What's new in MCM v2.0 — one console for everyone, finer access control, inventory drift, new source control and Linux platforms, dashboards, and simpler installs and upgrades

What's New in v2.0

MCM v2.0 is released. Items marked Coming soon are planned for a later release. For the previous version, see What's New in v1.2.

Plan your upgrade. v2.0 introduces a new data foundation, so data from v1.2 is not carried over automatically when you move to v2.0. Expect to re-onboard accounts and recreate policies, budgets, workspaces, and AI conversations. Contact the Revdau team to plan your move.

MCM v2.0 brings one console for everyone, finer control over who can see and do what, inventory drift, new source control and Linux platforms, dashboards you can build yourself or have written for you, and simpler installs and upgrades. Each feature below says what you get and how it works.

🆕 New platforms

v2.0 adds 10 new platforms. They work like the ones you already use — connect once, and they appear in your inventory and the modules that apply. See Supported Platforms for the full matrix.

Platform	Category	What you get
GitLab	Source control	Groups and projects discovered; repositories and branches scanned; cloud or self-hosted
Bitbucket	Source control	Workspaces and repositories discovered and scanned
Debian	Linux server	Discovery, security, compliance policies, and observability
RHEL	Linux server	Discovery, security, compliance policies, and observability
CentOS	Linux server	Discovery, security, compliance policies, and observability
Amazon Linux	Linux server	Discovery, security, compliance policies, and observability
SUSE	Linux server	Discovery, security, compliance policies, and observability
Rocky Linux	Linux server	Discovery, security, compliance policies, and observability
AlmaLinux	Linux server	Discovery, security, compliance policies, and observability
Oracle Linux	Linux server	Discovery, security, compliance policies, and observability

They join AWS, Azure, GitHub, Docker Hub, Docker, and Ubuntu, which keep working as before. Azure now also gets SecOps cloud activity monitoring. The built-in compliance policy content is written for Ubuntu today and runs over SSH on the other distributions; distribution-specific policy packs are planned.

Major features

Inventory Drift

AWS

Azure

Discovery

SecOps

See which cloud resources appeared or disappeared, and who made the change, in a dedicated Inventory Drift job that follows your Audit Log.

MCM reads the cloud audit trail (AWS CloudTrail, Azure Activity Log) to find new and deleted resources and shows who changed them and when.
Inventory Drift runs as its own job and starts by itself after every Audit Log collection or backfill that brought in new events. You can also run it on demand, or rebuild it for a range of months.
Drift history is kept for the Audit Log retention period (6 months by default, configurable per account), and deleted resources stay visible in your inventory for 30 days so you can review them.
Every Inventory Drift run appears in the account's Execution History, and you can export results to Excel, CSV or PDF.
Detecting resources that were edited rather than created or deleted is Coming soon.

More cloud and platform coverage

AWS

GitHub

GitLab

Bitbucket

Docker

Ubuntu

Debian

Red Hat

CentOS

SUSE

Rocky Linux

AlmaLinux

Oracle Linux

Discovery

FinOps

SecOps

Governance

Observability

MCM now covers more of your estate: more Linux distributions, AWS Organizations, GitLab and Bitbucket, and finer control over Docker Hub scans.

Linux servers beyond Ubuntu: onboard servers running Debian, RHEL, CentOS, Amazon Linux, SUSE, Rocky Linux, AlmaLinux or Oracle Linux with an SSH key, alongside Ubuntu. Each server appears in your inventory and your compliance policies (CIS, GDPR, HIPAA, ISO, NIST, SOC 2) run on it over SSH; the built-in policy content is written for Ubuntu today, with distribution-specific packs planned. Runtime and network security can be turned on per host, and logs and metrics appear in Observability. The same installer works on every supported distribution.
AWS Organizations: onboard an AWS management account and choose which member accounts to add, instead of onboarding each one by hand. Member accounts use the parent's consolidated billing report and audit trail, so there is no duplicate setup. Member accounts added to the organization later are onboarded the same way. By default a cloud account cannot be onboarded into more than one Enterprise; administrators can allow it in the installation's configuration.
GitLab and Bitbucket: connect GitLab and Bitbucket accounts, cloud or self-hosted, and have projects and branches inventoried and scanned just like GitHub. You can connect several accounts per Enterprise. Repositories are scanned for exposed secrets, vulnerable dependencies and infrastructure-as-code misconfigurations, on a schedule or on demand, with a scan history for each run. Scanning on every commit or pull request is Coming soon.
Docker Hub image tags and branch selection: choose which image tags are discovered and scan only those versions; the default is latest. For GitHub, GitLab and Bitbucket, choose which branches are inventoried and scanned with branch names or patterns; the default is main. A scan history tab shows every run.

