Jeremy PatonPolicy sets the intent. Settings do the work.
A written security policy sets the intent. Technical controls put it into practice. In Microsoft 365, those controls are mostly Microsoft Entra Conditional Access policies, privileged access settings such as Privileged Identity Management (PIM), and Microsoft Intune device compliance and configuration policies.
Getting those controls right once is important. Keeping them right is an ongoing job, because the tenant keeps changing even when the policy doesn't.
How policy drift creates hidden risk
Policy drift happens when live settings move away from an agreed baseline. Microsoft describes configuration drift (opens in a new tab) as the difference between what a baseline defines and the actual settings in a tenant.
It rarely comes from one big mistake. It usually starts with an ordinary operational change, made for a good reason at the time.
| Common drift | How it happens | Why it matters |
|---|---|---|
| Forgotten exclusion | A user or group is excluded from a Conditional Access policy to fix an access issue, and never added back. | An unintended way in that skips MFA or device checks. |
| Report-only left on | A policy is switched to report-only during troubleshooting and never switched back. | The policy records what it would have blocked. It blocks nothing. |
| Coverage gaps | A baseline is assigned to one group and misses another, or new users and apps arrive after the policy was created. | Some people and devices sit outside controls everyone assumes apply. |
| Standing admin access | An administrator is given a permanent role "just for this project" instead of time-bound access through PIM. | A compromised admin account has full access, all the time. |
| Permissive default | Intune's tenant-wide setting treats devices with no compliance policy assigned as compliant. | Unmanaged devices can pass Conditional Access checks meant to stop them. |
That last one isn't a change at all. Out of the box, Intune marks devices with no compliance policy as compliant (opens in a new tab), and the CIS Microsoft 365 Foundations Benchmark (opens in a new tab) recommends switching it to not compliant. New licences, applications and Microsoft feature changes can also leave policies out of step with how the business now works.
Each change may look small. Together, they can leave the business with weaker protection than its policies, leadership reports or last assessment suggest.
Why it matters beyond IT
Most organisations make statements about these controls every year. Board reports say MFA is enforced. Cyber insurance renewals ask whether admin access is restricted. Customer security questionnaires ask whether only compliant devices can reach company data.
Drift makes those statements quietly inaccurate. A forgotten authentication exception can leave an unintended way in. Inconsistent device configuration can mean company data is accessed from devices without the expected protections. And untracked changes make it harder to show which controls were operating when an incident occurred.
A successful assessment tells you where you stood then. Ongoing oversight shows your controls are still working now.
Enforcement needs judgement, not just automation
Detecting a difference is only the first step. The next question is whether it represents unmanaged risk, an approved exception or a legitimate business requirement.
Not every difference should be reversed. Microsoft's Conditional Access guidance (opens in a new tab) expects emergency access (break-glass) accounts to be excluded from policies to prevent lockout, while cautioning that other exclusions should be used sparingly and users added back as soon as possible.
Effective enforcement means keeping agreed controls in place while managing exceptions deliberately. That needs clear ownership, documented approvals and controlled remediation, not blindly resetting every setting. An automatic reversal without context could lock users out or disrupt a critical application. Let automated monitoring do the detecting, and let people decide what happens next.
A five-minute check for your tenant
The Australian Signals Directorate's ASD Essentials for enterprise IT (opens in a new tab) focuses on whether security controls are effective, not simply whether they've been deployed. Under secure configuration management, it calls for approved configuration baselines to be defined and deployed, and for configuration drift to be detected and responded to using scheduled technical assessments and, where supported, automated monitoring. Our Chief Security Officer, Chris Tiqui, covers the wider shift in ASD Essentials: from maturity levels to proof that controls work.
For a Microsoft environment, that means looking beyond whether a policy exists. Ask five questions:
- Is it enabled? A policy left in report-only mode records what it would have done. It doesn't enforce anything.
- Does it cover what it should? Check it applies to the intended users, devices and applications, including ones added since it was created.
- Are its exceptions still justified? Every exclusion should have an owner, an approval and a reason that still holds.
- Is privileged access still time bound? Admin roles should be activated when needed, not held permanently.
- Can you show what changed? You should be able to see when a setting changed, who changed it and whether the change was approved.
If you can't answer one of these with confidence, that's the place to start.
What good looks like
- A documented baseline that maps each Microsoft setting back to the policy it enforces.
- Drift checks on a set cadence, with alerts for high-risk changes such as a policy being disabled or moved to report-only, a new exclusion, or a permanent admin role.
- An exception register where every exclusion has an owner, an approval and an expiry date, so temporary never quietly becomes permanent.
- Remediation through change control, so fixing drift never causes an outage.
- Evidence you can hand over to your board, auditor or insurer showing controls are still working.
How Nueva Technology helps
- 1 · Baseline
Agree what good looks like for your business, mapped to your security policies and to ASD Essentials.
- 2 · Review
Compare your live Microsoft 365 settings with that baseline and separate approved exceptions from unplanned drift. You get a drift report, an exception register and a prioritised remediation plan.
- 3 · Oversee
Monthly drift checks against your baseline, fixes made through change control, and evidence you can share with your board, auditor or insurer.
For existing customers, this turns a one-off security uplift into ongoing oversight. Where your internal IT team runs the environment, we work alongside them in a co-managed model, with full visibility of the tools we use. If you also run Google Workspace, we apply the same baseline and drift-check approach there. Learn more about our Microsoft 365 management service.
Because Nueva Technology works alongside Nueva Cyber, high-risk changes can also feed into security monitoring, so a disabled policy can be treated as a potential incident, not just a configuration issue.
Sources
- Configuration management in Microsoft Entra Tenant Governance (opens in a new tab)
- Plan a Conditional Access deployment (opens in a new tab)
- Device compliance policies in Microsoft Intune (opens in a new tab)
- CIS Microsoft 365 Foundations Benchmark (opens in a new tab)
- Essentials for enterprise IT (opens in a new tab)