Configuration drift detection for Microsoft Entra External ID
Deletion is the easy case. The harder one is a change nobody meant to make, a policy scope widened, an attribute removed from a user flow, an identity provider pointed at the wrong client ID. Nothing was deleted, so nothing lands in any recycle bin.
Why a recycle bin is not enough
Microsoft's 30-day soft delete covers deletion, and only for a specific list of object types. It has nothing to say about modification. If someone edits a Conditional Access policy rather than deleting it, there is no undo, no record of the previous value, and nothing to notice it happened.
Configuration drift is far more common than outright deletion in a working tenant, which makes it the failure mode most recovery plans miss entirely.
Verified nightly, against the live tenant
Once a tenant is onboarded, EIDGuard compares its newest recovery point against the live tenant every night, object by object, and publishes a drift report. Verification runs with the same read-only identity as backups and can never modify your tenant.
The result surfaces on the dashboard alongside backup health and recovery point age, so a backup that has quietly stopped matching reality shows up within a day rather than during an incident.
What a drift report tells you
A row reading “Different · Require MFA for partner administrators · state · enabled → disabled” is an early warning that somebody turned off an MFA policy. Drift is information rather than automatically a problem, tenants are supposed to change, and the value is having the complete list so you can sort it into expected and worth investigating.
| Column | Meaning |
|---|---|
| Change | Different: the object exists in both but a property changed. Missing: it is in the recovery point and gone from the tenant. |
| Object | The display name of the affected object. |
| Property | Which setting differs, for Different rows. |
| Recovery point / live | The value in the backup versus the value in the tenant right now. |
Comparisons on demand, not just overnight
You can compare any recovery point against the live tenant, or against another recovery point, at any time. Comparing two recovery points shows what changed between two dates, which makes it a precise record of what a release actually touched.
The pattern worth adopting for change windows: take a manual backup immediately before the change, make the change, then compare that recovery point against the live tenant. What comes back is an exact list of what moved, including anything you did not intend to move.
Protect your tenant before you need to recover it.
Connect your Entra External ID tenant, set a schedule, and establish your first known-good recovery point.