Vigil
Know before your secrets expire
Azure has no built-in alerting for expiring secrets, certificates, or keys. When they expire silently, services break. Vigil deploys entirely into your own Azure subscription and sends email and webhook alerts at 90, 60, and 30 days out — giving your team time to rotate before anything goes down.
Expired secrets take down production with no warning
Every Azure Key Vault secret, certificate, and key has an expiry date. When it passes, the services that depend on it fail — authentication breaks, TLS handshakes fail, API calls return 401s. Azure Monitor has no built-in alert type for approaching expiry. Engineering teams cobble together scripts and calendar reminders that get missed, transferred between owners, or simply forgotten during on-call handoffs.
Everything in Your Subscription
Vigil reads only expiry metadata — never secret values. No data leaves your Azure tenant.
Vigil reads only expiry metadata from Key Vault — it never reads, stores, or transmits secret values. Access is granted via User-Assigned Managed Identity with Key Vault Secrets User (read-only) role.
The scanner runs on a schedule you control: daily on Free/Starter/Team tiers, every 6 hours on Business, and every hour on Enterprise. Alerts are deduplicated within a 23-hour window so you never get flooded.
Deploy in under 10 minutes via the Azure Marketplace ARM template. Provisions Azure Functions, Storage, Static Web App, and Azure Communication Services in your resource group.
What Vigil does
Expiry Scanning
Scans all secrets, certificates, and keys across every configured vault. Finds items expiring within your alert window and queues notifications without ever touching secret values.
Configurable Thresholds
Set alert thresholds at 90, 60, and 30 days per vault. Enable or disable individual thresholds from the settings dashboard — no redeployment required.
Email Alerts
Sends alerts via Azure Communication Services Email, running inside your subscription. Configure multiple recipients per vault. All email is sent from your own ACS domain.
Webhook Delivery
POST alert payloads to any HTTP endpoint — Microsoft Teams, Slack, PagerDuty, or a custom handler. Configure per-vault webhook URLs from the dashboard.
Per-Vault Routing
Business and Enterprise tiers support different recipients and webhook endpoints per vault. Route Key Vault A alerts to the platform team and Key Vault B alerts to the security team.
Managed Identity Auth
No API keys or credentials to rotate. Vigil's function app accesses your Key Vaults through a User-Assigned Managed Identity. Add the identity to a vault to start monitoring it.
Built for Azure-native teams
Platform engineering teams managing Azure Key Vaults across multiple subscriptions and environments. Replace manual tracking spreadsheets and calendar reminders with automated scans and routed alerts that reach the right team at the right time.
Security operations and compliance teams that need an auditable trail of expiry notifications. Vigil generates a log of every alert dispatched — timestamp, resource, vault, and threshold — to support compliance evidence requirements.
Healthcare, fintech, and government teams where a certificate expiry triggering a production outage is more than an inconvenience. Vigil runs in your subscription with no third-party data access — secret metadata never leaves your tenant.
Start free. Scale as your vault count grows.
No credit card required to start. Azure resource costs (Functions, Storage, ACS) are billed separately by Azure.
1 vault · Daily scans · Email alerts. Evaluate Vigil at no cost. No time limit.
5 vaults · Daily scans · Email + webhook. Small teams and single-environment setups.
25 vaults · Daily scans · Email + webhook. Multi-environment teams and growing vault inventories.
75 vaults · 6-hour scans · Per-vault routing. Enterprise teams with complex vault topologies.
Unlimited vaults · Hourly scans · Per-vault routing · 4-hour support SLA.
Annual plans available on Starter, Team, and Business tiers — equivalent to two months free. 30-day free trial on paid plans.
Resell Vigil to your managed clients
Vigil is available through the Microsoft Cloud Solution Provider program. CSP partners can provision Vigil SaaS for managed clients and deploy the ARM template into the client’s own Azure subscription. Managed Identity access is granted to the client’s Key Vaults — no AgeeBgee credential ever touches the client’s environment.
Deploy Vigil into your Azure subscription in under 10 minutes — free, no credit card required.