Know when a tenant drifts from your standard
Capture your standard from one tenant, scan every other tenant against it, and see exactly which Conditional Access and device configuration policies changed. Then accept the change or push your standard back.
See which tenants left your standard
Every tenant linked to your template, with the number of drifted policies per config type. Tenants whose last scan is more than a week old are flagged, so nothing quietly falls behind.
See what changed, and decide
Every difference from template to tenant, grouped the way the policy is built: targeting, state, conditions, controls. Push your standard back, or accept the deviation. Nothing changes in a tenant automatically.
Stop chasing config changes
One standard, every tenant
Capture a template from the tenant that defines your standard, then monitor any tenant against it, or against its own captured state.
Every difference, field by field
See what changed from template to tenant, like two users excluded from an MFA policy, or a policy switched to report-only.
You decide, per policy
Accept a deviation, exclude a policy from drift, or push your standard back. Nothing changes in a tenant automatically.
Scan history and activity
Every scan, acceptance and push is recorded, with a timeline per policy of when it drifted and what was done about it.
What it compares
Config Drift covers the policies MSPs change most. For Exchange, Teams, Defender and Purview settings, see UTCM.
Every policy: who it targets, which apps and conditions apply, grant and session controls, and whether it is on, off or report-only.
Intune device configuration profiles and Settings Catalog policies, compared setting by setting.
A template is captured from a source tenant. A baseline links a tenant to a template, or to its own captured state.
How it works
Capture your standard
Create a template from the tenant whose configuration you want everywhere.
Link your tenants
Give each tenant a baseline: your template, or its own current state if it is unique.
Scan
Scan on demand or on a schedule. Each scan compares a tenant with its baseline and lists every difference; scans older than a week are flagged.
Accept, exclude or push
Review each drifted policy. Accept the tenant's version, exclude the policy from drift, or push your standard back. Pushing needs write access to the tenant.
Frequently Asked Questions
What is configuration drift in Microsoft 365?
Configuration drift, sometimes called Microsoft 365 policy drift or Intune configuration drift, is when a tenant’s live settings diverge from the configuration you approved. A policy that was compliant at deployment quietly stops matching your standard.
How does this relate to Identity Security Posture Management (ISPM)?
ISPM tells you whether identity settings are configured well against best practice. Drift detection answers the adjacent question: has a setting changed away from the state you approved? The two are complementary, posture quality versus configuration stability over time.
How quickly are configuration changes detected?
At the next scan. Run a scan whenever you like, or schedule it daily or weekly. Each scan shows exactly what changed from the baseline, and tenants whose last scan is more than a week old are flagged.
Does Config Drift change my tenants?
Only when you push. Scans read configuration, and accepting a deviation or excluding a policy changes nothing in the tenant. Pushing your standard back needs write access to that tenant.
Which settings does it cover?
Conditional Access policies and Intune device configurations, including Settings Catalog policies. For wider coverage such as Exchange, Teams, Defender and Purview, Implora has UTCM.
See which tenants drifted from your standard
Capture a template and run your first scan on the free plan