Configuration drift

What it is

Every secure setup starts with an agreed configuration: which sign-in rules apply, which devices are trusted, how email is filtered. Microsoft calls the written version of this a baseline. Drift is any difference between that baseline and what the tenant is actually doing. Microsoft’s own tenant configuration tools report a drift whenever the live settings differ from what the baseline defines.

Drift is rarely malicious. It comes from ordinary work:

• a policy relaxed to get someone through a deadline and never put back
• a new starter’s laptop that never got enrolled
• an exception for one person that quietly becomes the rule
• Microsoft changing a default or adding a new setting

A common Microsoft 365 example

An administrator switches a Conditional Access policy to report-only mode to troubleshoot a sign-in problem. Microsoft’s documentation explains that in report-only mode a policy is evaluated and logged but not enforced, so users are not prompted for MFA or blocked. The policy still appears in the admin centre and looks as if it is doing something. Until someone switches it back, the business has a control on paper that isn’t working.

Why it matters for a UK small or regulated business

A certificate, an insurance form or a regulator’s questionnaire records what your controls were on the day. Drift means that answer can stop being true weeks later without anyone noticing. It also won’t raise an alert in most MDR services, because a weakened setting is not an attack.

How it is managed

1. Agree and document the baseline
2. Compare the live tenant against it regularly, ideally continuously
3. When a difference appears, decide whether it was intended
4. Put unintended changes back, and update the baseline for intended ones so they don’t keep raising alerts

Microsoft Entra now offers configuration baselines, monitors and drift reports through its Tenant Governance tools. Someone still has to own the decisions.

How &DEV helps: our service plan, available with the Microsoft 365 MOT and the cyber assurance uplift, checks your setup against the agreed baseline all the time and puts drifted settings back.