Stop being surprised by integrations nobody registered
Logic Apps and Functions in your configured scope are found, flagged and mapped to the data they move, including the ones nobody registered and the ones that exist only as code. On every deploy. In your tenant.
Runs in your tenant · least-privilege · keeps secrets out of its output
The riskiest integration is the one nobody’s tracking
Two years ago someone built a Logic App to push order data to a partner. It worked. They moved on. It still runs every day, still moving customer data to a third party. Nobody owns it. Nobody documented it. And some integrations don’t even show up as running resources yet, a Function sitting in a repo, written and not yet deployed, that no dashboard will ever show you, one pipeline run from production and on nobody’s list. You find out when an auditor asks, when a partner is breached, or when a data request lands and you can’t say where the data went.
Governed, incomplete, or ungoverned, no grey areas
Governed
A manifest exists with an owner and a data classification. Documented, owned, classified.
Incomplete
A manifest exists but is missing an owner or a classification. The exact missing field is flagged wherever it appears.
Ungoverned
A Logic App or Function is running with no manifest at all. Detected live, flagged red, with a page telling the developer exactly what to add.
Most tools only see what’s deployed
Most tools only see what’s deployed. TrueStateRegistry also scans the repositories in your configured Azure DevOps projects and GitHub organizations for Azure Functions code so it catches integrations that exist only as source and were never deployed, the most likely hiding place for shadow integrations in code-first teams.
Code-first discovery scans repos for the definitive Functions marker and reads the source directly, no git clone, no manual config. New repositories are included automatically on the next run, no setup per repo.
Confidence-scored, not noisy, Each Function is classified by its trigger and outputs. Housekeeping and timer jobs are skipped, so you see likely integrations, not every function in the repo.
Deployed + code, reconciled, Azure-deployed resources and in-repo code are compared against declared manifests on every run. What’s unaccounted for shows up red.
One screen tells you where you stand
Posture at a glance, total integrations, and how many are governed, incomplete, or ungoverned.
Data-classification exposure, Restricted and Confidential integrations named individually. Internal and Public summarised.
Criticality breakdown, critical / high / medium / low, colour-coded for instant prioritisation.
Open governance issues, every gap, with the exact missing field.
How it works
Live in three steps, then automatic
Step 1
Add one pipeline to your Azure DevOps project and point it at your resource groups and repos. No platform to host, no agents.
Step 2
It discovers your Logic Apps, Functions and repos, and opens a pull request with draft manifests. About five minutes each to complete.
Step 3
It runs on every deploy, regenerates the catalog, dashboard, diagrams and pages, and flags anything ungoverned.
Runs where your data already lives
In your tenant
Everything runs in your Azure environment. Customer data sent to TrueStateRegistry-hosted services is zero. No telemetry, no licence-server calls.
Keeps secrets out of its output
It does not read Key Vault, app settings or access keys. Every published page, diagram and CSV passes through redaction: known secret patterns and internal hostnames are replaced. You can also set the build to fail when one is detected.
Least privilege
Read-only on Azure: Reader on the resource groups in scope, and read access to the repos. By default it writes only your wiki pages and pull requests for new manifests.
Verifiable
Every page carries the build ID, commit SHA and timestamp that produced it.
Never more than one deploy behind reality
A registry maintained by hand starts lying the moment something changes and nobody updates it. This one regenerates on every release, so it reflects your estate as of your last deploy, not as of whenever someone last remembered to edit a page. Anything new in your configured scope, or anything running without a manifest, shows up red on the very next run.
FAQs
Further reading
Founding pilot
Try it on your own estate. Free for 30 days.
Add one pipeline. TrueStateRegistry discovers your Logic Apps and Functions, compares what it finds with your current integration list, and you get a dated audit pack.
Free. No contract. You keep what it finds.
Your effort: one pipeline and two short check-ins.
Hands-on setup with the engineer who built it, and a direct say in the roadmap.
Prefer to see it first? Book a 30-min walkthrough