Tenant Configuration Drift

The question it answers: Which tenant settings have drifted from the approved baseline, and since when?

Which tenant settings - Conditional Access, transport rules, Teams policies, Intune, Purview, Defender - have drifted from an approved baseline, and since when? The settings counterpart of ‘what changed since yesterday’.

Note

An admin creates monitors (with a baseline) once, outside this console - see ‘Set up authentication for Tenant Configuration Management APIs’ on Learn. Monitors run every 6 hours; at most 30 per tenant.

At a glance

Where in the app	Tenant › Defender & Security Operations › Configuration Drift (TCM)
Workload	Security
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed).
Licence	None stated; the Tenant Configuration Management service principal must be set up in the tenant.
Report id (API and MCP)	tenant.secops.configuration-drift

Columns

Column	Key	Type
Severity	Severity	Status
Workload	Category	Text
Resource / monitor	Subject	Link
Check	Setting	Text
Monitor / status	Value	Text
Finding	Finding	Text
Drifted properties	Detail	Text
First reported	When	Date
Active drifts	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: None stated; the Tenant Configuration Management service principal must be set up in the tenant.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
ConfigurationMonitoring.Read.All	Microsoft Graph	Read all Configuration Monitoring entities

Data sources it reads

• GET /v1.0/admin/configurationManagement/configurationMonitors
• GET /v1.0/admin/configurationManagement/configurationDrifts

Through the API and MCP

GET /ir-api/v1/reports/tenant.secops.configuration-drift?size=100

An AI assistant reads it with the MCP tool get_report and the id tenant.secops.configuration-drift. The client needs the Read grant for Security. See Using the API.