INTEGRATION GOVERNANCE AND AUDIT EVIDENCE FOR AZURE
Audit-ready evidence for your Azure integrations.
TrueStateRegistry compares what is in your code with what is deployed in Azure, on every deploy. For each integration it documents what it does, what data it moves, who owns it, and who approved each change through a pull request. The evidence your auditor asks for, generated in your own tenant.
Not a monitoring tool · Runs in your Azure DevOps pipeline · Stays in your tenant · Keeps secrets out of its output
The audit question nobody can answer in five minutes
Which integrations move personal data? Who owns them? Who approved the last change? In most companies the answer lives in an old Wiki page, a spreadsheet and the memory of whoever built it.
Integrations are no longer built by one team. Product teams, platform teams and consultants all ship them, in different repos. Every deploy widens the gap between what is documented and what actually runs. Usually nobody notices until the audit.
Questions your auditor asks. Answers TrueStateRegistry already has.
“Show me your inventory of integrations.”
An Integration Catalog discovered from Azure and your code, including integrations nobody registered
“Who owns this integration?”
Owner and data classification on every integration page. Missing owners are flagged as Incomplete
“Were changes reviewed and approved?”
A change history per integration with author, approver, pull request and build
“Which integrations transfer data, and between which systems?”
Source, target and flow diagrams for each integration
“Can you show me this as of a date?”
A dated audit export (ZIP and CSV) produced on every pipeline run
Evidence for ISO 27001 controls such as 5.9 (inventory), 8.32 (change management) and 5.14 (information transfer).
You maintain a few fields.
TrueStateRegistry discovers the rest.
Discovered automatically, on every deploy
✓ Logic Apps, Functions, APIM, Service Bus, and how they connect
✓ The source and target of each integration
✓ Repository, commit, and full change history
✓ Who approved each change (pull request and reviewer)
✓ Architecture and message-flow diagrams
✓ Run-as identity and Azure resource details
✓ Integrations that exist only as code and were never deployed
Provided once by your team
◦ Business owner
◦ Business purpose
◦ Criticality
◦ Data classification
One engine. The view each team needs.
Same tool, same data, just the view that matters to you.
Compliance and audit
Evidence on every deploy, not the week before the audit. Inventory, owners and approved changes for each integration, exported with a date.
Security
See the integrations moving your data, including the ones nobody registered, and who is accountable for each.
Integration teams
Documentation that writes itself from the code you already ship. No manual Wiki pages, diagrams or spreadsheets to keep in sync.
What TrueStateRegistry is not
TrueStateRegistry does not monitor messages or replace your monitoring tool. It works next to Application Insights, Nodinite or Turbo360. It is not a compliance platform either. It provides the integration evidence your ISO 27001 and security work keeps asking for.
Every integration has a state
Governed
A manifest exists with an owner and a data classification. Documented, owned, classified.
Incomplete
A manifest exists but is missing an owner or a classification. The exact missing field is flagged wherever it appears.
Ungoverned
A Logic App or Function running with no manifest at all. Detected live and flagged red for the developer to fix.
Four living pages, regenerated on every deploy
Integration Catalog every integration in one table: environment, criticality, source, target, classification, owner, status.
Governance Dashboard posture at a glance, data-classification exposure, criticality, open issues.
Per-integration pages architecture and message-flow diagrams, business and technical views, sample payloads.
Change history with approver who changed each integration, when, and who approved it via which PR.
One pipeline. Evidence on every deploy.
Step 1
Add one pipeline to your Azure DevOps project. TrueStateRegistry runs in your tenant with read-only access to Azure and your repos.
Step 2
TrueStateRegistry discovers and compares. It finds Logic Apps and Functions in Azure and in your code, and marks each one Governed, Incomplete or Ungoverned against its manifest.
Step 3
Your Wiki and audit pack update themselves. One page per integration, a catalog, a governance dashboard and a dated audit export. No manual Wiki, diagram or evidence-pack maintenance.
Developers touch one small file. The pipeline does the rest.
Documentation go stale because updating it is a chore. So we removed the chore. Developers fill in one small file with owner, criticality, classification, a one-line description. Everything else is discovered automatically. Five minutes once; then it maintains itself.
Runs where your data already lives
In your tenant
Everything runs inside your Azure environment. Nothing is sent to us. No phone-home.
Keeps secrets out of its output
It does not read Key Vault, app settings or access keys. Every published page, diagram and CSV passes through redaction: known secret patterns and internal hostnames are replaced. You can also set the build to fail when one is detected.
Least privilege
Read-only on Azure: Reader on the resource groups in scope, and read access to the repos. By default it writes only your wiki pages and pull requests for new manifests.
Verifiable
Every page carries the build ID, commit SHA and timestamp that produced it.
Never more than one deploy behind reality
A registry maintained by hand starts lying the moment something changes and nobody updates it. This one regenerates on every release, so it reflects your estate as of your last deploy, not as of whenever someone last remembered to edit a page. Anything new, or anything running without a manifest, shows up red on the very next run.
Founding pilot
Try it on your own estate. Free for 30 days.
Add one pipeline. TrueStateRegistry discovers your Logic Apps and Functions, compares what it finds with your current integration list, and you get a dated audit pack.
Free. No contract. You keep what it finds.
Your effort: one pipeline and two short check-ins.
Hands-on setup with the engineer who built it, and a direct say in the roadmap.
Prefer to see it first? Book a 30-min walkthrough