag), environment and resource group, with its end-of-month projection.
You compare month to month, see what moved the bill vs the previous period and review your budgets with the recommended limit.

An example

Your monthly bill is down €96 vs the same point last month. “What changed” explains it instantly: a €492 service disappeared, but OpenAI rose €138 and a new SFTP of €120 appeared. Also, 2 budgets are about to blow and Cost suggests raising the production one to €4,800 based on Azure's forecast.

Frequently asked questions

Where does the cost data come from?

From Azure Cost Management (Reader role, read-only). We install nothing and move no data.

Do I have to wait for it to load?

No. Cost is saved and served instantly; it refreshes in the background (Azure's data arrives a few hours delayed).

How is it different from Optimize?

Cost tells you how much you spend and on what; Optimize tells you what to change to spend less. They're complementary.

Where do projects and environments come from?

From each resource's tags, crossed with the inventory: you see spend by project or environment with no manual work.

What do the budgets do?

They read your Azure Budgets and show the spend; if Azure forecasts they'll be exceeded, they suggest a new limit with margin so they don't blow again.

Optimize

What to change to pay less, explained so whoever signs the bill understands it.

Every suggestion says what to change, why, based on which data and what happens next, without jargon.
Based on real usage (Azure Monitor, Log Analytics, Cost Management), not just the size you pay for.
Sorted by confidence: 'Safe', 'Review' or 'Decide', so you start with what carries no risk.
Only what saves money: idle resources, oversized tiers, duplicated logs, unused storage and reservations.
Accept or postpone each suggestion and track the savings achieved.

Who it's for: FinOps, budget owners and technical teams who have to justify every change.

How it works, an example and FAQ

How it works

It reads, read-only, the real cost, the usage metrics and the configuration of every resource.
Before suggesting a change it checks usage peaks, which applications depend on the resource and its backups.
It gives you the step-by-step in the portal or the command for the technical team; you decide what to apply.

An example

A development PostgreSQL database has had no connections for 30 days and no application uses it. Optimize flags it as idle and explains how it knows, what to do before deleting it and how much it saves per month.

Frequently asked questions

Does it apply the changes for me?

No. Calma Cloud is read-only: it tells you what to change and how; your team makes the change.

What if a suggestion doesn't fit my case?

Mark it as an exception, with a reason and a date to review it; it stops counting towards pending savings.

What data does it use?

The cost from Azure Cost Management, the metrics from Azure Monitor, the logs in Log Analytics and each resource's configuration, all read-only.

Investigate

Ask your Azure in plain language: logs, live configuration and security.

Analyze a resource, a resource group, a workspace or the whole subscription.
The AI writes the query (KQL or Resource Graph), runs it and explains the result.
It finds where each resource's logs live on its own, even when they arrive through Application Insights.
Blind AI: results are never sent to the model; they're shown raw.
Conversations are saved so you can pick them up again, and export to Markdown.

Who it's for: Operations, SRE, security and anyone who needs an answer without knowing KQL.

How it works, an example and FAQ

How it works

You choose what to analyze: a resource, a group, a workspace or the whole subscription.
You ask in plain language: 'errors in the last 24h', 'what is exposed to the Internet', 'failed sign-ins'.
You see every step streamed live: the generated query, the time range, the results and the explanation.

An example

You ask why an API is slow. Investigate finds its workspace through Application Insights, pulls the week's 5 slowest operations and the hours of the peaks, and leaves you the KQL query to reuse.

Frequently asked questions

Do I need to know KQL?

No, but you'll see it: every answer shows the generated query so you can audit and reuse it.

Do I need a Log Analytics workspace?

For logs, yes. To ask about the subscription's live configuration, no: it queries Azure Resource Graph.

What is blind AI?

The AI generates the query, but the results are never sent to OpenAI: they're shown raw. For maximum privacy.

Advisories

What Azure announces and what expires, matched to your resources: now, coming up and history.

Now: Azure incidents affecting you, plus Defender and Azure Monitor alerts.
Coming up: retirements, maintenance, unsupported versions and expiring certificates, on a calendar.
Add your own dates (contracts, licences, domains, audits) and export the calendar to Outlook.
Every notice, summarized in plain language, with the resources of yours it affects.
History: what happened and, with AI, whether it affected you and why.
Got a notice by email? Paste it and work out its impact on your resources.
A digest by email or Teams, only on days with something new.

Who it's for: Operations and service owners who don't want to find out too late.

How it works, an example and FAQ

How it works

Calma Cloud reads, read-only, Azure Service Health, Azure Advisor, Defender for Cloud and Azure Monitor alerts.
It matches every notice against your inventory to tell which resources it affects, and lays the dates out on a calendar.
The AI summarizes each notice in plain language and suggests what to do; you mark it as seen or assign it.

An example

Azure announces that a runtime version loses support in March. 'Coming up' shows it with its date, the 4 App Services using it and what to do; you export it to Outlook so the team has it in their calendar.

Frequently asked questions

Where do the notices come from?

From Azure Service Health, Azure Advisor, Microsoft Defender for Cloud, Azure Monitor alerts and each resource's configuration (versions and certificates).

Can I add dates that don't come from Azure?

Yes: contracts, licences, domains or audits, including yearly ones. The whole calendar exports to Outlook (.ics).

What if the notice reaches me by email?

Paste it into 'Paste an Azure notice' and Calma Cloud works out live which of your resources it affects.

Calma Studio

Design your Azure architecture on a canvas, with templates, official icons, transparent pricing and Bicep/Terraform export.

Visual drag-and-drop canvas: VNets, subnets, resources and connections.
25+ reference templates ready to customize.
Full set of official Azure icons.
Transparent, real-time pricing while you design.
Export to Bicep or Terraform in one click.
With AI (in the full version): generate the architecture from a natural-language brief.

Who it's for: Cloud architects, presales and teams designing new infrastructure.

How it works, an example and FAQ

How it works

Start in three ways: with AI from a brief, from a blank canvas, or from one of 25+ reference templates.
Design on the canvas: drag resources, group them into Resource Group / VNet / Subnet, connect them and edit their tier, with official Azure icons.
On top of the design: validate best practices, compute the monthly cost live and export to Bicep or Terraform.

An example

You start from the 'web + SQL' template, switch the region to West Europe and bump the database tier. The monthly cost recalculates instantly and you export the main.bicep ready to deploy.

Frequently asked questions

Can I try it for free?

Yes: Calma Studio is the free public demo, no sign-up, right in your browser.

Is the pricing real?

Yes: it uses the Azure price catalog (West Europe base + per-region factor), the same one as the product.

Is the AI included in the demo?

Manual design, cost and export work without sign-up; AI generation from a brief is in the full version.