Identity resilience glossary
Configuration drift
Configuration drift is a difference between a system's actual configuration and its intended or approved baseline. In identity environments, this can affect access policies, group assignments, application settings, or other configurations that shape access. The baseline might be an approved configuration record or a definition managed through code. HashiCorp's drift guidance describes the same distinction between actual infrastructure and intended configuration.
Why it matters
Drift matters because an administrator's understanding of the environment may no longer match what is deployed. An investigation can then start from the wrong assumptions, or a later deployment can overwrite an intentional emergency change. A useful comparison should identify the specific setting and baseline involved, not just report that two versions differ.
Illustrative identity example
In a Microsoft Entra ID environment, an administrator temporarily excludes a group from a Conditional Access policy during troubleshooting. The exclusion remains after the incident closes, but the approved baseline still requires that group to be covered. The mismatch is drift. The team needs to confirm why it exists before removing the exclusion or updating the approved configuration.
Common confusion
Drift is not automatically evidence of an attack or a faulty setting. An authorized change can create it when the baseline has not caught up. Likewise, a difference between two historical snapshots does not establish a policy violation. Detection is limited to the objects and properties being compared; unsupported or unobserved settings remain outside the result. AWS's drift reporting documentation illustrates why detection scope must be explicit.