Azure compliance, done for you. Not just detected.
Obsinto runs Azure compliance for you: it finds what breaks SOC 2, ISO 27001 or FedRAMP in your subscriptions and Entra ID, writes the fix, applies it once you approve, and proves it to your auditor.
What Obsinto does for you
Fixes, not just findings
Most compliance tools stop at the failing test or a code snippet your engineers apply. For dozens of the most common Azure checks, Obsinto applies the approved change itself and re-checks it. For the rest, you get the exact change and a runbook.
Audit-ready every day
Every check, approval and change is recorded as it happens, in a tamper-evident decision log your auditor can verify, so your SOC 2 Type II evidence covers the whole review period.
Less console work for engineers
Your team reviews and approves. Obsinto does the console work, the scripting and the follow-up that usually piles up before every audit.
From failing check to closed control, step by step
- 01 / DETECT
A check fails on a real resource, for example a storage account that still accepts TLS 1.0, within minutes of the change.
- 02 / MAP
The failure is tied to the SOC 2, ISO 27001 or FedRAMP control it puts at risk, so you know what matters for the audit.
- 03 / FIX
Obsinto prepares the exact change, with what it touches and how to roll it back.
- 04 / APPROVE
A person with approval rights reviews the change, its side effects and its rollback, then signs off. Nothing changes in Azure before that.
- 05 / VERIFY
The fix is applied, or handed over as a runbook, the resource is re-checked, and the proof is filed against the control.
Microsoft's SOC 2 report does not cover your Azure configuration
Microsoft's SOC 2, ISO 27001 and FedRAMP attestations cover the infrastructure Microsoft runs. Your auditor tests what you control: whether storage is encrypted, which networks are open, who has admin access, and whether that held for the whole review period. That is the part Obsinto runs for you.
Already using Azure Policy and Defender for Cloud?
Keep them. They tell you what is non-compliant. Obsinto closes the loop: it ties each failure to your audit requirements, gets the fix approved and applied, re-checks it, and keeps the record your auditor asks for.
What changes when the fix is part of the product
Vanta, Drata and Secureframe made compliance visible, and their AI can now write fix code. But the change still lands in an engineer’s backlog, and the audit waits until someone applies it. Obsinto is built for that step: applying the change, with a person approving it first.
What Obsinto covers in Azure
More than 140 Azure and Entra ID checks, mapped to SOC 2, ISO 27001:2022, NIST 800-53, FedRAMP Moderate and the CIS Azure benchmark.
Storage and data
Storage accounts, SQL Database and Managed Instance, PostgreSQL and MySQL, Data Factory, backups and encryption
Network
Network security groups, Azure Firewall, Application Gateway, Bastion, private endpoints, Network Watcher
Compute and apps
App Service, Functions, Container Apps, Container Registry, Azure Virtual Desktop, Arc-enabled servers
Security and secrets
Key Vault, Defender for Cloud coverage, Microsoft Sentinel, API Management, Automation
Identity (Entra ID)
MFA through Conditional Access, legacy sign-ins blocked, global admin count, standing privileged access
What access Obsinto needs in Azure
The Reader role on the subscriptions you choose, plus read-only Microsoft Graph permissions for Entra ID, granted with admin consent.
Permission to create one Event Grid subscription per Azure subscription. It is the only write permission needed by default, and it lets Obsinto re-check a risky change soon after it happens.
A separate writer role, only if you want Obsinto to apply approved fixes. Without it, you still get the exact change and a runbook.
Azure compliance questions
How is Obsinto different from Vanta or Drata for Azure?
Vanta and Drata flag failing Azure tests and can suggest or generate the fix, but your engineers still apply it. Obsinto applies the approved fix itself, re-checks the resource, and files the proof against the control.
Can Obsinto fix Azure compliance issues automatically?
Yes, with a person in control. Obsinto prepares the fix and applies it once someone with approval rights signs off, then re-checks the resource. If a change cannot be undone, you are told before you approve.
What access does Obsinto need for Azure compliance checks?
Read access to check: the Reader role and read-only Microsoft Graph permissions. Write access is optional and only used for fixes you approve.
Is this a SOC 2 audit of my Azure environment?
No. A SOC 2 report is issued by an independent CPA firm. Obsinto keeps the evidence your auditor tests current: what was checked, what failed, who approved the fix, and proof it worked.