Overview

The Drifts tab compares two security scans side by side to identify configuration changes and compliance drift over time. Use it to detect unauthorized changes, track remediation progress, and keep a consistent security posture.

How It Works

Comparison modes

• Controls that exist in both scans — shows only controls present in both snapshots, for a direct comparison
• Controls in any scan — shows all controls, including ones added or removed between scans

Change categories

Results are organized into tabs:

• All Changes — every control with any difference between the two scans
• Status Changed — controls whose pass/fail status changed (e.g., PASS to FAIL, or FAIL to PASS)
• Only Evidence Changed — controls whose underlying evidence changed while the overall status stayed the same

Narrow the results further with the Filter by categories dropdown to focus on specific Microsoft 365 components.

Drift table

Each row shows a control and its status in both scans:

• Control description and control ID
• Category — the Microsoft 365 component (e.g., Microsoft 365 admin center)
• Left scan status — status in the earlier scan
• Right scan status — status in the later scan
• Evidence Diff — click to see the detailed evidence difference for that control

Status values include PASS, FAIL, and FAIL LICENSE REQUIRED (the control can't be evaluated because the required license is missing).

Use Cases

• Unauthorized changes — a control that went from PASS to FAIL between scans points to a change in the tenant worth investigating.
• Remediation progress — controls that went from FAIL to PASS confirm your fixes took effect.
• Quiet changes — Only Evidence Changed shows configuration that moved without changing the result.

Related Articles

• Remediation
• Microsoft API Propagation Times
• Activity Log