Release Notes

What's been done?

Revision 53

Ongoing security hardening

A maintenance release focused on platform security — dependency currency and defensive hardening driven by our continuous automated scanning and a follow-up to our external penetration test.

What changed:

  • Dependency & supply-chain updates — Third-party libraries kept current against known advisories, including the Microsoft identity and authentication stack the platform signs you in with
  • Defensive input and output hardening — Extra validation on file and URL handling, and tightened API error responses so internal implementation details are never revealed in an error message
  • Secrets stay in the vault — The platform now fails closed on any legacy plaintext-secret path and never surfaces secret material in configuration or infrastructure outputs; every secret is resolved from the secure store at runtime

These changes build on the independent penetration test reported in Revision 40 and our continuous security scanning. The full remediation detail is available to enterprise customers and auditors on request.

Revision 52

One set of controls — design toward it, prove against it

Until now, three things lived apart in PAA: what a workload should comply with, what your estate actually does, and the designs PAA can generate. The new Cloud Control Framework ties them together. It gives you a single, editable “house” of security controls — poured once at the foundation, inherited upward — that PAA both builds your architecture toward and measures your estate against.

What’s new:

  • A control “house” you can see and shape — PAA ships a sensible default baseline, shaped like an Azure Landing Zone: a tenant-wide Identity foundation, an Azure foundation on top, your Corp / Online / Sandbox structures, and Dev / Test / Prod floors — plus a separate Microsoft 365 house. Controls inherit cumulatively upward, so a requirement declared once — “require MFA” at the Identity foundation — applies to everything above it without being restated. It’s yours to adapt: add or suppress controls at any level from the Edit tab, with each control tagged by where it came from (PAA default or your own override)
  • Assign each workload to where it lives — Point an application from your portfolio at a house level — say Online → Prod — and it inherits exactly the stacked set of controls that level requires. No hand-maintained, per-application control lists that go stale the day you write them
  • New controls arrive as suggestions, never surprises — When PAA improves the default baseline, any newly added controls show up as suggestions you Accept or Dismiss — they’re never silently applied. Your compliance posture never drops overnight because we changed something underneath you
  • Your architecture is generated toward these controls — The same effective control-set grounds PAA’s architecture generation. When you ask it to design or extend a workload, it designs toward the controls that workload must actually meet, instead of a generic design you then retrofit. One set of controls, used in both directions — to build toward and to check against
  • Honest by design — Controls that can’t be proven by an automated scan — organisational or behavioural ones — are marked not verified, never failed, and are left out of your compliance percentage. “Not scanned” never means “non-compliant”

Where to find it:

  • Compliance > Cloud Control Framework — the View, Assign, and Edit tabs
  • Assign workloads from the Assign tab; customise the baseline from the Edit tab

Per-level compliance scores populate after your next assessment. The Azure foundation levels fill in as native Azure checks are mapped onto controls — an ongoing expansion rather than a one-time build.

Revision 51

PAA in the tools you already work in

PAA is now an MCP server — so your AI development tools can talk to it directly. Point a client like Claude Code at PAA and ask about your estate from inside the tool you’re already in: search your findings, check your posture, or evaluate a Bicep file before you deploy it, without opening the platform. And connecting takes no token juggling — you sign in with your Microsoft account and approve, the same way you sign into PAA.

What’s new:

  • Query PAA from your AI client — Any MCP-compatible tool (Claude Code and other agentic clients) can call PAA’s tools on your behalf: search and explain findings, read your compliance and Zero Trust posture, look up a check or a remediation playbook, run an attack-path analysis, generate a compliance evidence pack, and evaluate a Bicep, Terraform, or ARM snippet against your Well-Architected and Azure Policy rules before it ships. It’s read-oriented — the one action it can take, filing a risk-acceptance exception, only ever raises a request a human still approves
  • Sign in, don’t paste tokens — For clients that support it, connecting is a browser sign-in with your Microsoft account and a consent screen — no token to copy, and access refreshes itself. There’s nothing new to register in your Entra tenant; it reuses the login you already have
  • A token option for automation — For CI pipelines or a client without the sign-in flow, generate a personal access token under Settings → MCP Access, paste it once, and revoke it any time from the same page
  • Tenant-isolated and entitlement-checked — Every call is scoped to your workspace and validated against your membership and subscription, exactly as the rest of the platform is. An AI client can only ever reach data for a tenant you belong to, and never touches your Azure or Microsoft 365 environment

Where to find it:

Revision 50

Findings that point at the exact line — and name the policy behind them

When PAA reviews an infrastructure-as-code file, it already tells you what’s wrong and how to fix it. Now every finding also shows you where — the exact file and line — and which Azure Policy it runs up against, so you can jump straight to the code and know whether a change will fail a governance gate before you push it.

What’s new:

  • Jump straight to the line — Each finding from an analysed Bicep or Terraform file now carries the exact source location (file:line) of the resource it concerns. No more scanning a template to find the block a finding is talking about — you land on it
  • The Azure Policy behind the finding — Where a finding maps to a Microsoft built-in Azure Policy, PAA names it: the policy, its effect, and a clear “Blocks deployment” flag when that policy would deny a deployment rather than merely audit it. You learn whether a change will fail a policy gate at review time, not after a failed release
  • Citations you can trust — The policy name and its identifier are attached from a mapping verified against Microsoft’s built-in catalogue and the same native check library that drives your live posture — not inferred on the fly. The identifier is real, so you can look it up, cite it in a change record, or hand it to an auditor

Where to find it:

  • Open any analysed IaC import and expand a finding — the source line sits on the finding, and the Azure Policy block shows the policy, its effect, and the related check

Line references are at the resource level today; policy citations cover the most common misconfigurations and broaden over time.

