Created by Claude - please verify

Configuration drift - Tenant Configuration Management monitors and active drifts (Microsoft Graph).

Required Microsoft Graph permissions

ConfigurationMonitoring.Read.All — application permission, granted to the app registration with admin consent.

Licence: None stated; the Tenant Configuration Management service principal must be set up in the tenant.

Endpoints: GET /v1.0/admin/configurationManagement/configurationMonitors · GET /v1.0/admin/configurationManagement/configurationDrifts

An admin creates monitors (with a baseline) once, outside this console - see 'Set up authentication for Tenant Configuration Management APIs' on Learn. Monitors run every 6 hours; at most 30 per tenant.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Tenant Configuration Drift

Which tenant settings - Conditional Access, transport rules, Teams policies, Intune, Purview, Defender - have drifted from an approved baseline, and since when? The settings counterpart of 'what changed since yesterday'.