What's live today and what's planned.
Azure credential lifecycle management: discovery, evidence aggregation, rotation, multi-cloud sync, alerts, audit trail.
Sign into CertifyClouds with your corporate Entra ID credentials, plus generic OIDC providers (Okta, Auth0, etc.) with group→role mapping. SAML 2.0 is on the roadmap.
Assets Discovery now scans B2C tenants for expiring credentials and secrets. Discover B2C app registrations.
Automation Sync now syncs secrets and certificates to Google Cloud Secret Manager.
Discover ADO Service Connections and Variable Groups that depend on your Key Vault credentials. See blast radius before you rotate.
Replicate secrets between Azure Key Vaults for DR, environment sync, or regional redundancy.
Discover, monitor, and rotate Key Vault secrets, certificates, and App Registration credentials from one deployment, across every Microsoft Entra ID tenant in your organisation. Subsidiaries, acquisitions, regions. ENTERPRISE tier.
One-click PDF evidence bundles for CIS Azure, SOC 2, ISO 27001, NIST 800-53, Microsoft cloud security benchmark, HIPAA and PCI DSS. Each bundle carries the source data, a cover page with scope and timestamp, and a management assertion page your team signs for the auditor.
Build your own compliance rules in the dashboard. Pick an asset type, pick a property, pick a condition, see how many findings it generates against your current scan. No DSL, no scripting.
Native PagerDuty Events API v2 integration for on-call paging. Severity mapping, dedup keys per credential, and success-event filtering so on-call sees real incidents, not noise.
Ask Claude or ChatGPT what's expiring next week and get a straight answer. Read-only: it sees expiry dates, compliance posture, and blast radius, never secret values. Your own Entra tenant authorises every call. ENTERPRISE tier.
Register Entra External ID external tenants alongside your Azure AD B2C tenants. Discovery, rotation, Key Vault propagation, and owner-scoped expiry alerts work identically on both, so credential coverage stays unbroken through a phased B2C migration.
Monitor Enterprise Application service principals for active SAML signing certificates, rollover certificates, client secrets, other certificates and confirmed owner-less apps. Expiry alerts cover active signing certificates, secrets and non-SAML certificates. Monitor-only; no rotation.
Every custom domain on App Service, Application Gateway, API Management, Container Apps and Front Door, with the certificate it serves, when it expires where Azure reports that, and alerts before it runs out. Certificates uploaded straight to the resource are covered too, and ones Azure renews for you are marked. Pro shows which Key Vault certificate each endpoint uses and whether it picks up a renewal.
See how each Key Vault certificate renews: automatically, with an email reminder only, by hand through an outside CA, or not at all. Compliance flags weak signatures (MD5, SHA-1), undersized keys and certificates that chain through an expired or mismatched intermediate. Pro turns on Key Vault auto-renewal for a self-signed certificate in one click.
Renew any Key Vault certificate from CertifyClouds, whoever issues it: a new self-signed version, a new order through a CA connected to Key Vault, or a request you send to any other CA and the signed certificate you upload back. Your apps keep the current version until the new one is ready, the copies CertifyClouds manages get it too, and the old version stays on for a grace period, or for as long as an app still points at it. An App Registration certificate a CA issued renews through that CA when you rotate it, and CertifyClouds adds the new certificate to the App Registration for you. PRO tier.
Every rotation updates that credential's copies in AWS, Google Cloud and other Key Vaults straight away, even when scheduled sync is off. The old credential waits for the copies before it is retired, up to a limit you set, so apps reading a copy keep working while it catches up. PRO tier.
Settings → Access shows every identity CertifyClouds signs in with, its Microsoft Graph permissions and its Azure access down to each vault. Compliance flags App Registrations that sign in with federated credentials but still hold a client secret, and checks your tenant's restrictions on new app credentials. CertifyClouds also warns your admins before the secrets it uses for connected tenants and SSO expire.
Rotate App Registration secrets and certificates before they expire, without anyone pressing a button. Turn it on for each credential, set how many days ahead it rotates, choose how often CertifyClouds checks, and get an email or webhook alert when a rotation succeeds or fails. PRO tier.
Add SAML 2.0 alongside the existing OIDC and Microsoft Entra ID SSO providers. For customers whose IdP doesn't expose OIDC, or whose security model standardises on SAML. This is signing in to CertifyClouds, not monitoring Enterprise Application signing certificates.
Sync to HashiCorp Vault, Infisical, and other self-hosted secret managers.
Find the AKS workloads that use your Key Vault secrets and certificates, so blast radius covers what runs inside the cluster, not just the Azure resources around it.