What is configuration drift in Microsoft 365?
Checked October 27, 2026 by Accred Consulting
Configuration drift is the gap that opens between the settings a Microsoft 365 tenant should have, its baseline, and the settings it actually has. It usually comes from one-off admin changes, new defaults, and exceptions nobody removes. Catching it needs a recorded baseline, a regular comparison against the live tenant, and a history of who changed what.
Common examples
- A Conditional Access policy switched to report-only or excluded for a "temporary" fix.
- External sharing loosened on a site for one project and never tightened.
- A new admin role assignment that nobody reviewed.
- Devices treated as compliant because no compliance policy was assigned. Intune marks devices with no compliance policy as compliant by default.
- Mail forwarding or inbox rules added to a mailbox outside the normal process.
How to detect drift
- Write down the baseline: the settings each tenant should have and why.
- Snapshot the live settings on a schedule.
- Compare each snapshot with the baseline and with the previous snapshot.
- Record who made each change and whether it was approved.
- Fix the drift, or record it as an accepted exception with an owner.
Microsoft 365 Lighthouse does this for partner-managed tenants with baselines and variance detection against a recommended configuration.
Where Accred helps
- Accred Manage keeps persistent findings and before-and-after snapshots, so meaningful changes and drift stay reviewable for one tenant.
- Accred Fleet (in development) is being built to show baseline drift across customer tenants.
- Accred Devices (in development) flags Intune configuration and compliance findings per client.
Questions
What causes configuration drift in Microsoft 365?
Mostly one-off admin changes, temporary exceptions that are never removed, new service defaults, and changes made outside the normal approval process.
Are devices without a compliance policy compliant in Intune?
By default, yes. Intune’s tenant setting marks devices that receive no compliance policy as compliant unless you change it.
Does Microsoft 365 Lighthouse detect configuration drift?
Lighthouse baselines detect configurations already present in a customer tenant and variances from the recommended configuration.
Sources
- Overview of baselines in Microsoft 365 Lighthouse · Microsoft Learn
- Microsoft 365 Lighthouse FAQ · Microsoft Learn
- Device compliance policies in Microsoft Intune · Microsoft Learn
Create your organization, then turn on the apps you need.
Hub, Manage, and the Connect preview are free for your whole team, and Assess is free to start.