The problem.
A support team running several Microsoft 365 tenants gets Defender incidents, reported e-mails, possibly compromised accounts and configuration review requests every day. Each investigation means jumping between portals (Defender, Entra, Exchange, Purview, Sentinel), writing KQL and drafting a report. The goal: cut that time drastically without ever losing control or inventing a conclusion.
What I built.
01
Investigation
- Read-only multi-tenant sign-in (Graph, Exchange, Purview, Teams), tokens kept in memory only; up to 5 tenants connected at once.
- Defender XDR advanced hunting: 30+ method playbooks (AiTM and MFA session theft, OAuth consent, exfiltration, ransomware, AD attacks, service accounts, Copilot…).
- Full account investigation in one call: MFA, risk, roles, sign-ins by IP, malicious mail, clicks, inbox rules, devices, alerts.
- Indicator reputation: Defender Threat Intelligence, VirusTotal, AbuseIPDB, abuse.ch, GreyNoise, urlscan — links are never opened.
- Official MITRE ATT&CK dataset downloaded and checked: no invented technique.
02
Three-level security audit
- Level 1 — AI-free collection (0 tokens, 5–15 min): 33 controls scored on complete lists (MFA, Conditional Access and exclusions, PIM, legacy auth, device code, SMTP AUTH, forwarding, DNS, Intune…).
- Level 2 — device and data add-ons: compliance per OS, LAPS, update rings, DLP, labels, retention; Excel findings, evidence appendix and presentation slides.
- Level 3 — recoverable licences, paid-for but unused security features, governance, score projection, then AI compromise investigation on the most serious leads.
- Score changes explained control by control from one audit to the next.
03
Reliability: the AI is not the source of truth
- Code-level sentinels flag what could not be established: unread page, capped result, inconsistent figure, sudden gap with the previous run.
- Adversarial sampling: up to 30 accounts per stratum re-checked one by one with Microsoft's Conditional Access What If simulator.
- Counter-audit by a second AI, and only a read replayed by the code can correct the collection.
- Fault injection and replay of past collections on every code change to measure detection rate.
04
Monitoring and reviews
- Morning triage, new Defender incident watch, threat-led hunting (Defender TI indicators searched in the tenant).
- On-demand reviews: privileged access, account lifecycle, reported e-mails, exploited vulnerabilities (CISA KEV, EPSS, CERT-FR) matched against the Intune fleet.
- Monthly report for management in plain language; Word and PDF reports; incident summary video with voice-over.
The architecture.
Analystquestion · ticket · attached mail
Vigil agentNode.js · MCP tools
AI engineClaude · ChatGPT · Gemini
Defender XDRKQL hunting
Entra IDrisk · sign-ins
Exchange · PurviewPowerShell
Sentinel · Azurelong-term logs
Code checkssentinels · replay
Reportverdict · MITRE · Word / PDF
Security & guardrails.
- Read-only by default; any proposed action (session revocation, disabling…) goes through a card the analyst approves with one click.
- E-mail or ticket content is treated as data, never as an instruction (prompt-injection protection).
- PDFs rendered with no network access: no image or page of an indicator is ever loaded.
- False positives remembered per tenant, always re-checked against the tenant itself.
The results.
- Used daily for support and security across several Microsoft 365 tenants.
- 400+ commits in six weeks: the tool evolves with every field feedback.
- An investigation that took an hour across portals now takes minutes, with a report ready to forward.