Revision 49

A workspace organised around your job — and your whole posture on one page

PAA had grown feature by feature, and it showed: related tools scattered across the menu, the same number reported in several places, and no single answer to “how am I doing, and what needs me first?” This release reorganises the platform around what you’re actually trying to do, folds related tools into tabbed hubs, and introduces one page that rolls your entire posture — Azure, Microsoft 365, Zero Trust, identity, and compliance — into a single verdict.

What’s new:

  • Security Posture — your whole estate on one page — A new hub rolls every domain PAA assesses (Azure, Microsoft 365, Zero Trust, identity, and compliance) into a single headline verdict and score. A ranked “Needs you now” queue puts the handful of things that genuinely warrant your attention first — weighing severity, whether a crown-jewel asset is involved, how recent the change is, and whether something that was passing has regressed — and an always-on “What changed” feed shows the posture regressions since you last looked. One glance answers how am I doing and what do I fix first, without opening five different pages
  • A workspace organised around your job — The navigation is regrouped around what you’re trying to do rather than internal feature names, so related work sits together and your muscle memory holds. Related tools are consolidated into tabbed hubs: Identity & Access brings the IAM Auditor, Permission Analyzer, and Usage Visualizer under one roof, and Applications & Capabilities pairs your application portfolio with the capability map. Fewer places to look, the same depth underneath
  • Architecture Chat, front and centre — The always-on architecture-intelligence chat — the surface that reasons over your live estate, cost, and IaC — is named consistently and elevated to the top of the workspace, so the thing that makes PAA always-on rather than a point-in-time report is the first thing you reach for
  • Home opens with your posture — Your home page now leads with a live posture briefing that links straight to the detail, so you land on what matters instead of a wall of duplicated tiles

Where to find it:

  • Security Posture — first in the Security & Compliance group; the verdict, the “Needs you now” queue, the per-domain roll-up, and the “What changed” feed
  • Identity & Access and Applications & Capabilities — the tabbed hubs; your existing links still work
  • The posture briefing sits at the top of your Home page

Revision 48

White-label branding across the platform, not just the reports

MSP partners could already brand their generated reports. Now your brand carries across the platform itself — so the workspace your clients log in to looks like an extension of your practice, not a generic tool.

What’s new:

  • Brand Profile — Set your logo, display name, and colour palette once. They’re applied across the authenticated platform — the shell your clients actually work in — not only on exported documents
  • Inherited across your clients — Your brand flows automatically to the child tenants you manage, so every client workspace and the emails they receive carry your practice’s identity without configuring each one by hand
  • Live in the platform — Branding takes effect in the running UI, applied through the platform’s own theme system rather than a separate skin, so it stays consistent as you move around

Where to find it:

  • Settings > Branding > White-Label (MSP admins)

Custom domain and branded sender email remain on the roadmap.

Revision 47

Compliance attestation — a second framework, auditor-ready evidence, and an honesty check

PAA’s compliance attestation lets you self-attest against a regulatory control set — answering each control while PAA auto-evidences the ones it can prove from your live scans — and produce a signed PDF for your regulator or auditor. This release adds a second framework alongside NIS2, wires an auditor-facing evidence trail into every control, and quietly checks what you attest against what we actually see in your tenant.

What’s new:

  • A second framework — the Dutch NIS2 control set (Cbw) — Alongside the existing NIS2 attestation you can now attest against the ADR/NOREA Cbw control framework: 26 controls across 16 themes, four of them auto-evidenced from your scans. Each control takes a hybrid answer plus an optional 1–5 maturity self-rating — shown for context, never counted for or against your score — and carries its Cbw/Cbb legal reference. The exported PDF is framework-aware: labelled for Cbw, rolled up by theme, with the maturity summary and a CC-BY ADR/NOREA attribution
  • One tabbed attestation hub — NIS2 and Cbw now sit side by side under a single Compliance > Attestation hub, so you switch framework with a tab instead of hunting through the menu. Your existing NIS2 links still work
  • Auditor-facing evidence trail on every control — Each attested control now carries the full chain behind it: the resource, the check that evaluated it, the control and framework it maps to, the confidence and source, any active exception, and how fresh the evidence is. It appears inline in the attestation wizard, in Appendix A of the exported PDF, and as a JSON or CSV export you can hand straight to an auditor. Reviewed controls keep their retained scan evidence, and break-glass and PIM-eligible accounts are recognised so identity controls map honestly rather than being counted against you
  • A consistency check between what you attest and what we scan — When you answer a control by hand in a way that materially contradicts what your latest scan implies — claiming a control you don’t appear to meet, or under-claiming one you already satisfy — PAA flags it inline with a badge and rolls the flagged controls into an acknowledgement at sign-off. It’s non-blocking: the final answer stays yours, but you sign with your eyes open. Active waivers are respected, so a risk you’ve formally accepted isn’t re-flagged
  • Footprint-aware applicability — Controls that only make sense for Azure IaaS no longer clutter your attestation when you don’t run any. If your tenant has no IaaS footprint — no virtual machines, scale sets, or managed disks — those questions are auto-marked Not applicable (score-neutral) and collapsed into a per-theme “Not applicable to your environment” group. Changed your mind, or the scan missed something? Reinstate any of them with one click and answer it yourself

Where to find it:

  • Compliance > Attestation — the tabbed hub with NIS2 and Cbw
  • The evidence trail sits inline on each control and in Appendix A of the exported PDF; export it as JSON or CSV from the same view
  • Consistency badges appear next to affected answers in the wizard and are summarised on the sign-off step

Revision 46

Scheduled reports, weekly digests, and drift re-engagement

Keeping stakeholders informed shouldn’t be a manual chore. This release closes the loop on delivery — your reports go out on a schedule, a weekly digest keeps your team current, and PAA reaches back out when your environment drifts after an assessment.

