Augur Vigil
Continuous Microsoft 365 posture monitoring. Augur assesses a tenant once, Vigil keeps watch and tells you when it drifts.
- PowerShell
- Microsoft 365
Problem
An Augur assessment is a point-in-time snapshot. Tenant configuration keeps changing after it, and exposure can creep back before anyone notices.
Approach
A read-only PowerShell module that re-runs an Augur assessment per tenant on a schedule, stores an accepted baseline, and diffs every run. New or increased exposure is routed to email and webhooks, and resolved findings are reported too. Deterministic, with no AI anywhere in the pipeline and no server to host.
Outcome
v0.1 pre-release. The drift engine and AI-exposure lens are built and tested. The Augur integration and the alert channels are the next seams to wire.
Augur Vigil | Continuous Microsoft 365 Posture Monitoring
Augur Vigil is the continuous-monitoring companion to Augur from Ironwright. Augur answers "how exposed is this tenant right now?"; Vigil answers "did anything get worse since last time?" It re-runs an Augur assessment per tenant on a schedule, keeps a baseline, and alerts when configuration drift raises exposure, before it becomes an incident. It reads tenant configuration only, uses no AI anywhere in the pipeline, and has no server to host.
Version: 0.1.0 | Status: Pre-release | Publisher: Ironwright
How it works
- Collect. Run an Augur assessment against a tenant (read-only Graph).
- Normalize. The AI-exposure lens maps Augur's findings to Vigil's canonical finding shape.
- Snapshot. Write a timestamped JSON record of the current state.
- Diff. Compare against the accepted baseline.
- Alert. Route new or increased exposure to email and webhooks. Resolved findings are reported too, so closed gaps stay visible.
Relationship to Augur
Vigil does not duplicate Augur. It reuses Augur as the single source of truth for
collection and scoring, consuming Augur's findings.json output, with Augur
pinned as a git submodule. When Augur fixes or adds a collector, Vigil benefits
with no code change, because Vigil only ever touches Augur's output.
How it runs
Scheduling is left to the host: Windows Task Scheduler or cron invoking
Invoke-VigilBatch across a GDAP portfolio, with Azure Automation as the
unattended, MSP-grade option. App-only runs use a certificate-based app
registration; MSP runs reuse an existing GDAP delegated session. No secrets,
tenant IDs, or connection strings are committed.
License
Augur Vigil is published by Ironwright. As a security tool, its source is closed. For inquiries, contact Ironwright.
Roadmap
Drift engine and AI-exposure lens are built and tested; the Augur integration and alert channels are the next seams to wire.
Full roadmap →