Your SaaS stack,
defined as code.

LimberOps imports Microsoft 365, GitHub, Azure DevOps and Jira as code. Preview every change, prove it's safe, get it approved, and undo it in one click. For IT teams, and the MSPs who run IT for everyone else.

Get early access See how it works

Free to start. Read-only first. Nothing applies without your approval.

contoso.onmicrosoft.com / plan #142 · Require MFA for all users

Applied

configuration/conditional-access.yaml+2 −1

 conditionalAccessPolicies:
   - name: Require MFA for all users
-    state: enabledForReportingButNotEnforced
+    state: enabled
     users:
       include: [All]
       exclude:
         - breakglass-01@contoso.com
+        - group: Scanner service accounts
     grantControls:
       builtIn: [mfa]

Sign-in simulation

4/4 passed

CEO · iPhone · SeattleAllowed with MFA
Break-glass accountAllowed · excluded
Copier scan-to-emailAllowed · excluded
Contractor · legacy IMAPBlocked, as expected

Guardrails

Break-glass accounts excluded
MFA never switched off
No admin left without MFA

Approved by Jordan R.

Applied 14:02 · restore point saved

Works withMicrosoft 365Entra IDGitHubAzure DevOpsJiraPulumi

The problem

The admin portal has no undo button.

Teams make high-stakes identity and access changes through screens built for one click at a time. The work is risky, slow to review, and impossible to repeat exactly, and for MSPs it's multiplied by every client.

1 portal per tool

Configuration scattered everywhere

Microsoft 365, GitHub, Azure DevOps and Jira each keep their settings behind their own admin screens. Nobody can say what "standard" means anymore.

0 previews

You find out in production

Admin portals have no dry run. A conditional access change gets tested when the CEO calls from the airport.

0 undo

Rollback is a memory exercise

When something breaks, you rebuild the old setting from screenshots and guesswork. Nobody's sure who changed what, or when.

How it works

One loop for every change. Six steps, zero guesswork.

Every change in LimberOps follows the same path, whether it's one policy in one tenant or a new standard across every platform and client.

Connect a Microsoft 365 tenant

Read-only

Admin consent link

https://login.microsoftonline.com/…/adminconsent?client_id=limberops

Tenant verified · contoso.onmicrosoft.com
Directory and policies: read
Write access: off until you turn it on

Packages

Six packages. Pick the ones your team runs.

Every plan includes Core, the safe change loop. Plans bundle the packages most teams need, and you can add any other one when you're ready.

Core · every plan

Safety is not an upsell.

Connections, inventory and import
Preview, approve, apply
Managed Git repository
Built-in safety guardrails
Audit log and notifications

LimberOpsITOps

Early access

Run Microsoft 365 and Entra as code.

Conditional access and named locations as code
Baseline import and sign-in simulation
People across platforms, explain access
Joiner, mover and leaver plans

LimberOpsPolicyOps

Early access

Hold every change to your rules.

Custom policy packs in YAML
Enforcement levels, waivers and violations
Review rules for who approves what
Compliance evidence and remediation plans

LimberOpsDevOps

Early access

Developer platforms and cloud, as code.

GitHub, Azure DevOps and Jira as code
SaaS apps as code: Clerk, Stripe and more
Azure governance, RBAC and Azure Policy
Change Reviews with file and effect diffs

LimberOpsSRE

Early access

Keep the estate as declared.

Drift detection with adopt and revert
Restore points and one-click rollback
Health rules, scores and maintenance windows
Runbooks and the Automation IDE

LimberOpsSecOps

In development

Prove who can do what.

Secrets in your own Key Vaults, with rotation
Access reviews, dormant and orphaned identities
One audit timeline across platforms
CIS Microsoft 365 security baselines

LimberOpsFinOps

In development

Stop paying for seats nobody uses.

License and seat utilization
Licenses on inactive users
Reclaim plans with a monthly figure
Azure cost, later

Automation IDE

Turn your onboarding checklist into a runbook in minutes.

A Cursor-style editor for runbooks, scripts and configuration, built into LimberOps. Describe the job in plain language and the AI drafts it. Every step that touches a tenant still goes through preview, checks and approval.

Python, PowerShell, Bash or TypeScript steps, with completion per language
AI chat grounded in this tenant's real users, groups and policies
Review findings shown on the lines they concern, before you save
Dry runs in a sandbox, never against a live tenant without approval
Save is a commit: reviewed, versioned and reversible like everything else

Automation IDE

leaver.yaml

1# runbooks/leaver.yaml
2name: Leaver
3inputs: [user, manager]
4steps:
5  - plan: revoke-sessions
6  - plan: block-sign-in
7  - plan: convert-mailbox-to-shared
8    delegate: ${{ inputs.manager }}
9  - plan: reclaim-licenses
10  - approve: it-admins
11  - manual: wipe laptop in RMM

Assistant

Also convert their mailbox to shared and give the manager access.

