onGuard for Entra ID

Know what is in your Microsoft Entra ID tenant, see what changed, and keep the evidence in your own AWS account.

onGuard for Entra ID deploys a small stack into your AWS account: an AWS Lambda function on a daily schedule, an S3 bucket you own, and an IAM role. Every day it reads Microsoft Entra ID and Microsoft 365 data through Microsoft Graph and writes 37 extracts in 9 areas to your bucket, as JSON and CSV files partitioned by area and date: users, groups and memberships, roles and privileged role policies, devices, app registrations, service principals and consent grants, conditional access and authentication methods, sign-ins and directory audit logs, risk detections, Secure Score and tenant security settings, licenses, SharePoint sites, and Microsoft 365 usage reports. The portal documents every field of every extract.

What you get

• Watch notifications. Optional alerts, turned on by your admin, for changes such as new app consents, permissions and credentials, role assignments and PIM activations, group membership and owner changes, guest invitations, security info and MFA changes, conditional access, domain and federation changes, and risky sign-ins. Each notice explains the change and asks "Was this expected?" (or "Was this you?" for the person whose sign-in was flagged), so an unexpected change is caught the same day.
• Security posture report, every tier. Findings, Secure Score and what changed since the last report, as PDF, HTML and JSON.
• Compliance readiness reports, Professional and Enterprise. Map your collected evidence to industry security benchmark and NIST SP 800-53 Rev. 5 controls, with a status for each control. These are readiness assessments, not a certification, attestation or audit opinion. Report files are kept in an S3 bucket in your account with Object Lock, and you can give an auditor read-only access that expires (30 days by default, at most 180). Additional framework mappings are on the roadmap.
• Qlik Cloud apps, Professional and Enterprise. Prebuilt analytics apps on the same data.

How onGuard handles your data and access

• Your extracts stay in your AWS account. The daily extracts are written only to your S3 bucket (encrypted at rest, public access blocked); IPC Global does not keep a copy.
• What IPC Global stores. Your account, subscription and configuration, collection run status, report metadata such as file hashes, and the names and email addresses of the people who receive notices. When Watch is on, each notification is also stored in the onGuard service for up to 400 days, including who made the change (user principal name and IP address) and, for risky sign-ins, the reported location, so notices can be delivered, answered and reviewed. Only your guardians and admins see those details.
• Read-only data access. Your admin consents once to the onGuard Microsoft Entra app. Data is read with read-only Microsoft Graph application permissions; the consent screen also lists Application.ReadWrite.OwnedBy, which only lets the onGuard app manage its own credentials. onGuard does not change your tenant: no remediation, no identity management, no policy changes.
• You choose the sources. Turn each extract on or off on the Configuration page to match your data minimization policy. Some extracts need Microsoft Entra ID P1 or P2.
• Built for Microsoft Graph limits. Throttled and transient Graph responses are retried, honoring the wait time Microsoft returns.
• No lock-in. Extracts are plain JSON and CSV, readable with Amazon Athena or any tool that reads S3. If you cancel, the bucket and its files stay in your account.

Pricing

One monthly contract on your AWS bill, one tier per subscription, no per-user or per-row metering. Every tier includes every extract.

• Data Collection, 299 USD per month: all extracts, Watch and security posture reports.
• Data Collection + Qlik Apps, 999 USD per month: adds the prebuilt Qlik Cloud apps, compliance readiness reports and email alerts on collection failures.
• Data Collection + Qlik Apps + Expert Hours, 2,999 USD per month: adds up to 10 hours per month of IPC Global expert consulting and support (unused hours do not roll over) and priority support.

Trials and additional expert hours are available through a private offer. AWS charges for the resources in your own account are separate.

Support: support@ipc-global.com , Monday to Friday, 8:00am to 6:00pm US Eastern, excluding US holidays. Target first response is 1 business day, and 4 business hours for critical issues.

Benchmark and standard names belong to their owners; onGuard is not affiliated with or endorsed by them. Built and operated by IPC Global, a Data, Analytics, AI, and Cloud services company.