What’s new:

  • Scheduled report delivery — Put any executive report on a schedule and PAA regenerates it, exports it, and emails you the link automatically on your chosen cadence — no more remembering to re-run and re-send
  • Weekly activity digest — An opt-out weekly email summarising what changed across your findings, assessments, posture drift, and notifications. It suppresses itself when there’s nothing material to report, so it only lands when it’s worth your attention
  • Post-assessment drift re-engagement — After an assessment, PAA watches for meaningful change in your estate and reaches back out when your posture has drifted — a resource-level delta since your last run — so a one-time assessment doesn’t quietly go stale. Opt out any time from the email itself

Where to find it:

  • Schedule delivery from an executive report’s schedule settings
  • The weekly digest and drift re-engagement emails are opt-out; manage them from your notification preferences

Revision 45

Zero Trust posture — measured against Microsoft’s own model

Your Zero Trust assessment now answers two questions a score alone never could: how mature am I, really and what should I fix first. PAA maps its checks to Microsoft’s own Zero Trust Assessment catalogue — the same model Microsoft’s open-source tool uses — and shows you, control by control, where you’re covered, partially covered, or have a gap. Honest coverage, not a vanity number. Two new pillars, a maturity ladder your board can read, and a remediation queue ranked by what’s actually worth doing first.

What’s new:

  • Posture dashboard with a maturity ladder — Every Zero Trust pillar is placed on a Traditional → Initial → Advanced → Optimal ladder, with a per-pillar level, an overall headline, and your weakest pillar called out. It turns “you scored 64” into “you’re at Initial — here’s what reaches Advanced,” a destination leadership can budget against. Lives on a new Posture tab under Zero Trust; your scheduling and trend views move to an Automation tab alongside it
  • Remediation queue ranked by return on effort — Instead of a flat severity list, your Zero Trust gaps are ranked by risk weighed against implementation cost and user disruption, then banded into Do now, Plan this quarter, and Backlog. You start where the payoff is highest, not just where the red is
  • Graded against Microsoft’s Zero Trust Assessment — PAA maps its checks across Entra, Microsoft 365, and Azure to Microsoft’s Zero Trust Assessment catalogue, so your posture is measured against Microsoft’s own definition of Zero Trust. Each control shows as Covered, Partial, or Gap — and the gaps are an honest, prioritised build list, never hidden behind a flattering percentage
  • Stays current with Microsoft — A weekly check watches Microsoft’s upstream assessment for new or revised controls and flags anything not yet mapped, so your Zero Trust coverage doesn’t quietly drift behind Microsoft’s
  • New Network pillar — Global Secure Access — Thirty checks covering Entra Internet & Private Access: traffic-forwarding and filtering profiles, security profiles, Private Access app segmentation, TLS inspection, web content filtering, and Conditional Access integration. PAA reads configuration only — never your network traffic logs — and the checks sit out, score-neutral, on tenants without Global Secure Access licensing rather than counting against you. Requires the read-only NetworkAccess.Read.All Graph permission, added to the onboarding script; existing tenants re-run it once to grant it
  • New AI pillar — A first AI-governance check confirms your AI / Copilot administrative roles have accountable owners. The remaining agent-identity controls are mapped and shown honestly as gaps where the data isn’t yet reachable — no fabricated coverage
  • Deeper Azure network coverage — Twelve new native Azure checks for Application Gateway WAF (Prevention mode, managed and bot rule sets, rate limiting, diagnostics) and Azure Firewall (threat-intelligence and IDPS in deny mode, outbound TLS inspection, diagnostics)
  • Export your posture — One click produces a branded PDF or PowerPoint of the whole Zero Trust posture — maturity ladder, per-pillar breakdown, and the prioritised remediation plan — ready for a stakeholder or a board pack

Where to find it:

  • Zero Trust > Posture — the maturity ladder and remediation queue (scheduling and trends move to the Automation tab)
  • The new Network and AI pillars appear in your next Zero Trust assessment after collection
  • Export from the Posture view as PDF or PowerPoint

Revision 44

Application Portfolio & capability mapping

PAA already knows your cloud in depth. It now turns that knowledge into a standing inventory of your applications — auto-derived from what’s actually deployed, enriched with the business context only you can supply, and rolled up onto a capability map your board can read. The technical foundation for enterprise architecture, built from live ground-truth instead of a spreadsheet that goes stale the day it’s filled in.

What’s new:

  • Auto-derived Application Portfolio — A standing portfolio of your applications, inferred automatically from your Azure inventory rather than hand-maintained. Resources are grouped into applications (by tag, then resource group, then AI inference), and each re-scan reconciles against your decisions — it never deletes an application you confirmed, and only ever marks an unconfirmed one stale. Confirm, rename, merge, or archive applications as you go
  • Obsolescence & tech-debt at a glance — Each application carries an obsolescence signal (e.g. end-of-life App Service runtimes) and a tech-debt count drawn from its open findings. The tech-debt number drills down to the exact findings behind it, each linking straight to the issue — so the count is always defensible, never a black box
  • Business context overlay — Add the layer only you have: owner (picked from your tenant members), business criticality, and a TIME disposition (Tolerate / Invest / Migrate / Eliminate). A single application management drawer handles detail, rename, archive, and the full business form in one place
  • Tenant-editable capability taxonomy — A hierarchical L1→L2 business capability model, seeded from a sensible reference set and fully editable per tenant. Map each application to the capabilities it supports
  • Capability risk heatmap — A board-ready capability map that rolls each application’s risk (severity-weighted open findings, multiplied by business criticality) up onto the capabilities it supports. High-heat capabilities surface in crimson; drill into any tile to see the applications behind it
  • Beyond Azure — non-Azure applications — The portfolio is no longer Azure-only. Applications discovered from your Entra ID (SSO-integrated and gallery apps) appear automatically after your next Microsoft 365 collection, and you can add SaaS or on-premises applications by hand. Non-Azure applications sit on the same capability map marked Unassessed — and a business-critical Unassessed capability is flagged as a coverage gap, so you can see exactly where your assurance stops

