Pillar 1 · ChatAdmin · running today · not yet open for sign-up
You say what you want. You do not go and find where it lives. Ask for a resource group, a storage account, a virtual network, a key vault, a Log Analytics workspace or a Container App and ChatAdmin works out the calls, chains the steps and feeds each result into the next. It looks things up without interrupting you. Before it changes anything it stops, shows you the exact call it is about to make, and waits for Approve or Reject. If nobody answers, it declines. Every action goes into an audit trail.
ChatAdmin is designed to execute inside your own Azure subscription — your tenant, your identity, your audit trail, nothing about your estate exported to us. How that works is under where it is designed to run. ChatAdmin is not yet open for sign-up — here is what that means — and if you want to be early, talk to us.
The interface is the product decision, not a wrapper around one. This is a comparison of two interaction models, not a claim that one tool is better than another — the Azure and Microsoft 365 admin portals are comprehensive, and ChatAdmin is not.
If you administer Azure all day and know exactly where everything lives, a portal is a fast tool and we are not going to pretend otherwise.
The honest summary: a portal is better when you are exploring, and a chat is better when you already know what you want and would rather say it once than click it eleven times. The list of what ChatAdmin covers is the other half of that sentence.
Every capability below has been executed against a live Azure subscription — through the chat, behind the approval gate. This list is the whole of ChatAdmin's coverage today: if a resource type is not on it, ChatAdmin does not manage it.
| What you can ask for | Notes |
|---|---|
| List resource groups and resources | Read-only, so it answers immediately — no approval card, because nothing changes |
| Create and manage resource groups | Behind the approval gate |
| Storage accounts | Behind the approval gate |
| Virtual networks and subnets | Behind the approval gate. Subnets you leave out of the request are removed — a sharp edge worth knowing about |
| Key vaults | Behind the approval gate. It manages the vault; it does not read secrets out of it |
| Log Analytics workspaces | Behind the approval gate |
| Container Apps and their environments | Behind the approval gate. This is the one that shows what the chat buys you — a whole environment chained from one instruction |
An agent holding cloud credentials is only as good as what it does when nobody is watching. That is the question this design answers first, and everything else is downstream of it.
Every mutating call stops and raises an Approve / Reject card. The agent loop waits — it does not carry on and reconcile later. If the card is left unanswered for five minutes it is automatically declined and the change does not happen.
Nothing is ever auto-approved. There is no “trusted action” list that skips the card, and no confidence score that lets the model decide it is probably fine.
Verified rather than asserted: an approved change created a real resource group in a real subscription, driven from the browser over the public internet. The decline and time-out paths are covered by the approval-loop tests that ship with the agent.
Looking up what exists runs straight through — you are not clicking Approve to ask a question. The gate sits precisely where the risk is, so it stays meaningful instead of becoming a habit you click past.
The card shows the action and its parameters, so you are agreeing to a specific change to a specific resource. Password and key parameters are masked in the card, and capability results redact secrets before anything is returned or logged.
What was asked for, what was approved or declined, and what the platform did — recorded for every action, whether it went ahead or not.
This is the architectural model, and it is the reason ChatAdmin sits at Level 2 on our ladder. Administering a cloud means acting inside it, so the agent goes to where your resources already are rather than reaching across a boundary to manage them from outside.
Availability: not yet deployed for customers — see availability today.
The same agent, the same approval gate, the same capabilities are running today against a live Azure subscription. It authenticates by managed identity and drives real ARM calls, so the mechanism is real rather than mocked.
There are none in the container. The hosted agent authenticates to Azure by managed identity — the platform hands it a token, so there is no certificate, no client secret and no key file baked into the image to leak, rotate or lose.
The running instance reports its own auth mode, subscription and tool list over an information endpoint, so the claim can be checked rather than taken on trust.
The limits are enforced outside the model, in the dispatcher that every action has to pass through, not by asking the model nicely in a prompt. Out-of-scope actions are refused before any Azure call is made.
Concretely: it will not reach the commercial Marketplace API, it will not mint or hand back credentials, and it will not disclose secret material — not in a chat reply, not in a tool result, not in the audit log.
It also has a dry-run mode in which it does the whole conversation and the whole approval flow and performs no network calls at all.
ChatAdmin is running today, but it is not yet something you can sign up for. Here is what that means for you.
While you wait, there is something you can run right now on the other pillar: Planning Data Auditor, the free check for Microsoft Dynamics 365 Supply Chain Management. It runs in your browser, needs no account and transmits nothing.
ChatAdmin is not yet open for sign-up, and we would rather say that plainly than take a sign-up we cannot yet honour. When it opens, this page changes first.
If you want to be told when it opens, or you would rather argue with the design before it ever comes near your subscription, contact@neopiq.ai reaches a person — and so does 0041 78 223 6716.