Built on the open-source Aura framework
Aura tells you whether your Microsoft 365 security configuration is correct right now. Aura Cloud remembers what it looked like every run before that — so you can see what changed, when it changed, and who changed it.
Run the open-source framework and you get an answer about today: 412 passed, 18 failed, here is how to fix them. That answer is genuinely useful, and it is also gone the moment the next run overwrites it.
The questions that actually cost you time are historical ones. Was this exclusion in place during the incident window? When did that policy stop requiring MFA? Can you show a reviewer twelve months of evidence that the control held? A folder of HTML reports on a share drive is not an answer to any of those.
Aura Cloud is the layer that keeps them. Every run is stored, indexed, and diffed against the one before it.
CA-014 — Require MFA for administrators
excludeGroups: []excludeGroups: ["Break-glass-temp"]Keep the pipeline you already have, or let us run it. Same portal either way.
You already run Aura in GitHub Actions, Azure DevOps, or a scheduled job. Add one cmdlet after the run and the results land in the portal. Nothing else about your pipeline changes.
# existing step
Invoke-Aura -OutputJson results.json
# new step
Publish-AuraCloudResult -Path results.jsonNo pipeline to maintain. Pick a schedule and a region, consent the app in your tenant, and the runner executes the suite and files the results for you. Useful when you are covering tenants you do not build CI for.
Everything here is a question about time, which is exactly what a single run cannot answer.
Every run retained for five years or more, in the Azure region you nominate. Open any date and see the posture as it stood.
Consecutive runs compared field by field. New failures, fixed failures, and settings that moved without changing a result.
Delivered to a Microsoft 365 mailbox when posture shifts, so drift reaches a human without anyone opening a dashboard.
One board across every tenant you manage, ranked by what regressed most recently rather than alphabetically.
Export a control's full history for a date range as a signed report, with run identifiers a reviewer can trace.
Track EIDSCA, CISA SCuBA, CIS, and ORCA coverage as a trend line, not a number you re-derive each quarter.
You are asked to evidence a control's state on a date in the past. Today that means screenshots and hope.
Conditional Access and authentication methods drift quietly. You want the diff the morning it happens, not at the next review.
Thirty tenants, one team. You need the exceptions surfaced rather than thirty reports to read.
Aura Cloud reads configuration. It does not change it, and it does not ask you to hand over a credential that outlives the session.
Browse the open-source framework →The framework stays open source and free. Aura Cloud is the optional layer for teams who need the history kept for them — and it is what funds continued work on the tests themselves.
Tell us how many tenants you look after and we will get in touch when your slot opens.