Where to find it:

  • Applications in the main navigation — the portfolio, with Source badges (Azure / Entra-discovered / external), the Suggested tab for unconfirmed apps, and the “Add application” action
  • Capability Map in the main navigation — the capability risk heatmap, with drill-down to the applications behind each capability

Revision 43

One finding per control — cross-framework de-duplication

The same underlying control — “require MFA for administrators”, “block legacy authentication”, “require approval to activate a privileged role” — is independently checked by many standards at once (CIS, EIDSCA, SCUBA, Zero Trust, the community check set, and more). Until now that meant the same issue could appear five or six times in your results. It now collapses into a single finding per control, with every contributing check shown as evidence.

What’s new:

  • Overlapping findings collapse into one — When several framework checks verify the same underlying control, they merge into one finding titled by the control instead of repeating the same issue once per framework. Your findings list reflects real, distinct issues — not framework overlap
  • Cross-framework evidence on every merged finding — Each merged finding shows “Verified by N checks across M frameworks” with the exact contributing checks. One glance shows how many independent standards agree a control is failing — strong, defensible evidence to put in front of a stakeholder or auditor. The citations appear on the assessment results, on the finding detail page, and in your PDF and PowerPoint exports
  • De-duplication summary — The assessment overview shows how many overlapping findings were collapsed into how many canonical controls, so the reduction in noise is visible at a glance
  • Cleaner tracking over time — Each control is now tracked under one stable identity, so the same issue no longer re-opens as a brand-new row on every scan and resolves automatically once the control passes — even if a different framework’s check is the one that flags it next time
  • Fewer false positives on privileged access — The privileged-access / standing-access check now recognises your designated emergency-access (break-glass) accounts and accounts that are eligible through PIM rather than permanently assigned — so break-glass accounts are no longer counted against you, and only genuine standing access is flagged

Where to find it:

  • Merged findings and their evidence citations appear across the assessment results, the finding detail page, and your exported reports
  • The de-duplication summary sits alongside the findings count on the assessment overview

Revision 42

Clearer Manual Review reasons & two more automated checks

When a check can’t be evaluated automatically, the platform now tells you why — so “Manual Review” no longer hides whether something genuinely needs your judgement, is waiting on a licence or consent, or simply isn’t reachable from our collectors yet.

What’s new:

  • Manual Review now carries a reason — Every Microsoft 365 check that lands in Manual Review is tagged with why it’s there: Human judgement (a genuinely manual decision — e.g. your sensitivity-label strategy), Licence or consent required (the check works, but your tenant hasn’t granted the access it needs — e.g. the Power BI admin API, or Defender for Office 365 licensing), Platform limitation (not reachable from our collectors today — e.g. controls that depend on the Security & Compliance PowerShell endpoint), or Not yet automated (on our build list). No more guessing whether a Manual Review item is your action, your licensing, or ours
  • Honest posture scoring — Checks we can’t assess because of a missing licence/consent or a platform limitation are now excluded from your score rather than counted against you. Your score reflects what we can actually measure, not gaps in our coverage
  • Two checks now automated — Sign-in to shared mailboxes is blocked (CIS 1.2.2) and Unified audit log is enabled (CIS 7.1.1) now return a real Pass/Fail from data we already collect, instead of asking you to verify them by hand

Where to find it:

  • The reason appears next to the Manual Review status on the Microsoft 365 security results

Revision 41

Governed exceptions & multi-framework coverage

Accept risk on your own terms — with an approver, an expiry date, and a full audit trail — and see how a single piece of evidence carries across every framework you report against.

What’s new:

  • Control Exception Register — Accepting a risk is now a governed, time-limited decision rather than a silent status change. Each exception is anchored to a specific finding or control, carries a reason (and, for a compensating control, a description of the offsetting measure), requires approval, and has an expiry date. When it expires it is reverted automatically — the finding re-opens and the requester and approver are notified — so a risk acceptance can never quietly outlive its mandate. Every request, approval, rejection, revocation, and expiry is kept on an immutable audit trail
  • Approver-gated waivers — Marking a finding Waived or Mitigated now raises a request in the register instead of flipping a status. Owners can approve at the point of request; everyone else raises a request for a separate approver to action. While an exception is active it excuses the affected controls from compliance scoring, and the finding can’t be quietly reopened without revoking the exception first
  • Multi-framework coverage matrix — A single view of your posture across every framework at once, including the ones you cover implicitly: when a control is already evidenced by findings shared with a framework you assessed, that coverage is surfaced as reuse-implied alongside the frameworks you assessed directly
  • Evidence reuse — For any finding, see the full set of framework controls a single piece of evidence satisfies — evidence once, satisfy many — so you can show an auditor exactly how one remediation carries across ISO 27001, SOC 2, NIS2, GDPR, and the rest
  • AI risk identification — Synthesises the most important business-impact risks from your current open findings, grouping related findings into clear risk statements with their linked findings and the framework controls they touch

Where to find it:

  • Exceptions register: the Exceptions page, and the Request exception action on any finding
  • Coverage matrix, Evidence Reuse, and Risk Identification: the Coverage tab on the Compliance Dashboard

Revision 40

Infrastructure security hardening

A focused release on infrastructure security depth and independent external validation.