Added lines 7–8. The manager comes from the runbook inputs, so it works for any leaver.

AcceptReject

Trust

Built to earn access to your clients, not assume it.

You are trusting us with the keys to other people's businesses. These promises come before any feature.

Security details

Nothing applies without your approval

Every change is a plan your own team approves, or a schedule or rule they approved in advance. No AI or teammate pushes a change on their own.

Read-only first

Start with inventory and sign-in simulation. Turn on write access per tenant, only when you are ready.

Your code, your repository

Configuration is plain Pulumi in Git. Export it any time. No proprietary format, no lock-in.

Why switch

Faster than click-ops. Safer than scripts.

Scripts made changes repeatable. LimberOps makes them reviewable, testable and reversible too.

Capability	Admin portal	PowerShell scripts	LimberOps
See the exact change before it ships	No	Partly	Yes
Test sign-ins against the new policy	No	No	Yes
Block known-dangerous changes	No	No	Yes
Approval by a second person	No	No	Yes
One-click rollback	No	No	Yes
Same change, same result, every tenant	No	If maintained	Yes
Who changed what, and why	Audit log	No	Plan, checks, approver
Safe for a junior admin	No	No	Yes

Roadmap

What works today, and what's next.

LimberOps is in early access. Here's what you can use now, and what early customers and founding partners are shaping next.

Early access

Working today

Core: connect, import, preview, approve, apply
ITOps: Microsoft 365 onboarding, conditional access, users
PolicyOps: policy packs, waivers and violations
DevOps: GitHub, Azure DevOps and Jira as code
SRE: drift with adopt and revert, health rules, rollback

Shaped by early customers

Sign-in simulation before identity changes ship
Automation IDE with AI drafting, runbooks
Joiner, mover and leaver plans
MSP plan billed per user
Change Reviews with comments and suggestions

Later

On the roadmap

SecOps: secrets, access reviews, one audit timeline
FinOps: license and seat utilization
Intune and Exchange Online
NinjaOne, ConnectWise, Autotask and HaloPSA
Compliance evidence: CIS, NIST, ISO 27001, SOC 2

Pricing

Free to start. Priced per team, not per resource.

Paid plans start at $499 a month for your whole team. MSPs pay per user. Add any package for $199 a month.

Community

free forever

Try the core loop on one small estate.

Packages

Core

1 operator
2 connections
7 days of history

Get early access

Team

Recommended

$499

per month

For an IT team running its own tenant.

Packages

Core
ITOps
PolicyOps

25 operators
10 connections
1 year of history
Scheduled drift checks

Get early access

Company

$999

per month

Adds developer platforms and SRE.

Packages

Core
ITOps
PolicyOps
DevOps
SRE

100 operators
25 connections
1 year of history
Scheduled drift checks

Get early access

Enterprise

$1,999

per month

Every package, no limits.

Packages

Core
ITOps
PolicyOps
DevOps
SRE
SecOps
FinOps

Unlimited operators
Unlimited connections
Unlimited history

Get early access

MSP

Per user

per user per month, minimum per client tenant

Run many client tenants from one workspace.

Packages

Core
ITOps
PolicyOps

Unlimited client tenants
Unlimited operators
Priced the way you bill clients

Founding partners

Compare plans and packages

FAQ

Questions people ask us

Make your next tenant change the boring kind.

Connect one tenant or organization, read-only, and see its configuration as code before you change a thing.

Get early access MSP? Become a founding partner

Your SaaS stack, defined as code.

Sign-in simulation

Guardrails

The admin portal has no undo button.

Configuration scattered everywhere

You find out in production

Rollback is a memory exercise

One loop for every change. Six steps, zero guesswork.

Six packages. Pick the ones your team runs.

LimberOpsITOps

LimberOpsPolicyOps

LimberOpsDevOps

LimberOpsSRE

LimberOpsSecOps

LimberOpsFinOps

Turn your onboarding checklist into a runbook in minutes.

Built to earn access to your clients, not assume it.

Nothing applies without your approval

Read-only first

Your code, your repository

Faster than click-ops. Safer than scripts.

What works today, and what's next.

Early access

Next

Later

Free to start. Priced per team, not per resource.

Community

Team

Company

Enterprise

MSP

Questions people ask us

Who is LimberOps for?

Which platforms does it cover?

What is a package?

What's in the free plan?

Do I need to know Pulumi, Git or code?

What permissions does LimberOps need?

Can the AI change anything on its own?

What if I stop using LimberOps?

I'm an MSP. Does it work with my PSA or RMM?

Make your next tenant change the boring kind.

Your SaaS stack,
defined as code.