Verify backups and detect drift

A comparison reads two versions of a tenant's configuration and reports every object that was added, modified or deleted between them. EIDGuard uses comparisons in two ways:

Scheduled verification compares each tenant's newest recovery point with the live tenant every day. A match shows the recovery point is a faithful copy of the tenant.
On-demand comparisons compare any recovery point with the live tenant, or two recovery points with each other, to find out what changed since a known-good point.

A comparison never changes the tenant. A comparison against the live tenant reads it with the tenant's read-only backup app; a comparison between two recovery points does not contact the tenant at all. Reports are stored with the recovery point used as the baseline, and retention removes them like that recovery point's other files.

Scheduled verification#

Scheduled verification runs once a day, one hour after the backup schedule's run hour (the anchor hour when the RPO is shorter than a day), in the schedule's time zone. For each onboarded tenant it compares the newest recovery point with the live tenant, across every resource type, and writes a report.

It is on by default (the deployment form's option Daily drift verification (compare newest snapshot against the live tenant)). It appears on Jobs as Compare and uses the tenant's read-only backup app. The dashboard estimates its cost at about $0 to $1 a month in Automation minutes; see Azure Automation pricing.

What happens with the result:

Differences raise the drift alert, which emails the alert recipients. They do not fail the job. The alert resolves on its own after a verification finds no differences. See Alerts that ship.
A resource type that could not be read from the live tenant fails the job, which raises the failed-jobs alert. The report lists it under "Export failures (not compared): …".

A difference means one of two things: the tenant changed after that recovery point was taken, or the recovery point did not capture something. Either way, the newest recovery point would not restore the tenant exactly as it is now.

Turn scheduled verification on or off#

Go to Manage > Configuration > Protection.
In the Scheduled verification section, select Enable or Disable. The badge shows Enabled or Available (off), and while it is on the section shows the next run.

You need the Admin role. Updating EIDGuard keeps your choice.

With private networking, verification runs on the Hybrid Worker VM, and the worker's power schedule covers it. See Private networking.

What the Overview shows#

The Last verification card on Overview, and the Sync with live and Verification columns of its Tenant protection table, count only scheduled verification. An on-demand comparison, including one started from the Overview, does not update them.

The card groups tenants by the age of their last verification (Verified < 24h, 1 – 3 days, 4 – 7 days, > 7 days, Never verified) and shows SLA healthy or Behind SLA. Needs attention reports "Recoverability has never been proven for every tenant" when a tenant has no scheduled verification yet, and "Recoverability verification is overdue" when the oldest one is too old. If either appears, check that scheduled verification is on and that its last Compare job completed.

Run a comparison#

You need the Operator role to run a comparison. Viewers can read existing reports; the page says "Running comparisons requires the Operator role; existing reports are viewable below."

With private networking, jobs run on the Hybrid Worker VM, which is powered on only around scheduled backups. Start comparisons during that window, or power on the worker VM first.

Compare a recovery point with the live tenant#

Use this to see everything that changed in the tenant since a recovery point.

Go to Workspace > Drift. The page is titled Drift detection.
Choose the Tenant.
In Baseline (from), choose the recovery point to compare from. Points without a report are marked " — not compared yet".
Under Compare to, select Live tenant.
Select Run comparison. The button shows Comparing…, and View job opens the job. When the job finishes, the page shows its report.

You can start the same comparison from other pages; each opens the job:

Differential on a row of Recovery points.
Compare on a recovery point's page.
Verify drift (or ↻) on a tenant's row in the Overview table, which compares the tenant's newest recovery point.

Compare two recovery points#

Use this to see what changed between two backups, for example to find when a setting changed. It does not contact the tenant.

On Drift detection, choose the Tenant and the earlier point in Baseline (from).
Under Compare to, select Another recovery point, then choose the later point. The swap button exchanges the two.
Select Run comparison.

A comparison between two recovery points never fails because of differences, and never raises the drift alert.

Read a drift report#

The report for the selected baseline appears below the controls. When a recovery point has several reports, choose one from the report list.

Comparison summary names the two sides and counts Added, Modified, Deleted and No change. Select a count to show only that change type.
Changes by category shows the changes per resource type. Select a category to show only it.
Changed items lists one row per object. Select a row to see each changed property with both values.

Column	Meaning
Change type	Added: present now but not in the baseline. Modified: present in both, with different properties. Deleted: in the baseline but no longer present.
Category	The resource type, such as users, groups or Conditional Access policies.
Name	The object's display name.
What changed	The properties that differ.
Baseline value	The value in the baseline recovery point.
Live tenant or Point …	The value now, or in the later recovery point.

Filter the rows with Search by name, property or value…, All categories and All changes. When nothing differs, the table says "No differences — every compared object matches."

Large reports#

A report stores at most its first 500 differences, although it records the total. When it holds fewer than the total, the page says "This report stored the first X of Y differences. Counts, filters and the export cover only those." To see every difference, open the recovery point's page and, under Reports, open the comparison's Markdown report (the .md file), which lists all of them.

Export a report as CSV#

Select Export CSV above Changed items. The file is named drift-<tenant>-<timestamp>.csv and has one line per changed property, with the columns Change type, Category, Name, Property, Baseline value and Current value.

The export contains the rows that match the current filters, so clear the filters first to export the whole report. Values that a spreadsheet would read as a formula are prefixed with an apostrophe.

Respond to drift#

For each difference, decide whether it was expected.

Expected (a change your team made): no action is needed. The next scheduled backup captures it. To capture it at once, select Run backup on Recovery points; that backs up every onboarded tenant.
Unexpected: find out who made the change, for example in the tenant's Microsoft Entra audit logs, then restore from a recovery point taken before it. Operators can select Review restore → below the report to open the restore wizard for the baseline recovery point.

How a restore treats each change type:

Deleted objects are recreated by a Missing only restore.
Modified objects keep their current properties in a Missing only restore, although it re-adds missing links such as group members and owners. Full (disaster recovery) gives them back their backed-up properties, and needs the Admin role to apply.
Added objects are not removed by any restore. Delete them in the Microsoft Entra admin center if they should not exist.

See Restore modes and Restore from a recovery point.

Check a planned change#

To confirm that a change did only what you intended:

Before the change, select Run backup on Recovery points and wait for the job to complete. This gives you a recovery point from just before the change.
Make the change in the tenant.
On Drift detection, choose that recovery point in Baseline (from), select Live tenant and Run comparison.
Check that the report lists only the changes you intended. If it shows anything else, restore it from the same recovery point.
Optionally, run another backup so the newest recovery point includes the change.