What is configuration drift in Microsoft 365?
Checked October 27, 2026 by Accred Consulting
Configuration drift is the gap that opens between the settings a Microsoft 365 tenant should have, its baseline, and the settings it actually has. It usually comes from one-off admin changes, new defaults, and exceptions nobody removes. Catching it needs a recorded baseline, a regular comparison against the live tenant, and a history of who changed what.
Common examples
- A Conditional Access policy switched to report-only or excluded for a "temporary" fix.
- External sharing loosened on a site for one project and never tightened.
- A new admin role assignment that nobody reviewed.
- Devices treated as compliant because no compliance policy was assigned. Intune marks devices with no compliance policy as compliant by default.
- Mail forwarding or inbox rules added to a mailbox outside the normal process.
How to detect drift
- Write down the baseline: the settings each tenant should have and why.
- Snapshot the live settings on a schedule.
- Compare each snapshot with the baseline and with the previous snapshot.
- Record who made each change and whether it was approved.
- Fix the drift, or record it as an accepted exception with an owner.
Microsoft 365 Lighthouse does this for partner-managed tenants with baselines and variance detection against a recommended configuration.
Where Accred helps
- Accred Manage keeps persistent findings and before-and-after snapshots, so meaningful changes and drift stay reviewable for one tenant.
- Accred Fleet (included in Hub) is built to show baseline drift across customer tenants; that source is not connected yet.
- Accred Devices (open in Hub, priced per device) flags Intune configuration and compliance findings per client.
Questions
What causes configuration drift in Microsoft 365?
Mostly one-off admin changes, temporary exceptions that are never removed, new service defaults, and changes made outside the normal approval process.
Are devices without a compliance policy compliant in Intune?
By default, yes. Intune’s tenant setting marks devices that receive no compliance policy as compliant unless you change it.
Does Microsoft 365 Lighthouse detect configuration drift?
Lighthouse baselines detect configurations already present in a customer tenant and variances from the recommended configuration.
Sources
- Overview of baselines in Microsoft 365 Lighthouse · Microsoft Learn
- Microsoft 365 Lighthouse FAQ · Microsoft Learn
- Device compliance policies in Microsoft Intune · Microsoft Learn
Create your organization, then turn on the apps you need.
Hub, Connect, License, and Fleet are free. Manage is free for every role except Viewer, Assess is free to start, and every paid app starts with a 30-day free trial with no card.