TenuVaultDesktopComparison
Intune audit logs and diffs or drift detection
To find out what changed in Intune, most admins start with the audit log, and some diff exported JSON in Git. Both are useful, and the audit log is the only place that tells you who made a change. What neither shows easily is the full before and after of every setting across the tenant. This page compares the three approaches.
At a glance
- Intune audit logs show who changed which object, when, and which properties changed. They are the right place to answer who did it.
- Diffing exports shows every changed value, but only for what you exported, and it also shows IDs, timestamps and reordered lists unless you normalize them.
- Drift detection compares two complete backups and lists every added, changed and deleted item down to the setting, on every plan.
- TenuVault drift detection compares backups, not the live tenant, so it is only as recent as the newest backup.
- TenuVault drift detection does not say who made a change. On Pro, change digests from the Intune audit log do.
- Restoring the previous version as a copy works on every plan; one-click Revert and Recreate need Pro or MSP.
Side by side
| Question | Intune audit logs | Diff of exports | TenuVault |
|---|---|---|---|
| Who made the change | Yes | No, unless commits record it | Not in drift detection; Pro change digests from the audit log name the admin |
| Full before and after | No; changed properties, with old and new values where the event records them | Yes, for exported objects | Yes, every changed setting with its value before and after |
| Deleted items | A delete event | A file that disappeared | Listed as deleted, with the backed-up version |
| Readable names | Property names | Raw JSON keys and setting IDs | Intune's names for settings catalog settings, written-out names for others |
| Noise | Every event, including assignments | IDs, timestamps and order changes unless normalized | IDs, versions, timestamps and descriptions are ignored |
| How recent | Near real time | As of your last export | As of your last backup |
| Undo | No | Re-import or edit by hand | Restore a copy on every plan; Revert and Recreate on Pro and MSP |
What the audit log is good for
The Intune audit log records each change with the actor, the time, the object and the properties that changed. For questions such as who deleted a compliance policy or who edited a profile last night, it is the right tool, and TenuVault does not replace it.
Its limit is the content. An event lists the properties that changed, with old and new values where it records them, but it does not keep the full policy, so it cannot show the whole configuration at a point in time or put a policy back.
What diffing exports is good for
If your own script exports JSON into Git, every commit is a snapshot and git diff shows each changed value. With pull requests, it also shows who approved a change. For a team that already works this way, it is a strong drift record.
It needs care to be readable. Settings catalog policies store settings by setting ID, IDs and timestamps change on every export, and reordered lists look like many changes. A diff covers only what the script exports.
What TenuVault drift detection does
Drift detection compares two complete backups and lists every added, changed and deleted item down to the setting, on every plan. By default it compares the two newest complete backups, and you can pick any pair. Lists of settings are matched by the setting itself, so a reordered or added setting is reported as that setting. Changes to IDs, version numbers, creation and modification times, descriptions and the reference IDs of encrypted values are ignored, which also means a description change is not shown.
Each change has a severity, and results export as CSV or JSON. Restoring the previous version as a copy works on every plan; one-click Revert and Recreate need Pro or MSP. On Pro, a notification can tell you when a scan finds drift, and change digests from the Intune audit log report who changed what, every 15 minutes by default.
When you do not need TenuVault
Audit logs or diffs are enough when:
- The question you ask most is who made a change, and when.
- You already export to Git, normalize the files and review changes in pull requests.
- You need alerts within minutes, which audit logs sent to Log Analytics or Microsoft's Tenant Configuration Management monitors can give you.
- Changes are rare enough that reading the audit log once a week covers them.
When TenuVault saves you time
Drift detection is worth it when:
- You need the full before and after of every changed setting, not only the property names.
- You want to undo a change from the same screen where you found it.
- You review changes across several tenants, which MSP checks in one pass.
- You want a dated drift report for a change review or an audit.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Can I see who changed an Intune policy?+
Yes, in the Intune audit log, which records the actor, time, object and changed properties of each change. TenuVault drift detection shows what changed between backups, not who changed it.
Can I find Intune drift with Git?+
Yes, if a script exports your configuration to Git regularly. A git diff shows every changed value for the exported objects. Normalize IDs, timestamps and list order first, or the diff shows many changes that are not real.
Does TenuVault detect drift in real time?+
No. Drift detection compares backups, so it is as recent as the newest backup. On Pro, change digests from the Intune audit log arrive every 15 minutes by default while TenuVault runs.
Is TenuVault drift detection free?+
Yes. Comparing backups and exporting drift reports is included in Community for one tenant. One-click Revert and Recreate need Pro or MSP.