What changed:

  • Storage encryption hardened — Azure storage accounts now enable infrastructure-level encryption (requireInfrastructureEncryption), providing a second encryption layer at rest. Data is encrypted at both the service layer and the hardware layer simultaneously
  • Cosmos DB: key-based access removed — The account key / connection string authentication path has been fully removed. All database access now runs exclusively through Azure Active Directory (managed identity). No key material in configuration, no rotation required, complete audit trail in Azure AD logs
  • External penetration test — Independent VAPT conducted by CISA.one (11–18 May 2026) against the production platform. Two findings identified (rated Medium and Low; no Critical or High findings), both remediated.

The full remediation plan is available to enterprise customers and auditors on request.

Revision 39

AI token metering & admin controls

What’s new:

  • AI token usage tracking — All agent calls now record input and output token counts against the originating tenant. Usage is captured asynchronously via a dedicated background queue, so it never blocks agent responses or adds latency. Covers all AI-powered surfaces: assessments, chat, IaC generation, executive summaries, and adversarial review
  • Real-time streaming restored — Fixed a regression where streaming agent responses were being buffered before delivery. Chat and workflow outputs now stream token-by-token as the model generates them

Revision 38

Scheduled Azure health checks

Set assessments to run automatically on a recurring schedule.

What’s new:

  • Configurable run schedules — Define recurring cron schedules for automated Azure security scans directly from the tenant settings panel. Standard intervals (daily, weekly, monthly) are available via a guided UI; custom cron expressions are also supported
  • Background execution — A dedicated scheduler picks up scheduled runs, executes the full native Azure security check engine against the configured subscriptions, and stores results as a new assessment run — no manual trigger required
  • Run history — Every scheduled execution is recorded with its start time, duration, finding counts by severity, and completion status. Accessible from the settings panel and queryable via the API
  • Change signal between runs — Each scheduled run compares against the previous run and surfaces newly introduced findings and findings that have been resolved since the last execution

Where to find it:

  • Settings > Azure Health Checks > Schedules

Revision 37

Remediation roadmap & automatic finding resolution

Turn your findings list into a plan. Close what’s already fixed.

What’s new:

  • Remediation roadmap — Assessment results include a Roadmap tab that organises all open findings into a phased remediation timeline. Findings are grouped by priority and estimated effort, with sequencing guided by dependencies and risk reduction impact. Available on Pro tier
  • Automatic finding resolution — When a security scan re-runs and a deterministic check no longer fires, the corresponding tracked finding is automatically resolved. No manual triage needed. Applies to all Azure, M365, and Zero Trust checks that produce findings linked to a specific check ID. Findings that reappear in a later scan are re-opened automatically

Where to find it:

  • Roadmap tab on the Assessment Results page (Pro tier)

Revision 36

External attack surface intelligence

See your infrastructure the way an attacker does.

What’s new:

  • Shodan enrichment — Optional Shodan integration (toggled per assessment in the wizard) queries Shodan for each public IP address and hostname discovered in your Azure subscription. Returns open ports, running services, service banners, and CVEs visible from the public internet — without authentication
  • External exposure checks — Eight EXT-EXPOSE checks evaluate the Shodan data against security expectations: unexpected open ports, unencrypted services on sensitive ports, exposed management interfaces (RDP, SSH, WinRM), and internal endpoints reachable from the internet. Results appear as findings in the assessment alongside native Azure checks
  • External exposure panel — When Shodan enrichment was run, assessment results include a dedicated External Exposure tab with a per-host breakdown of internet-visible services, severity distribution, and matched check findings
  • Attack path analysis — A new engine maps lateral movement paths through your Azure environment, identifying crown jewel resources (Key Vaults, databases, identity services) and the attack paths leading to them from internet-exposed entry points

Where to find it:

  • Enable Shodan enrichment in the assessment wizard (step: Azure configuration)
  • External Exposure tab on Assessment Results
  • Attack paths surfaced as findings in the Security pillar

Revision 35

Compliance framework expansion

Five new frameworks. Agents that know what they just scanned.

What’s new:

  • WAF as a compliance framework — The Microsoft Well-Architected Framework is now a first-class compliance target alongside ISO 27001, NIS2, GDPR, and SOC 2. Findings map directly to WAF pillars, with coverage scores and framework-level gap analysis in the compliance dashboard
  • CAF compliance framework — Cloud Adoption Framework controls added. Useful for organisations in active migration or landing zone build-out phases where architectural alignment to CAF is a delivery requirement
  • Data Pro Code (DPC) — Dutch data processing compliance framework, used by organisations subject to the Data Pro Code agreement. Includes dedicated checks for sub-processor transparency (DPC-SUB) and automated data deletion/retention verification (DPC-RET). Two new Azure storage and Cosmos DB checks were added specifically to produce DPC compliance evidence
  • BIO Clouddiensten & BIO M365 — Dutch Baseline Informatiebeveiliging Overheid frameworks for cloud services and Microsoft 365. Relevant for Dutch public sector organisations and their supply chain. BIO findings map across both Azure and M365 check domains
  • Scan context in agent workflows — During multi-step workflow runs, AI agents now receive a summary of your most recent Azure and M365 scan findings in their context. Agents build on what the scans already know rather than reasoning from scratch, producing more accurate and targeted remediation guidance

Where to find it:

  • Compliance Dashboard > Framework Scores
  • Assessment wizard: framework selection includes WAF, CAF, Data Pro Code, and BIO

Revision 34

Security check depth

More checks, sharper signal — across Azure, Microsoft 365, and Zero Trust.

