Security Compliance Monitor

Challenge

Email authentication reports (DMARC and TLS-RPT) arrive by email, and in most organisations that is where they stay — never archived, never analysed, never watched. Authentication failures and compliance drift go unnoticed until something bounces.

Approach

A scheduled collector pulls the reports from the mailboxes through Microsoft Graph, copes with attachments that arrive without usable filenames, and hands them to a queue. A containerised C# processor on Azure Container Apps scales up from zero when work arrives and back down when it is done. Processing is idempotent: each message is claimed atomically so two runs can never process it twice, and any run interrupted part-way is recovered before new work begins, so no report is lost. Reports are archived to blob storage and their results written to the first-party analytics database, where an analysis layer identifies findings and tracks compliance trends that surface in the internal dashboard and the daily digest. Deployed images are pinned by digest so what runs is exactly what was built; failures and missing runs raise alerts.

Outcome

• Every report archived and analysed automatically — no manual collection
• Authentication failures and compliance gaps raised as alerts, with trends visible over time
• An audit trail of what was collected, when and why — the evidence a regulator would ask for
• No idle compute between runs, and compliance data queryable alongside session and conversion records

Where judgement mattered

• Scale-to-zero containers for bursty work instead of an always-on service
• Atomic claiming and startup recovery, so "at least once" never becomes "twice" or "never"
• Writing results to the shared first-party store rather than a silo, so they can be joined with everything else
• Digest-pinned deployments — reproducible images, no floating tags