Cost and budgets

FinOps

Platform

Budgets can now span accounts and Enterprises, and cost data is easier to bring in and manage.

Budgets across accounts and Enterprises: create a budget that spans several accounts or Enterprises and alerts on their combined spend. Narrow it to a provider, account, category or resource type.
Suggested amounts: recurring budgets can suggest a new amount each period, based on a recent average or a fixed growth rate, which the owner accepts or dismisses.
Import older cost data: pull up to 36 months of historical cost data when you need it, from your AWS cost and usage reports or the Azure Cost Management API, so trends are available immediately. Re-running a month is safe because existing records for that month are replaced, and if some months fail the others still import and the failures are grouped by reason.
Automatic first backfill: when a FinOps account runs for the first time, MCM backfills the last completed month for you (once), and it shows in Execution History. Accounts that share another account's billing data are filled by the account that owns it, and only that account can run cost jobs or backfills.
Exchange rates in one place: manage one set of exchange rates under Settings, instead of one per Enterprise.
Optional billing: switch billing off for an Enterprise to give it access to every module without assigning a billing plan.

Improved user management

FinOps

Platform

Dashboards

Give people exactly the access they need: roles can be granted down to individual stacks, workspaces, dashboards, budgets, custom tags and governance groups, and staff can sign in with Microsoft Entra ID, OpenID Connect or SAML.

Default roles: 18 default roles (Owner, Admin and Viewer for MSPs and Enterprises, plus Admin and Viewer for Accounts, Stacks, Dashboards, Budgets, Custom Tags and Governance Groups) with a clear permission matrix. Default roles are kept up to date for you and can't be edited; you can create your own roles from individual permissions.
Access down to the individual resource: assign a role to a user for specific Enterprises, accounts, stacks, dashboards, budgets, custom tags or governance groups, and every part of MCM enforces it. A person who only needs one stack, one budget or one dashboard sees only that.
Stacks and workspaces: give users access to specific stacks and workspaces from the stack or workspace's own Users tab, and view their files in place.
Dashboards: share a dashboard from its Users tab, or use the Dashboard Admin and Dashboard Viewer roles to limit someone to just the dashboards they need. They only see, edit and choose as Home the dashboards they have been given.
Budgets: each budget has a Users tab with Budget Admin and Budget Viewer roles; alerts and suggestions go to the budget's users, and people see only the spend inside the scope they can access.
Custom tags: custom tags have their own Admin and Viewer roles.
Users and roles: User Management covers Users, Roles and Single Sign-On (the earlier Teams and Departments screens are removed). Every new user starts with at least one role assignment, each user can have a profile picture with an initials fallback, and deleting a user asks for your confirmation.
Single sign-on: connect your Entra ID tenant (the recommended, fully tested option), or an OpenID Connect or SAML provider, prove you own your email domain with a DNS record, and test the sign-in before turning it on. New users receive the default role you choose (Owner is never granted automatically). You can require SSO for a domain, which turns off password sign-in, except for Owners so you are never locked out. See Single sign-on below.
Allowed email domains: set the allowed domains for your MSP, then narrow them for each Enterprise. Your activation domain is always allowed, and you can change the lists later without re-onboarding.

Audit Log for AWS and Azure

AWS

Azure

Discovery

SecOps

Collect the cloud audit trail for your AWS and Azure accounts automatically, so you always know who did what and when.

Always up to date: MCM reads AWS CloudTrail from your S3 bucket and the Azure Activity Log every 30 minutes, with nothing extra to install in your Azure subscription.
Fast start and backfill: when you turn Audit Log on, MCM collects the last month. You can backfill any range of months later, or run a collection on demand.
You control retention: events are kept for 6 months by default and you can set a different period per account (1 to 36 months); older events are cleaned up daily.
Shared data, safe by design: accounts that read another account's audit data (for example member accounts of an AWS Organization) see the shared events, but only the account that owns the data can run or backfill it.
Full visibility: every collection and backfill appears in the account's Execution History, and each one can trigger Inventory Drift automatically.

A simpler agent for security and observability

AWS

Azure

Discovery

SecOps

Observability

Security and observability now share one lightweight agent, with fewer components to run.

Security data: runtime (Falco), network (Zeek) and host sign-in data from your servers is collected by one agent, and cloud-account audit events are collected by MCM itself. Dedicated pages cover runtime alerts, network monitoring, audit events and findings, and security scans can start automatically after a discovery run.
Simpler Observability agent: Observability uses a single standalone agent, with no extra management server to run, and one installer that works across Linux distributions.
Cloud audit monitoring: AWS and Azure audit collection is covered by the Audit Log feature below.

