How to detect configuration drift in Intune

Three kinds of drift

Drift over time: something changed between last week and today, for example an administrator edited a policy, a script changed settings or a policy was deleted. Drift from a baseline: your policies no longer match the baseline you deployed or the standard you agreed. Drift on devices: a device does not apply what a policy says, which is a device status problem rather than a configuration change.

This guide covers the first two, which are about the configuration in Intune. Device status is covered by Intune's own device and policy reports.

What Microsoft provides

Intune audit logs show who changed which object, when, and which properties changed. Microsoft documents that the Graph API returns two years of audit events and the admin center filter covers up to the previous year. They are the right place to answer who did it, but they do not hold the full policy before the change.

Tenant Configuration Management (TCM) in Microsoft Graph adds monitors that compare the tenant with a baseline you define, across workloads including Intune. Each monitor runs every six hours, a tenant can have up to 30 monitors and 800 monitored resources per day, and resolved drifts are deleted 30 days later. Monitors only report: Microsoft says to resolve drift in the admin centers or by other methods.

• Microsoft Learn: Intune audit logs
• Microsoft Learn: Tenant Configuration Management limits

Compare backups to see every changed setting

The most complete view of drift over time comes from comparing two full copies of the configuration. TenuVault drift detection compares two complete backups, by default your two newest, and lists new, changed and deleted items with each changed setting before and after, with a severity. It compares backups rather than the live tenant, so run a backup first to include the latest changes.

From each change you can restore the previous version as a separate copy on every plan. On Pro and MSP, Revert puts a changed policy back to its backed-up version and Recreate brings back a deleted one, and each action is recorded in the audit log. Results can be exported as CSV or JSON, and MSP can check every tenant at once.

• Intune drift detection with TenuVault
• Drift detection in the docs

Check drift from a baseline

If you deployed OpenIntuneBaseline, Policy Validation in TenuVault checks each deployed policy setting by setting against the baseline: value mismatches, settings missing in the tenant and settings only in the tenant. On Pro and MSP, Fix drift resets a drifted policy to its baseline configuration in place, after a backup, and can be undone.

For your own standard, framework comparisons and policy packs compare Settings Catalog policies with the baseline you import, and Governance tracks deliberate deviations with an owner and reason, so expected differences are not mistaken for drift.

• OpenIntuneBaseline in TenuVault
• How to roll back a bad Intune policy change