What’s new:

  • 47 new Azure security checks — Coverage expanded across five domains:

    • Storage (AZ-STOR-009..018): Blob versioning, soft delete, secure transfer enforcement, infrastructure encryption, lifecycle management, network ACL logging, public blob access, and data deletion verification
    • Defender for Cloud (AZ-DEF-011..022): Coverage gaps across 12 Defender plans — App Service, DNS, Key Vault, open-source relational databases, Cosmos DB, Storage, Containers, ARM, and Servers
    • App Service (AZ-APP-009..014): VNet integration, managed identity attachment, deployment slot swap logging, FTP state, minimum TLS version, and remote debugging disabled
    • Virtual Machines (AZ-VM-007..012): Disk encryption status, Desired State Configuration, vulnerability assessment solution, auto-patching, boot diagnostics, and guest OS update settings
    • Application Insights (AZ-APPINS-001..002): Workspace-based configuration and diagnostic settings forwarding

  • 12 new Zero Trust identity gap checks — Covers Conditional Access policy depth, PIM approval workflow configuration, account lockout thresholds, B2B collaboration restrictions, group naming policy enforcement, and password policy settings. Mapped to CIS 4.0 identity controls and surfaced in the Zero Trust dashboard

  • 14 new CIS Microsoft 365 checks — SharePoint (CIS Section 3) and Teams (CIS Section 8) evaluators added to the M365 security check engine. Covers SharePoint external sharing settings, legacy authentication, Teams external access, guest permissions, meeting recording policies, and channel management controls. CIS Section 7 (Purview) and Defender guidance also improved

Where to find it:

  • New findings appear automatically in the next assessment run — no configuration required
  • Check IDs visible on individual findings for audit traceability

Revision 33

Technical debt

It’s all about technical debt this time around! Internal fixes and UX optimization.

Revision 32

Cloud Sovereignty & Digital Independence

Help European organizations assess sovereignty risks and plan cloud migrations away from US hyperscalers. Eight new features deliver AI-powered assessment, actionable migration planning, and compliance mapping for European sovereignty frameworks.

What’s new:

  • Sovereignty Assessment Agent - A new specialized AI agent evaluates your cloud workloads for sovereignty risks. Scores each workload against EUCS, BSI C5, and SecNumCloud frameworks and classifies them as Sovereign-Ready, Partially Sovereign, At-Risk, or Non-Sovereign. Includes data residency analysis, vendor dependency mapping, and CLOUD Act exposure assessment
  • Sovereignty Readiness Questionnaire - Structured intake capturing your sovereignty drivers (regulatory, political, strategic), data classifications, acceptable sovereignty levels, and migration constraints. Covers three sovereignty dimensions: data sovereignty, operational sovereignty, and software sovereignty
  • Cloud Exit Strategy Planner - Generates comprehensive exit strategies with workload portability scoring (Portable/Adaptable/Locked-in), lock-in point identification, migration complexity matrices, cost comparison against European providers, dependency graphs, and phased migration timelines
  • European Provider Knowledge Base - Curated reference database mapping Azure and AWS services to European equivalents including OVHcloud, Hetzner, IONOS, Scaleway, Exoscale, Open Telekom Cloud, STACKIT, and more. Includes certification status, pricing tiers, SLA data, and region coverage
  • Sovereignty Compliance Dashboard - Visual sovereignty posture with overall score (0-100), data residency breakdown (EU/EEA vs non-EU percentages), service portability analysis, vendor diversity scoring, jurisdiction risk indicators, and trend tracking over time
  • Migration Playbook Generator - Step-by-step migration playbooks for VMs, Kubernetes, databases, storage, identity (Entra ID to Keycloak), and monitoring (Azure Monitor to Prometheus/Grafana). Each playbook includes prerequisites, commands, risk assessment, rollback procedures, and estimated downtime. Target any European provider
  • Data Flow & Jurisdiction Mapping - Automated discovery of cross-border data transfers from Azure Resource Graph data. Maps storage replication, CDN endpoints, backup regions, and log analytics locations. Classifies jurisdictions by risk level (EU/EEA adequate, Schrems II risk, restricted). Flags transfers lacking adequate legal basis
  • European Compliance Framework Controls - Adds EUCS (Basic/Substantial/High), BSI C5 (Basic/High), SecNumCloud, Gaia-X Trust Framework, TISAX, and ENS framework controls to the policy-to-framework mapping database. Enables compliance gap analysis: “What do I need to achieve BSI C5 High?”

Where to find it:

  • Sovereignty Dashboard available from the main navigation (Pro tier)
  • Tabbed layout: Overview, Data Flows, Workloads, Exit Strategy, Playbooks
  • European alternatives and provider information available to all subscription tiers
  • Sovereignty assessment can be triggered from the dashboard or via AI chat
  • Migration playbooks generated on-demand with provider-specific customization

Revision 31

Advanced Azure Governance & Scanning

Eight new scanning capabilities complete the full Azure governance suite on the Advanced Scans tab, covering management group visualization, identity auditing, network security, governance change tracking, policy analysis, Landing Zone validation, and drift detection.

