// tools/drift

Tenant drift checker

Compare two exports of the same configuration, such as Conditional Access policies from last month and today, or from test and production. You'll see every policy that was added, removed or changed, and exactly which settings changed.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Before (JSON)

load file

After (JSON)

load file

ignore timestamps and IDs that always change

Export something to compare

powershell4 lines

1
2
3
4Connect-MgGraph -Scopes Policy.Read.All
$day = Get-Date -Format yyyy-MM-dd
Get-MgIdentityConditionalAccessPolicy -All | ConvertTo-Json -Depth 10 | Out-File "ca-$day.json"
Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" | ConvertTo-Json -Depth 10 | Out-File "auth-methods-$day.json"

Save an export now and keep it. Next time, compare the new export with it. Lists are matched by id, or by displayName when there's no ID, so policies are compared even when their order changes.

Microsoft Entra also has tenant configuration management features for monitoring drift. See the post on tenant configuration management.