v0.3.0

Security License Lens v0.3.0. See CHANGELOG.md.

v0.2.0 — Complete 10-check pack

Security License Lens v0.2.0

All 10 original checks now evaluate when licensed.

New in Session F

• Sentinel: analytics rule coverage + UEBA/entity analytics (Azure ARM)
• Purview DLP: Secure Score proxy evaluation
• CLI: --workspace-resource-id or subscription/RG/workspace name
• Doctor: optional Sentinel workspace probe

Full pack

Identity (4) · Defender/Endpoint (3) · Sentinel (2) · Purview (1)

Live Sentinel example

licenselens scan --live --auth client_secret \
  --workspace-resource-id "/subscriptions/.../resourceGroups/.../providers/Microsoft.OperationalInsights/workspaces/..." \
  -o reports

Known limitations

• MDO / MDI / Purview may use Secure Score proxies
• Sentinel requires workspace ARM ID + Microsoft Sentinel Reader
• Findings are advisory

See CHANGELOG.md for full history.

v0.1.0 — Identity-first production baseline

Security License Lens v0.1.0

See what you paid for but never turned on.

Highlights

• Live Microsoft Graph auth (device code, client secret, Azure CLI)
• Real SKU → capability mapping with plain-language customer reports
• Identity pack live: Conditional Access, Identity Protection (via CA risk), PIM usage, dormant privileged accounts
• licenselens doctor preflight
• Static HTML / JSON / Markdown output
• Sample report: examples/sample-report/

Install

git clone https://github.com/d4rk-pri0r/licenselens.git
cd licenselens
python3 -m venv .venv && source .venv/bin/activate
pip install -e .
licenselens scan -o reports

Live scan

See docs/app-registration.md.

Defender / Sentinel / Purview checks are registered but not evaluated yet (roadmap v0.2).