What’s new:

  • Management Group Hierarchy - Visualize your entire Azure Management Group tree with governance overlays. See policy assignments, RBAC roles, and subscription counts at every level of your hierarchy. Navigate complex governance structures at a glance
  • Diagnostic Settings Audit - Find resources that aren’t sending logs or metrics to any destination. See coverage percentages by resource type, identify operational blind spots, and prioritize logging gaps across your subscriptions
  • Identity & RBAC Audit - 18 security checks for your identity posture. Detects over-privileged identities, orphaned role assignments, service principal credential expiry, guest user risks, PIM eligibility gaps, and owner-equivalent custom roles
  • Network Security & Topology - Analyze NSG rules for open management and database ports, monitor subnet IP capacity and exhaustion risk, and identify resources missing private endpoint connectivity
  • Azure Governance Change Tracking - See who changed which policies and RBAC assignments, with identity resolution and configurable audit windows (default 7 days). Required for NIS2 compliance
  • Policy Governance Deep Dive - Find orphaned policies and PolicySets, detect deprecated policies, track DeployIfNotExists effect policies, and monitor exemptions approaching expiry
  • Azure Landing Zone Validation - Compare your deployed policies against 25 expected ALZ archetype policies. Detect version drift and missing assignments to ensure your landing zone governance stays complete
  • Configuration Drift Detection - Compare deployed resource configurations against IaC source definitions (Bicep, Terraform, ARM, Pulumi). See expected vs actual values with severity classification for each deviation

Extended Azure Health Check Scans

Five additional scanning capabilities for ARM limits, storage security, resource locks, naming conventions, and service health.

Also includes:

  • ARM Limits & Capacity Planning - Get proactive alerts before you hit Azure subscription limits. Monitors role assignment counts (limit 4,000), resource group counts (limit 980), and tag usage per subscription. Configurable warning threshold (default 80%) with severity classification (Warning/Critical)
  • Storage Security Analysis - Go beyond encryption checks to audit storage account security configurations. Detects anonymous blob access, shared key access enabled, public network exposure, outdated TLS versions, missing infrastructure encryption, and OAuth not set as default
  • Resource Locks Coverage - Find critical resources that aren’t protected by deletion locks. Checks 11 high-value resource types (SQL servers, Key Vaults, storage accounts, VMs, and more) and reports lock coverage percentage with inherited lock resolution
  • CAF Naming Convention Validation - Validate your resource names against Cloud Adoption Framework naming conventions. Checks 12 resource type prefixes (rg-, st, kv-, vnet-, nsg-, vm-, app-, sql-, cr, pip-, lbi-/lbe-, id-) with suggested corrected names for non-compliant resources
  • Azure Service Health Integration - See active Azure platform incidents, planned maintenance windows, health advisories, and security advisories affecting your subscriptions. Impact level classification helps you prioritize response

Where to find it:

  • Compliance Dashboard > Advanced Scans tab
  • All 13 scans are available to AI agents during assessments
  • Each scan supports optional subscription ID filtering
  • Available on Pro tier (Compliance Reporting included)

Revision 30

Microsoft 365 Assessments

PAA now assesses your Microsoft 365 environment alongside your Azure infrastructure. A new M365 Architect agent evaluates your identity, security, collaboration, and compliance configurations against Microsoft best practices.

What’s new:

  • M365 Architect Agent - A specialized AI agent that assesses your Microsoft 365 tenant across four areas: security configuration, compliance posture, identity management, and collaboration governance. Available on Pro plan
  • M365 Security Baseline Questionnaire - 26 structured questions covering Identity & Access Management, Email Security (DKIM/DMARC/SPF, Defender for Office 365), Collaboration Security (Teams, SharePoint, OneDrive), Endpoint Management (Intune), Information Protection (sensitivity labels, DLP), and Security Monitoring (Defender 365, audit logging)
  • M365 Governance Questionnaire - 15 questions evaluating Groups/Teams lifecycle management, SharePoint governance, Exchange governance, Compliance & Data Governance, Operational Governance, and Training & Adoption maturity
  • 4-Agent Assessment Pipeline - M365 assessments run a dedicated pipeline: M365 Architect → Security & Compliance → Identity Governance → Remediation, generating findings with severity classification and compliance framework mapping
  • No Azure Subscription Required - M365 assessments work independently of Azure subscriptions, so you can assess your productivity platform even without connected Azure environments

Where to find it:

  • Start a new assessment and select “M365” as the review type
  • Skip the Azure subscription selection step for M365-only assessments
  • View findings mapped to M365 security baselines and compliance frameworks

Revision 29

Export, Integrations, Collaboration & Multi-Language

The biggest feature release yet. PAA now delivers professional reports, integrates with your ITSM tools, enables team collaboration, and supports multiple languages — everything you need to turn findings into action.

Export & Deliverables:

  • PDF Export - Generate professionally formatted PDF assessment reports with cover pages, executive summaries, WAF pillar scores, findings by severity, compliance mapping, and remediation guidance. Includes your tenant branding
  • PowerPoint Export - Create presentation-ready slide decks for leadership and board meetings with executive summary slides, WAF radar charts, top findings, and actionable recommendations
  • AI Executive Summaries - One-click AI-generated executive summaries tailored for C-level stakeholders. Covers architecture health, key risk areas, critical findings with business impact, priority actions, and compliance implications

Workflow Integrations:

  • Jira Integration - Create Jira issues directly from findings with automatic severity-to-priority mapping. Configure your Jira project, issue types, and custom fields. Test your connection from Settings
  • ServiceNow Integration - Generate ServiceNow incidents and change requests from findings with custom table and field mapping. Supports bidirectional status synchronization
  • Webhook Events - Receive HTTP notifications when assessments complete, findings are created or resolved, or documents are generated. Includes delivery logging, automatic retry with exponential backoff, and event type filtering

Collaboration:

