Drift detection and daily operations

A backup you never look at is a hope, not a plan. EIDGuard's daily operations loop is designed so you'd notice — within a day — if your tenant changed unexpectedly or your backups stopped matching reality: scheduled backups, nightly verification against the live tenant, and a dashboard that surfaces anything off.

The daily loop

Once a tenant is onboarded, every day EIDGuard automatically:

1. Backs it up into a new recovery point, on the schedule you chose at deployment.
2. Verifies by comparing the newest recovery point against the live tenant, object by object, and publishes a drift report to the Drift page.
3. Surfaces the result on the Overview: backup health, recovery point age against your recovery point objective (RPO), and a per-tenant drift status.

Verification is read-only — it runs as the same read-only identity as backups and can never modify your tenant.

Reading a drift report

Open Drift and choose a tenant. The report lists every difference between the recovery point and the live tenant, grouped by resource type. Each row shows:

Two examples and how to read them:

• Different · CA03 — Require MFA for partner administrators · state · enabled → disabled — someone disabled an MFA policy since the backup. If that wasn't a sanctioned change, this is your early warning.
• Missing · Jonas Keller · (present) → (absent) — a user in the backup no longer exists in the tenant.

Drift is information, not automatically a problem. Tenants are supposed to change — new users sign up, apps get updated. What drift detection gives you is the complete list of what changed, so you can sort it into "expected" and "investigate."

Responding to drift

• Expected changes (a release went out, users were added): no action — tonight's backup becomes the new baseline automatically.
• Unexpected changes: investigate in your audit logs, and if a change needs reverting, restore exactly the affected objects from the last good recovery point — see Restoring from a recovery point. Full mode reverts modified objects; missing-only recreates deleted ones.

Running a comparison on demand

You don't have to wait for the nightly run. On the Drift page, pick a tenant, a recovery point, and what to compare it against — the live tenant or any other recovery point — and select Compare. Comparing two recovery points shows what changed between two dates, which is ideal for change windows:

1. Take a manual backup (Run backup) immediately before the change.
2. Make the change.
3. Compare that recovery point against the live tenant — the report is now a precise record of what the change actually touched.

Comparisons run as jobs, so you can watch progress under Jobs and find every past report in the Drift page's report history.

Watching backup health

The Overview answers the questions that matter at a glance:

• Is every tenant protected? Backup health shows whether each tenant has a recovery point within its RPO, and the history grid shows the last 30 days of runs — including any failures and whether a retry covered them.
• Are we verified? The last-verified indicator tracks when a drift check last completed against each tenant.
• Will authentication keep working? Certificate gauges count down the days remaining on each tenant's backup and restore certificates.

Certificates and alerting

EIDGuard authenticates to your tenants with certificates that live in your Key Vault. Two things keep expiry from ever becoming a 2 a.m. surprise:

• Expiry warnings appear on the dashboard — and by email, if alerting is enabled — a configurable number of days before a certificate expires (30 days by default).
• Rotation is one action. An Admin triggers rotation from the dashboard; new certificates are issued inside Key Vault and attached to the apps automatically, with no downtime for scheduled backups.

Email alerting also covers failed backup runs. The alert address, the cert-expiry warning window, the backup schedule, verification, and the storage retention period are all adjustable on the Configuration page (Admin role).