Single sign-on

Platform

Let your people sign in to MCM with the work accounts your organization already manages.

Entra ID, OIDC and SAML: connect Microsoft Entra ID (recommended, and the most thoroughly tested), any OpenID Connect provider or a SAML provider with the same guided wizard.
Prove your domains: a verified email domain routes its users to your identity provider.
Test before you switch on: a Test sign-in checks the connection end to end before anyone relies on it.
The right access from day one: new users get the roles you set on the connection, and Owner roles are never granted automatically.
Require SSO: turn off password sign-in for a domain; Owners can still sign in with a password, so you are never locked out.

One console and a stronger platform

Platform

MSP and Enterprise screens merge into one console, with platform announcements, guided activation, easier installs and a new data foundation.

One console for everyone: MSP and Enterprise screens are merged into a single console, and navigation follows each user's roles and permissions. Some page addresses change, so update any bookmarks.
Enterprise hierarchy and a picker: organize enterprises as a root with child enterprises, require an owning Enterprise for every cloud account, and use one Enterprise picker in the header to scope the Accounts screens to one, several or all Enterprises.
Platform announcements: administrators publish announcements with a severity and an audience, delivered live, with read tracking.
Guided activation: check your license first, then activate. MCM shows the organization, plan, status and dates tied to your key before anything is saved. If any step fails, everything it created is rolled back and you can simply retry.
Easier installs and upgrades: a new command-line installer supports single-VM and three-tier setups, checks ports, resources and domains before installing, and is safe to re-run. Upgrades are two steps: MCM downloads the new version on your chosen update channel, and an administrator chooses when to install. Your custom domain, certificates and configuration are kept, and you can set a custom domain and TLS from the console.
A new data foundation and API: MCM's data storage is rebuilt so pages load faster and stay reliable at scale. The API is also updated, and some v1.2 API calls are no longer available, so review any scripts or integrations you built on v1.2. Existing v1.2 data is not migrated automatically.

AI Assistant

Ollama

OpenAI

Anthropic

Orchestration

Platform

Dashboards

The AI assistant works inside your access: ask questions, run quick actions, and have it draft dashboards, workspaces, Terraform and policies for you to review before anything is saved.

Quick actions: slash commands such as cost data, resources, policies, create a budget, draft a workspace and create a dashboard run instantly and show a result card for what was done.
Clarifying questions: when a request is missing a decision that changes the result, the assistant asks you in a dedicated panel, with suggested options, before acting.
Dashboards written by AI: describe the dashboard you want and it opens beside the chat with up to four tabs of eight widgets (tables, lines, areas, columns, pies and stat tiles) appearing one by one. Keep chatting to add, change or remove widgets, or add a tab, and watch the dashboard update live. Only widgets that can actually run on your data are created.
Workspaces and Terraform drafted by AI: describe the infrastructure you need and get a workspace draft, optionally with a reusable stack, or generated Terraform files. Nothing is saved until you confirm.
Policy drafts: describe a compliance policy in the same chat and the assistant drafts it straight away for your review before anything is saved.
Stays within your access: the assistant signs in as you, so every question and quick action is checked against your live session and role and it can only read or change what you could in the console. It covers the Enterprises you have selected, and your conversations are private to you.
Fullscreen and history: a fullscreen view with conversation history, and a model picker below the message box.
Provider setup: connect Ollama, OpenAI, Anthropic or Groq from Settings under AI Assistant Setup, test each connection and choose which models your team can use; models from every connected provider show up together, grouped by provider. Provider keys are stored encrypted and never shown again, and only administrators with platform settings access can view or change providers.
Not in this release: questions about SecOps and Observability data.

Dashboards

Platform

Dashboards

One place for every dashboard: eight ready-made dashboards for MSPs and enterprises, dashboards you build yourself from any module's data, a Home page you choose, and an AI assistant that can write a dashboard for you. Every number reflects only what you can access.