  • Assessment Sharing - Share assessment results with external stakeholders via secure, time-limited links. Set expiration (up to 30 days), view active shares, and revoke access at any time. Shared views are read-only with no PII exposed
  • Comments & Annotations - Discuss findings with your team directly in PAA. Add threaded comments on findings and assessments, @mention team members for notifications, and track discussions alongside remediation
  • Assignment & Ownership - Assign findings to team members with due dates. Bulk-assign from the findings list. Filter by “My Assignments” to see your personal queue

Multi-Language:

  • Multi-Language Documents - Generate documents and executive summaries in English, German, French, or Dutch. Set a default language per tenant or choose per document. AI-powered generation ensures professional-quality output in each language

Where to find it:

  • Export buttons on the Assessment Results page
  • Integration settings under Settings > Integrations (Business+ plans)
  • Webhook configuration under Settings > Webhooks (Team+ plans)
  • Language preference under Settings > Organization
  • Comment threads on Finding Detail and Assessment Results pages
  • Share button on Assessment Results page

Revision 28

Azure Policy-to-Compliance Framework Mapping Database

Your compliance reports just got a major upgrade. PAA now maps Azure Policy definitions to real compliance framework controls, replacing AI-inferred mappings with deterministic, auditor-friendly relationships.

What’s new:

  • Real compliance control catalog - ISO 27001:2022, NIS2, GDPR, and SOC 2 controls are stored in the database with official control IDs, names, descriptions, and sections. No more placeholder text or generic descriptions
  • Azure Policy-to-control mappings - Hundreds of Azure built-in policies are linked to the framework controls they satisfy, with confidence levels (Verified, Inferred, Partial) so you know exactly how trustworthy each mapping is
  • Per-control policy lookup - See which Azure policies map to any specific compliance control (e.g., “which policies satisfy ISO 27001 A.8.24?”)
  • Cross-framework policy view - See all framework controls that a single Azure policy satisfies across ISO 27001, NIS2, GDPR, and SOC 2 simultaneously
  • Mapping statistics - Dashboard-ready statistics showing total controls and policy mappings per framework
  • Admin verification - Admins can review and promote mapping confidence from Inferred to Verified for audit-ready reports

Why this matters:

Compliance reports now show real control names like “A.8.24 - Use of cryptography” instead of generic IDs. Framework coverage comes from your actual Azure Policy enforcement, not AI guesswork. This is the foundation for SOC 2, ISO 27001, and regional compliance assessment templates coming next.

Available via new endpoints in the Compliance API for all plans with Compliance Reporting enabled.

Also includes:

  • Automatic seeding of framework controls and policy mappings on first startup
  • Distributed caching for fast control lookups (1-hour TTL)
  • 37 new backend tests covering parsers, matchers, service logic, and API endpoints

Bug fixes:

  • Fixed “Start Scan” returning silent 400 error - The assessment start button could fail with no visible feedback when Azure configuration validation failed (e.g., due to stale cache across Container Apps replicas). Added a prominent error banner on the Assessments page and diagnostic logging to identify which validation field fails
  • Fixed assessment crash on missing compliance containers - Assessments would fail entirely if the framework-controls or policy-framework-mappings Cosmos DB containers hadn’t been created yet. Both repositories now return empty results gracefully instead of crashing the assessment pipeline
  • Fixed policy-framework-mappings not seeding in deployed environments - The Azure Policy CSV file used by the compliance seeder was not included in the Docker image, so policy mappings were never populated. Added the CSV to the API Dockerfile build
  • Fixed usage tracking flooding logs with 404 errors - The UsageTrackingMiddleware threw unhandled exceptions when the usage Cosmos DB container didn’t exist, producing noisy error logs on every API request. Now logs a single clean warning

Revision 27

Azure Health Checks & Governance Scanning

Go deeper into your Azure environment with four new health check and governance audit scans.

What’s new:

  • Resource Health Monitoring - Real-time availability status for every Azure resource. Instantly see which resources are Unavailable, Degraded, or Unknown, with aggregation by subscription and resource group
  • Orphaned Resource Detection - Find unattached disks, unused public IPs, idle network interfaces, and empty network security groups that are costing you money. Includes estimated monthly cost waste per resource
  • Tag Compliance Auditing - Audit all resources against your required tags (environment, owner, costCenter, etc.). Configure required tags per tenant and see compliance percentages with breakdowns by resource type and group
  • Encryption & HTTPS Enforcement - Verify that storage accounts enforce HTTPS, managed disks are encrypted, App Services use current TLS versions, and SQL databases have Transparent Data Encryption enabled

Available on the new Advanced Scans tab in the Compliance Dashboard for all plans with Compliance Reporting enabled.

Also includes:

  • Tag compliance configuration endpoint for admins to set required tags per tenant
  • Optional subscription ID filtering on all scan endpoints
  • Full AI agent tool integration — agents can invoke all four scans during assessments

Revision 26

WAF Pillar Health Scoring

See at a glance how your architecture measures up across all five Well-Architected Framework pillars.

What’s new:

  • Per-pillar health scores - Each WAF pillar (Reliability, Security, Cost Optimization, Operational Excellence, Performance Efficiency) now has a 0-100 health score derived from your open findings
  • Overall architecture health - A single weighted score that summarizes your entire cloud posture
  • Health ratings - Scores are classified as Excellent, Good, Fair, Poor, or Critical for quick interpretation
  • Trend tracking - See whether each pillar is improving or declining compared to previous assessments
  • Findings drill-down - Click any pillar to see its contributing findings, filterable by severity with full pagination
  • Smart scoring - A logarithmic diminishing returns model ensures that large environments with many findings still produce meaningful, actionable scores rather than collapsing to zero

Available on the WAF Health tab in the Compliance Dashboard for all plans with Compliance Reporting enabled.