What is drift detection?
Also known as
Definition
Even well-governed Microsoft 365 environments change. Someone adds a guest. A site gets shared broadly. An owner leaves and nobody replaces them. A sensitivity label gets removed. None of these are necessarily deliberate policy violations. They're the natural result of people working. Over time, those small changes add up until the environment no longer reflects the governance baseline it was designed around.
Drift detection is how you notice. It looks at the current state of your environment: permissions, ownership, sharing settings, labels. It compares that to how things were set up and shows you what's changed. The goal isn't to catch wrongdoing. It's to know when something has shifted so you can decide whether it needs fixing.
tip
Start with the things that matter most: external sharing, permission changes, missing workspace owners, and inactive sites. Watch those first before trying to monitor everything.
Why it matters
Cleanup projects fix the environment once. Drift detection keeps it from getting there again.
- Governance & security: Permissions that drift create exposure. An overshared site, a missing owner, a guest who should have been removed months ago.
- Compliance & audit readiness: Drift that goes undetected means your governance only works on paper.
- Post-migration: Without drift detection, the new environment you’ve migrate to starts accumulating the same problems the migration was supposed to leave behind.
Commonly confused with: Access reviews
Access reviews are scheduled checks where reviewers confirm whether access is still appropriate. Drift detection is continuous monitoring that surfaces when something has changed. Reviews validate access on a cadence; drift detection flags changes as they happen.
What we see out there
Cleanup happens. Then the drift starts again.
IT teams run a cleanup project, tighten permissions, archive inactive sites, and remove stale guests. Six months later, the environment has drifted back. Without continuous monitoring, the cleanup becomes an annual fire drill rather than a sustained state.
Orphaned permissions after migration.
After migration, SharePoint permissions left without clear owners create ongoing access issues.
Frequently asked questions
What can drift in Microsoft 365?
Permissions drift when access gets added or shared in ways that weren't intended. Ownership drifts when owners leave and nobody takes over. Sharing settings drift when someone opens up a site or file beyond what the policy allows. Sensitivity labels drift when content gets reclassified or labels aren't applied consistently. Basically: anything that was deliberately set up can drift if nobody is checking it.
How often should we check for drift?
It depends on what's at risk. External sharing, sensitive content, admin accounts, and sites with no owner need more frequent checks, at least quarterly, ideally continuous. Lower-risk internal workspaces can go longer. The goal isn't one schedule for everything. It's paying attention where the risk is highest. As Maarten Eekels, Microsoft MVP, put it: monitoring is the single thing that gives you an edge for security.
What is a governance baseline?
A governance baseline is the intended state of your Microsoft 365 environment: who owns what, which sharing settings are allowed, which guests have access, and how sensitivity labels should be applied. It's what drift detection compares against. Without one, you can see that something changed. But you can't tell whether it was supposed to.
Who owns remediation when drift is detected?
It depends on what drifted. IT handles configuration and policy-level fixes. Workspace and site owners handle access decisions within their own spaces. The programs that work are ones that send drift to the right person, not ones that route every finding back to IT. When a site owner's guest list has grown beyond what was intended, the owner should be the one deciding whether those guests still belong. IT's job is to make that conversation happen, not to make every call themselves.
.avif)
