Connecting your accounts

You connect each cloud or SaaS account once, under Connections in the portal. Cloud infrastructure (AWS, Azure, GCP) uses a deployed agent with keyless access; DigitalOcean and SaaS suites are agentless.

All access is least-privilege — Vigil requests read/inventory, security-review, and cost permissions, not write access to your workloads. See Trust & security for the full permission model.

A five-minute walkthrough of all six providers — and what actually crosses the line. Watch on YouTube

AWS

Method: CloudFormation stack · Access: keyless IAM role

1. In Connections, choose Add account → AWS.
2. Launch the provided CloudFormation template in your AWS account.
3. The stack deploys the Vigil agent (sidecar + collector + security scanner) and creates an IAM role Vigil can assume — no access keys are created or shared.
4. Data begins flowing within about an hour.

Azure

Method: ARM template · Access: user-assigned managed identity

1. Choose Add account → Azure.
2. Deploy the provided ARM template in your subscription.
3. It provisions a managed identity and the agent (container instances + scheduled triggers).
4. Data begins flowing within about an hour.

Google Cloud (GCP)

Method: pre-filled gcloud script · Access: keyless attached service account

1. Choose Add account → GCP.
2. Run the pre-filled gcloud script in your project (Cloud Shell works well).
3. It deploys the agent to Cloud Run (service + scheduled jobs) with an attached service account granted viewer and security-reviewer roles.
4. Data begins flowing within about an hour.

DigitalOcean

Method: scoped API token · Access: agentless

1. Choose Add account → DigitalOcean.
2. Create a read-scoped DigitalOcean API token and paste it in.
3. Vigil polls the DigitalOcean API on your behalf — nothing is deployed into your account.

Note: DigitalOcean compliance is not yet available. Monitoring, security, cost, and CI/CD are supported.

Microsoft 365

Method: admin consent · Access: agentless

1. Choose Add account → Microsoft 365.
2. Grant admin consent to the Vigil app registration.
3. Vigil reads security, governance, and license-utilization signals via the Microsoft Graph API.

Google Workspace

Method: admin consent · Access: agentless

1. Choose Add account → Google Workspace.
2. Authorize the Vigil connector with a Workspace admin.
3. Vigil reads security, governance, and seat-utilization signals.

After connecting

• Confirm the account appears Connected and is posting data on the portal dashboard.
• If you’re using Access Governance, connect Microsoft 365 or Google Workspace first — it’s the identity anchor that module requires.

Next: The portal