Eight ready-made dashboards, there from day one with nothing to set up. Everyone who can read dashboards sees all eight, MSP teams and enterprise users alike, and each shows only the enterprises and accounts your role can reach:
MSP Overview: the whole estate at a glance for MSP teams, with enterprises, accounts, users, resources, month-to-date revenue and growth, module adoption, accounts by provider and an enterprise table.
MSP Billing Dashboard: revenue and subscriptions across your enterprises, with revenue trend and by module, plan distribution, top plans, pending change requests and an enterprise billing table.
Enterprise Overview: one enterprise at a glance, with its accounts, resources, users and compliance score, cost against forecast, spend by provider, and FinOps, SecOps, Governance and Orchestration summaries.
Enterprise Billing Dashboard: an enterprise's current bill and subscriptions, forecast and variance, billing trend, cost breakdown, plan coverage and renewal schedule.
CIO Dashboard: executive cloud spend for finance and leadership, with total spend, spend change and budget variance, spend trend, provider mix, top accounts and budget against actual by department.
Governance: compliance score, non-compliant resources by severity and category, a risk matrix, and a policy explorer, in tabs.
FinOps Overview: cost by provider, cost trend and a cost explorer table, in tabs.
Discovery Overview: resources by provider and type, and a resource explorer table, in tabs.
A Home you choose: set any dashboard you can open as your own Home, and reset it whenever you like.
One list, easy to create and manage: built-in and custom dashboards sit together as cards or a table. Create a dashboard in two steps, add tabs, rearrange widgets, filter by date range, provider, account and region, and duplicate or delete your own.
Widgets from any module's data: choose the data, filters, up to three groupings, up to five measures and the time period, and show the result as a table, line, area, bar or pie chart, or stat cards. Prefer a head start? Pick a prebuilt widget from the gallery.
Dashboards written by AI: describe the dashboard you want and the assistant builds it beside the chat, then keeps refining it as you ask for changes.
Share with the right people: give each dashboard its own list of users and roles, or limit someone to just the dashboards they need with the Dashboard Admin and Dashboard Viewer roles.
Always within your access: results include only the enterprises, accounts and resources you are allowed to see, so two people can see different totals on the same dashboard.

New

Run MCM behind your corporate proxy

Platform

Nexus

Install and run MCM in networks that reach the internet only through an HTTP or HTTPS forward proxy.

Set it at install: the installer asks whether you need a proxy and applies it to the package manager, Docker and MCM itself. The install command in the Nexus portal can include your proxy too.
Change it any time: administrators manage the proxy from a new Proxy tab in Settings, with the HTTP and HTTPS addresses and a list of destinations that bypass it, and watch the progress live.
No downtime surprises: services restart one at a time when the proxy changes, so the console stays available and no data is lost.
Also from the command line: configure or check the proxy on the host with the MCM command-line tool.

Improved

Resource map

AWS

Azure

Discovery

See how your resources relate on an interactive map for each account, from the account down through resource-type groups and VPCs or VNets to the resources inside them.

Parent and child at a glance: related resources are linked, and selecting a node opens the resource.
AWS and Azure: the map is built on demand from your latest discovery data and can be filtered by enterprise, account, provider and region.
Network relationships such as routes, firewalls, VPNs and gateways are Coming soon.

Custom tag compliance and bulk apply

Discovery

FinOps

Governance

Tag suggestions now work in both directions: push a tag down to child resources or pull it up from them, then apply the selected suggestions in bulk. Track compliance per tag, per Enterprise and per account, with clear bands: Good (80% and above), Review (50 to 79%) and Action needed (below 50%).

Cost and compliance overviews

Platform

Start with the big picture before you open the detail tables.

FinOps Overview: total cost and cost by cloud provider, with trends by cloud, account and region over a date range you choose.
Top-N: the biggest (or smallest) contributors to cost by provider, account, region and resource.
Custom Tags report: a tagging-completeness score and cost broken down by the values of the tags you pick.
Governance Overview: an overall compliance score, non-compliant resources by severity, and compliance by policy category and group.
Charts can be switched between chart types where they offer it, and the detailed tables are still one click away.

Run jobs on demand and watch them work

Discovery

FinOps

SecOps

Platform

Start discovery, security scans, cost syncs, backfills, Audit Log collections and Inventory Drift runs from one Trigger menu, and see what is running as it happens.

One Trigger menu: every job you can run for an account is on the account page, with a clear running indicator while it works.
No double starts: a job that is already running cannot be started again.
Live status for you: progress reaches your browser as it happens, and every run lands in Execution History with a Success, Partial success or Failed outcome.
Shared data stays safe: accounts that read another account's cost or audit data point you to the account that owns it, so only the owner can run those jobs.

Cost estimates from live cloud pricing

AWS

Azure

FinOps

Orchestration

Estimates before you apply a change come straight from the AWS and Azure published price lists, with no extra cost tool to install or run.

Never a false zero: resource types without a published price show cost not available instead of zero.
Informational only: applying a plan is never blocked by its estimate.
Setting your own price for a resource type is Coming soon.

What's New in v2.0

What's New in v2.0

🆕 New platforms