Your Microsoft 365 Security Baseline Will Drift. Here's How to Catch It

A Microsoft 365 tenant that follows security best practice today will not stay that way on its own, so the real work is capturing a baseline, checking regularly for changes against it, and watching the identity signals that show someone is trying to get in.

A client recently asked us for more than a one-off security review. Their tenant already followed best practice. What they wanted to know was whether it would still be that way next month, and they asked for both automated checks and human review. This article explains why that request makes sense and how the work is put together.

The short answer

Treat security as a known-good state you can measure against. Record the settings that matter, compare the live tenant with that record on a schedule, investigate every difference, and keep an eye on sign-in activity in between. Automation finds the change; a person decides what it means.

Why a secure tenant drifts

Nobody sets out to weaken their own security. Drift happens in small, reasonable-sounding steps:

• A Conditional Access policy is switched to report-only while someone troubleshoots, and never switched back.
• An exclusion is added for one user or one location, then forgotten.
• An administrator role is granted for a project and outlives the project.
• A new app or service is connected with broader permissions than it needs.
• A setting changes because a vendor or consultant needed it for an afternoon.

Each change may have been approved at the time. The problem is that nobody compares the result with what the tenant was supposed to look like.

Step 1: capture the baseline

A baseline is a written, dated record of how your tenant should be configured, agreed by whoever is accountable for security. For most organisations it covers:

1. Conditional Access policies: which exist, what they apply to, and every exclusion.
2. Multifactor authentication: how it is enforced and for whom.
3. Privileged roles: who holds Global Administrator and the other admin roles, and why.
4. Sign-in protections such as account lockout settings.
5. Mail flow and forwarding rules, and external sharing settings in SharePoint and OneDrive.
6. App registrations and consented applications with high permissions.

Microsoft now offers tenant configuration management in Microsoft Entra that can take a snapshot of tenant settings, use it as a baseline, and report drift when the live configuration no longer matches. Availability depends on your licences, and a snapshot only helps if someone has agreed that it represents the right configuration in the first place.

Step 2: check for changes, regularly

Comparing the live tenant with the baseline should happen on a fixed schedule, not only after something goes wrong. Each difference falls into one of three groups:

• Approved change: update the baseline and record who approved it.
• Unapproved but harmless: reverse it or approve it formally, so it stops appearing.
• Unexplained: treat it as a possible incident until proven otherwise.

An edited Conditional Access policy deserves particular attention. Turning off a single policy can remove multifactor authentication for a whole group of users without any visible sign to them.

Step 3: watch the identity signals

Configuration checks tell you what changed. Sign-in data tells you who is trying their luck. The signals worth reviewing include:

• Risky sign-ins: sign-ins Microsoft Entra flags as unusual, such as unfamiliar locations or leaked credentials. The most detailed risk reporting needs Microsoft Entra ID P2.
• Failed password attempts: repeated failures against the same accounts, or a few failures spread across many accounts, which is the pattern of password spraying.
• Account lockouts: Microsoft Entra smart lockout is on for every tenant and, by default, locks an account for one minute after 10 failed sign-ins, then for longer if the attempts continue. A cluster of lockouts is a signal in itself.
• Changes made by administrators: the audit log shows who changed what, and when.

Timing matters because these logs do not last forever. Microsoft Entra keeps sign-in and audit logs for seven days on the free tier and 30 days with Entra ID P1 or P2. If a review only happens once a month on a free-tier tenant, most of the evidence is already gone. Logs can be kept longer by sending them to Azure storage or a Log Analytics workspace.

Why automation and people both matter

Automation is good at noticing. It does not get tired, it checks every setting the same way each time, and it catches a change as it happens.

People are good at judging. A script can report that a Conditional Access policy was edited. It cannot tell whether that edit was the approved fix discussed in last week's meeting or the first step of an attack. That needs someone who knows the organisation, the change history and who to call.

Relying on automation alone produces alerts nobody reads. Relying on people alone produces reviews that happen when someone has time. The arrangement that works is automated checks feeding a short, regular human review with a clear owner.

A simple routine to start with

1. Agree and record the baseline, with a date and an owner.
2. Set up automated comparison against it, and alerts for high-risk changes such as Conditional Access edits and new privileged role assignments.
3. Review risky sign-ins and failed sign-in patterns at least weekly, well inside your log retention period.
4. Hold a monthly review of every difference from the baseline and decide: approve, reverse or investigate.
5. Update the baseline after every approved change, so it stays the single source of truth.

Frequently asked questions

Is Microsoft Secure Score the same as a baseline?

No. Secure Score measures your tenant against Microsoft's recommendations. A baseline records the configuration your organisation has agreed on, including exceptions you have decided to accept. The two work well together.

How often should the tenant be checked?

High-risk changes such as Conditional Access edits and admin role assignments are worth alerting on as they happen. Sign-in activity should be reviewed at least weekly. A full comparison against the baseline once a month suits most small and mid-sized organisations.

Do we need extra licences?

It depends on what you already have. Longer log retention, detailed risk reporting and some configuration management features need Microsoft Entra ID P1, P2 or other add-ons. We check what your current plans include before recommending anything new.

Does this replace a security assessment?

No. An assessment tells you where you stand today. Ongoing monitoring tells you when that changes. Most organisations start with an assessment, fix what it finds, and then use the result as their baseline.

Where to start

Onprem2Cloud IT Solutions is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We help organisations capture a Microsoft 365 security baseline, set up automated change checks and run the regular human reviews that make them useful. If you would like to know whether your tenant still looks the way it should, start with our cybersecurity services. Related reading: cloud security posture assessment for Microsoft 365 and cutting back Global Administrators.