Kronikl records every change in your Azure tenant — the resource, the role grant, the policy edit — with the configuration either side of it. Read-only, and set up in about ten minutes.
Connect your tenant How it works
Azure Reader access · Admin consent, then one role assignment · Nothing to install
Azure Activity Log keeps 90 days of operations — a line saying a write happened. It does not keep what the configuration was before the write, or after it. Azure Resource Graph keeps 14 days of change records; past two weeks, the question when did this setting change has no answer in the portal.
Nobody remembers who widened the NSG rule. The auditor is asking about March, and the person who would know left in April.
Kronikl reads your tenant through Azure's own APIs and keeps its own history.
A Global Administrator approves three read-only Microsoft Graph application permissions, plus two delegated scopes used only while you are signed in.
You give Kronikl Azure's built-in Reader role over the subscriptions or management groups you pick. Create it in one click with your own Azure sign-in, or copy the command for Azure CLI, PowerShell, Terraform or Bicep and run it yourself.
Kronikl records the current state of everything visible, then keeps watching on a frequent schedule, so new changes appear shortly after they happen.
One feed of every change in your tenant — resources, policy and role assignments. Filter it by anything on the row. No query language.
Pick any two points in a resource's history and see exactly which properties differ — by property path, not two walls of JSON.
One request produces the whole date range as CSV or JSON, streamed, with no row cap.
routine as a column.
X-Kronikl-Range-From: 2026-06-13T00:00:00ZX-Kronikl-Clamped-To-Plan: true
Set a rule and Kronikl watches for it: a privileged role granted, a resource deleted in a production resource group, an NSG opened to the internet, or a policy assignment removed. Matches are grouped, so a burst is one finding rather than four hundred, and they appear in the app.
Connecting your Azure environment is a real decision. These are the three things it grants.
The role Kronikl asks for is Reader, Azure's built-in read-only role. There is no write
or delete anywhere in it.
Press Create the role assignment and Kronikl makes it there and then — with your own Azure sign-in, under your name in your Activity Log, after showing you the role, the principal and every scope it will apply to. Or take the same grant as a command, for an account that cannot create role assignments.
No secret, no password and no API key against your tenant. Withdraw consent and access stops within minutes.
| Azure portal | Kronikl |
|---|---|
| Configuration history | |
| 14 days of change records, no config | 14 or 90 days, with the config either side |
| Comparing two points in time | |
| Not available | Property-level diff |
| Reading the Activity Log | |
| Raw JSON, one subscription at a time | One filterable feed across subscriptions |
| Your SIEM | Kronikl |
|---|---|
| Who it is for | |
| A SOC analyst | Whoever administers the tenant |
| Query language | |
| KQL, and rules to maintain | Filters and a URL |
| Point-in-time config diff | |
| Not what log search is for | The core of the product |
| An audit suite | Kronikl |
|---|---|
| Scope | |
| AD, file shares, on-premises, Azure | Azure only, and deeper for it |
| Getting started | |
| Agents, collectors, a project | Admin consent and one role assignment |
| Commitment | |
| An annual contract | A free plan |
Every new organization gets 90 days of history for its first two weeks. After that, Free keeps 14 days at one scope, and Pro keeps 90 across your whole estate for $100 a month.
$0/month
A real tenant. Real history.
$100/month
For teams that need the longer window and more than one subscription.
No. Every permission we request is read-only.
Usually within a couple of minutes of Azure recording it.
In the United States, on Microsoft Azure. Azure encrypts managed database storage at rest by default, and everything is served over TLS.
Hidden by default, and one click away when you want them.
Close your account from inside Kronikl and we delete everything within seven days, then confirm by email. If you simply stop signing in, nothing is deleted: your history stays until you ask. You can also stop collection from a tenant on its own, which leaves the history you already have readable and exportable.
Connect your tenant and Kronikl starts recording within minutes.