Configuration Drift in Microsoft 365: Why One CIS Assessment Is Not Compliance

You run a CIS Microsoft 365 Foundations Benchmark v7.0.0 assessment, work through the findings, and close the gaps. Two weeks later a helpdesk engineer disables an anti-phishing policy to unblock a vendor mail flow. A project team switches on external sharing for one SharePoint site. A break-glass exclusion added to a Conditional Access policy during an outage never gets removed. None of that appears in the report you already filed.

That is configuration drift: the widening gap between the tenant you assessed and the tenant you are actually running. It is why a one-time assessment measures a moment rather than a state, and why compliance work that stops at remediation quietly decays.

A benchmark result is a timestamp, not a property

The v7.0.0 benchmark defines 160 controls across 9 sections. An assessment tells you the state of those 160 settings at the instant it ran. Nothing about passing them makes them stay passed — each one is a setting that an administrator with the right role can change back in under a minute, usually for a reason that sounds entirely sensible at the time.

Drift is rarely misconduct. Four ordinary mechanisms produce most of it:

• Operational exceptions. A policy relaxed to unblock a user, a vendor, or a migration — with nothing scheduled to put it back.
• Delegated administration. The controls live across nine separate admin surfaces, and the people holding write access to each are rarely the same people.
• Platform change. Defaults, new features, and renamed settings arrive on Microsoft’s schedule, not yours.
• Licensing and org churn. A license downgrade, an acquired subsidiary, or an admin who leaves can each change what is actually enforced without anyone editing a policy.

Drift has nine front doors

The benchmark is organized by the admin surface each control lives in. That structure is also a map of where drift can enter, and how much of your posture each door is worth:

• Microsoft 365 admin center — 15 controls. Administrative accounts, Microsoft 365 Groups, password and related tenant policies.
• Microsoft Defender for Office 365 — 21 controls. Safe Links, Safe Attachments, threat policies, priority-account protection.
• Microsoft Purview — 5 controls. Audit log search, Data Loss Prevention, Information Protection.
• Microsoft Intune — 2 controls. Device compliance policies, device enrollment restrictions.
• Microsoft Entra (Identity) — 63 controls. MFA, password protection, Conditional Access, authentication methods, Privileged Identity Management.
• Exchange Online — 13 controls. Mailbox auditing, mail flow and anti-phishing, Outlook add-ins, Exchange modern authentication.
• SharePoint Online and OneDrive — 12 controls. External sharing, link defaults, site and OneDrive settings.
• Microsoft Teams — 17 controls. File sharing, external access, apps, meetings, messaging policies.
• Microsoft Fabric and Power BI — 12 controls. Tenant settings.

Two things fall out of that list. First, Entra carries 63 of the 160 controls — more than the next three sections combined. Identity is both the largest share of your benchmark result and the surface most often edited under pressure, which makes it the place where drift costs the most. Second, no single console shows you all nine. Checking by hand means nine logins, nine navigation trees, and nine chances to miss something. The full section breakdown is on our CIS Microsoft 365 Benchmark page.

143 controls can watch themselves. 17 cannot.

v7.0.0 marks 143 of its 160 controls Automated and 17 Manual. That split should drive your entire drift strategy, because the two groups fail in completely different ways.

The 143 automated controls are machine-checkable. Their current state can be read back from the tenant on demand, which means the marginal cost of re-checking them is close to zero. If a control can be evaluated by a machine, there is no defensible reason to evaluate it once a year. Re-check it on a schedule and treat any change from the last known-good result as an event, not as something to discover during the next audit.

The 17 manual controls cannot be handled this way. They need a person to inspect something, read a policy, or exercise judgment, so no scanner will tell you they regressed. Give them a review calendar of their own and tie that calendar to change events — a new admin, a new subsidiary, a license change, a merger — rather than pretending automation covers them. We list all 17 and where they cluster in the manual-controls breakdown.

The practical failure mode is treating all 160 as one undifferentiated annual chore. The automated majority then gets checked far too rarely, and the manual minority gets checked at the same rate as everything else, which is far too rarely for the controls most likely to be quietly bypassed.

Pick a cadence per control set, not one for everything

Scan frequency is a blast-radius question: how much damage can this control do between one check and the next, and how easily can someone change it? ConfigCobra lets you schedule scans daily, weekly, or monthly against any combination of controls or predefined rule sets, so different parts of the benchmark can run at different rhythms. A reasonable starting shape:

• Daily — Entra identity controls and SharePoint and OneDrive external sharing. High blast radius, trivially easy to change, and the two areas most often relaxed in a hurry.
• Weekly — Defender threat policies, Exchange Online mail flow, and Teams external access. Changed less often, but expensive when they regress unnoticed.
• Monthly — Intune, Purview, and Fabric and Power BI tenant settings. Stable surfaces where a monthly check is enough to catch a change before it ages into an audit finding.
• Event-driven — a full 160-control run after any migration, tenant merge, license change, or admin handover, plus the manual 17 on their review calendar.

A full automated scan completes in 20–25 minutes and runs on read-only Microsoft Graph permissions — no agents to deploy, no admin passwords to share. A daily cadence on your identity controls is therefore an operational non-event, not a project. The scheduler documentation covers how cadences and rule sets are configured.

An alert is only worth having if it closes the loop

Detecting drift is the easy half. What determines whether drift actually gets fixed is what lands in front of the engineer who has to fix it. Three things have to be in that hand-off:

• Which control regressed, and what the tenant looks like now. Continuous scanning compares each run against the previous result, and drift detection raises an alert when a control that was passing stops passing — with an email notification rather than a dashboard nobody has open.
• Evidence you can file. Each finding carries its evidence and a timestamped tenant snapshot, exportable as a CIS-certified PDF report. That is what turns a fixed setting into something an auditor will accept months later.
• The remediation, written out. Every finding comes with a copy-paste remediation script — PowerShell or the equivalent admin portal steps — so closing a regression is a task, not an investigation.

One thing it deliberately does not do: change your tenant for you. The assessment runs read-only, so the remediation decision stays with the administrator who owns that surface. Activity logs record what was found and when, and a read-only auditor seat lets a client or external auditor see the same evidence without touching the configuration.

If you run more than one tenant — as a group with subsidiaries, or as an MSP — the same cadence applies per tenant from one workspace, which matters because drift is not synchronized across tenants and a per-tenant manual sweep does not scale.

Close the gap between the assessment and the tenant

A CIS Microsoft 365 assessment answers the question where are we right now. Continuous scanning answers the more useful one: has anything moved since the last time we were sure. The benchmark gives you 160 specific, checkable answers — 143 of which a machine can re-verify as often as you want it to. Checking them once a year is a choice, not a constraint.

Start a free 14-day trial to run all 160 controls against your own tenant and see where your posture actually sits today.