Skip to content
MDO Documentation

Drift detection

MDO finds policy changes by comparing each Intune collection with the one before it. Each difference becomes a drift event.

When changes are found

Section titled “When changes are found”

Drift detection runs as part of the Intune collection: every night at 04:00 UTC, and whenever someone clicks Sync with Intune on Home › Intune overview. The before and after of a change made in Intune show up in MDO after the next collection. Who made it shows sooner, from the audit log MDO reads every 15 minutes (see Audit and Activity).

Before comparing, MDO strips the metadata Microsoft updates on its side (timestamps, version counters and similar fields at every depth of a policy). One edit in the Intune portal gives one drift event.

What a drift event records

Section titled “What a drift event records”
  • The policy name and platform.
  • The type of change: added, removed, modified, assignment changed or setting modified.
  • Each changed setting, with the old and new values side by side.
  • When MDO detected it.
  • A severity: High, Medium or Low.

Severity is worked out from the policy name and the type of change. Policies whose names mention BitLocker, Defender, firewall, encryption, compliance or a security baseline are rated High. Names that mention Conditional Access, update rings, enrollment or authentication are rated Medium. Everything else is Low.

If a policy was restored from a backup, the event links the old and new policy IDs, because a restored policy gets a new ID.

The Changes tab

Section titled “The Changes tab”

Open Audit in the sidebar; it opens on the Changes tab. Narrow the list by search, source, who, kind of change, severity, platform, review state and status (open, acknowledged or all).

To take an expected change off the open list, acknowledge it:

  1. Click the change to open its sheet and review the before and after.
  2. Click Acknowledge.
  3. Choose how long the acknowledgement lasts: 30, 60 or 90 days, or indefinitely (the default).
  4. Optionally add a comment recording why the change is fine.

To acknowledge several events at once, select them and use the bulk action. It applies one comment and one duration to all of them. When a time-limited acknowledgement expires, MDO’s clean-up job re-opens the event.

Approve, revert or dismiss

Section titled “Approve, revert or dismiss”

The change sheet in Audit › Changes is where you decide what to do about a change. The Needs review filter shows the changes no one has decided on yet; the review filter also shows Approved and Dismissed.

  • Approve accepts the change as the new normal.
  • Revert undoes the change, after a preview of exactly what MDO will write. For a setting it writes the old value back; it also covers assignment changes and deleted policies, which come back from the newest backup that has them. It needs a role that can restore policies (Owner or Admin). Reverting Settings Catalog settings is switched off for now. See Audit and Activity for what Revert refuses.
  • Dismiss takes the change off the review list without changing anything in Intune.

The old Drift Review page and its links open Audit › Changes.

Apps

Section titled “Apps”

Apps that MDO manages are checked too. If someone edits one in the Intune portal, the app shows an amber dot on the Apps page, and its sheet shows MDO’s version next to what is in Intune now. See Editing an app.

Next steps

Section titled “Next steps”