How it works
From Azure access to a repeatable delivery motion
Cerberus Cloud does not give your MSP another dashboard to monitor. It creates a practical workflow that turns multi-tenant Azure data into prioritised, explainable work your team can deliver.
Step 01
Connect client tenants safely
Grant read-only access through an Azure service principal. There are no agents to install and Cerberus cannot create, change or delete client resources. The connection exposes the inventory, usage, monitoring, cost and billing signals needed for a useful assessment while your delivery team retains control of every remediation decision.
- Reader and monitoring access
- Cost and billing context
- No write permissions
A typical connection takes minutes, so a pilot can begin with two tenants and expand without redesigning the delivery process.
Step 02
Prioritise what is worth doing
Cerberus runs 275+ automated finders across 15 Azure service families. A finding is not treated as useful merely because it exists: the platform ties the technical signal to actual spend, estimates the recoverable value and adds delivery context. Your engineers receive a ranked backlog instead of another unfiltered recommendation feed. Per-category adjustments, such as a discount on commitments or an uplift on licences, keep every figure in line with your CSP invoice, and commitment intelligence groups reservation and savings plan opportunities across clients so you can bundle them for a better discount.
- Impact, effort and risk scoring
- Figures matched to your CSP invoice
- Commitments bundled across clients
Step 03
Execute and prove the outcome
Each prioritised item includes the evidence behind the recommendation, implementation guidance and remediation scripts for your team to review. Once work is completed, Cerberus keeps the finding and savings history connected. That gives account teams a clear record of what was found, what changed and how much value the service delivered.
- Execution-ready guidance
- Savings verification
- Client-ready delivery history
Step 04
Show clients the results under your brand
Give any client its own login to Cerberus Cloud, isolated from your other customers and showing only your name, never ours. You decide which clients get one. Before a review, your team can view as the client to see exactly what they see, and the reports you send carry your branding too.
- Optional login per client
- Your name and branding only
- View as the client
Designed for weekly service delivery
The portfolio view helps service managers decide where the next hour of engineering time will produce the most client value. Delivery teams can work from the ranked backlog, while account managers can use the same evidence to explain progress. Because the operating record persists, the service becomes an ongoing optimisation cadence rather than a report that disappears after a quarterly review.
Human-controlled remediation
Cerberus is intentionally read-only. It identifies opportunities and provides enough context for a qualified engineer to decide whether a change fits the workload, maintenance window and client appetite for risk. Nothing is applied automatically. This separation lets an MSP standardise discovery and preparation without weakening its existing change management and approval controls.
Frequently asked questions
- What access does Cerberus Cloud need to client Azure tenants?
- A standard Azure service principal scoped to Reader and monitoring-read roles. No agent is installed and nothing runs on client infrastructure. Access is granted and revoked from the Azure side, so you can remove it at any time.
- Can Cerberus Cloud change anything in a client environment?
- No. The service principal has no write, modify or delete permissions. Each finding comes with evidence, implementation guidance and remediation scripts for your engineers to review and apply through your normal change process. Nothing is applied automatically.
- Does Cerberus Cloud work with Azure Lighthouse?
- Yes. Cerberus Cloud collects multi-tenant cost and usage evidence through Azure Lighthouse delegation. Because Lighthouse only extends delegated permissions to ARM control-plane APIs, metrics are collected through control-plane endpoints that work fully through delegation. Azure Lighthouse cost management with Cerberus Cloud
- What does Cerberus Cloud check for?
- Cerberus Cloud runs 275+ automated finders across 15 Azure service families. Each finder ties a technical signal to real Azure billing data, so findings arrive with an estimated recoverable value and are ranked by impact, effort and risk. See what each family covers
- Can my clients log in to Cerberus Cloud?
- If you choose. Each client can have its own login, isolated from your other customers and showing only your name, not ours. Your team can view as the client to see exactly what they see, and reports carry your branding.
- Can I bundle reservations and savings plans across clients?
- Yes. Commitment intelligence groups reservation and savings plan opportunities across your portfolio, so you can buy them together for a better discount rather than client by client.
See the workflow against a sample Azure portfolio
We will walk from tenant connection through prioritisation, engineering hand-off and savings verification in 15 minutes.
Book a Walkthrough