What ASTRAL Does
ASTRAL takes regular snapshots of your Microsoft 365 configuration — Conditional Access policies, Intune compliance and configuration profiles, admin role assignments, authentication methods, cross-tenant access settings, privileged groups, and more — and stores them as versioned files in a Git repository.
Configuration Snapshots
Regular, automated snapshots of your entire M365 configuration stored as human-readable JSON files in Git. Coverage includes Conditional Access, Intune, Entra ID roles, PIM policies, authentication methods, cross-tenant access, identity protection policies, and more.
Drift Detection & Pull Requests
When configuration changes between snapshots, ASTRAL opens a Pull Request in Azure DevOps showing exactly what changed in a human-readable diff. If Azure OpenAI is configured, it adds a plain-English narrative explaining the change and its implications.
Reviewable Approval Trail
PRs can be reviewed, commented on, and approved or rejected by the team. This is lightweight change management built on infrastructure you already use. Every decision is timestamped and reviewer-attributed — audit evidence ready without extra tooling.
Baseline Restore
If a drift PR is rejected, a pipeline can automatically restore the previous configuration. The Git baseline is the source of truth. "What do we restore to?" becomes a deterministic operation, not an emergency reconstruction exercise.
MCP Server
ASTRAL exposes its snapshot data via the Model Context Protocol, enabling AI assistants to query configuration history, compare policy states, and surface drift in natural language. AURORA uses this interface for cross-tool diagnostics.
Coverage
ASTRAL currently covers the following M365 workloads:
- Entra ID — Conditional Access policies, authentication methods, authorization policy, security defaults, cross-tenant access, external collaboration settings
- Entra Roles — Permanent and PIM-eligible role assignments, PIM governance policies, privileged group membership with delta tracking
- Intune — Compliance policies, device configuration profiles, enrollment restrictions
- Identity Protection — Sign-in risk policy, user risk policy, MFA registration policy
- Reports — Nightly generated Intune and Entra documentation, committed to the repository automatically
Phase 2 (planned): UTCM API integration covering Exchange Online, Teams, Defender, and Purview — 249 additional resource types via a single API surface.
Bring Your Own AI
AI PR narratives use any OpenAI-compatible endpoint — Azure OpenAI, Ollama (local), Groq, or others. ASTRAL is fully functional without AI. The narratives are an enhancement, not a dependency.
What This Gives You Strategically
Configuration decoupled from Microsoft’s control plane. Once M365 configuration lives in Git, it is data you own. The history, the review workflow, the approval trail — none of it depends on Microsoft’s tools. Gitea, GitHub, GitLab, or a self-hosted instance are all valid targets.
Disaster recovery baseline. The Git history is not just evidence — it is a rebuild blueprint. If a CA policy is catastrophically misconfigured or bulk changes are made by a compromised account, the previous known-good state is in Git and the restore pipeline applies it deterministically.
Compliance evidence. ASTRAL’s Git trail maps directly onto NIS2 Article 21 (configuration management), DORA Article 11 (ICT change management), GDPR Article 5(2) (accountability principle), and ISO 27001 A.8.9 (configuration management). External auditors receive timestamped, reviewer-attributed evidence — not manual screenshots.
Institutional knowledge capture. Every PR comment, AI narrative, and approval decision is a searchable, permanent record of why a configuration choice was made. Teams without this lose institutional knowledge every time personnel changes.
Deployment Model
ASTRAL runs entirely within your Azure DevOps organisation and Microsoft tenant:
- One ADO project
- Three pipelines (backup, review sync, restore)
- One Entra app registration (read-only Graph permissions + targeted Intune read)
- One variable group
No data leaves your environment. No CQRE infrastructure is involved. No ongoing licensing.
Ready to deploy ASTRAL?
Full deployment guide, bootstrap scripts, and pipeline YAML are on GitHub.