Configuration History

Securtea maintains a history of your Microsoft 365 configuration snapshots. Browse past states, compare versions, and understand how your environment has evolved.

Understanding Snapshots

What Are Snapshots?

A snapshot is a point-in-time capture of your configuration:

• Configuration data - Settings and values at that moment
• Timestamp - When the snapshot was taken
• Hash - Unique identifier for the configuration state
• Version - Sequential version number

Snapshot Sources

Snapshots are created by:

Browsing History

Accessing History

1. Navigate to Drift Detection > History
2. Select a resource type to explore
3. View snapshot timeline

Timeline View

The timeline shows:

• Snapshot points - Each scan or capture
• Change indicators - Visual markers for changes
• Date range - Filterable time period
• Resource summary - Quick stats per snapshot

Filtering History

Filter snapshots by:

Viewing Snapshots

Snapshot Details

Click a snapshot to see:

• Full configuration - Complete data at that time
• Metadata - Timestamp, hash, source
• Change summary - What changed from previous
• Related events - Drift events linked to this snapshot

Configuration View

Browse the configuration hierarchy:

Snapshot: 2024-01-15 09:00:00
└── Conditional Access Policies
    ├── Require MFA for Admins
    │   ├── state: enabled
    │   ├── conditions: {...}
    │   └── grantControls: {...}
    └── Block Legacy Auth
        ├── state: enabled
        └── conditions: {...}

Expand nodes to see detailed settings.

Raw Data View

View raw JSON data:

1. Click View Raw on any snapshot
2. See complete API response
3. Copy for external use
4. Download as JSON file

Comparing Versions

Side-by-Side Comparison

Compare two snapshots:

1. Select first snapshot
2. Click Compare
3. Select second snapshot
4. View differences

Comparison View

The comparison shows:

Diff View

See exact changes:

Conditional Access Policy: "Require MFA"
- state: "disabled"
+ state: "enabled"

Green (+) indicates additions, red (-) indicates removals.

Compare with Baseline

Compare current state to your baseline:

1. Select a snapshot
2. Click Compare to Baseline
3. Choose baseline
4. See differences from expected state

Version Navigation

Jump to Version

Navigate to specific snapshots:

• Latest - Most recent snapshot
• Previous - One version back
• Next - One version forward
• Specific date - Enter date/time

Change Markers

Timeline shows change types:

Snapshot Management

Manual Snapshots

Create a snapshot on demand:

1. Go to Drift Detection > History
2. Click Capture Now
3. Select resource types
4. Snapshot is captured immediately

Use manual snapshots:

• Before making planned changes
• To establish a known-good state
• For audit documentation

Snapshot Retention

Snapshots are retained based on your plan:

Exporting Snapshots

Export snapshots for external use:

1. Select snapshot(s)
2. Click Export
3. Choose format (JSON, CSV)
4. Download file

Use Cases

Audit Trail

Document configuration history for audits:

1. Export snapshots for audit period
2. Include comparison reports
3. Show compliance maintenance over time

Change Investigation

Investigate when a change occurred:

1. Filter history to relevant resource
2. Find snapshot with change marker
3. View comparison to identify change
4. Correlate with drift events

Rollback Planning

Plan configuration rollback:

1. Find snapshot with desired state
2. Export configuration
3. Use as reference for manual restoration

Compliance Documentation

Document compliance maintenance:

1. Export periodic snapshots
2. Show consistent baseline adherence
3. Demonstrate continuous monitoring

Best Practices

Regular Review

Schedule periodic history reviews:

• Weekly: Scan for unexpected changes
• Monthly: Review change patterns
• Quarterly: Audit snapshot coverage

Meaningful Captures

Create manual snapshots at key moments:

• Before major changes
• After remediation
• For milestone documentation

Correlation

Link history to other data:

• Match snapshots to change tickets
• Correlate with Azure AD sign-in logs
• Connect to incident timelines

Troubleshooting

Missing Snapshots

If expected snapshots aren't present:

• Verify monitoring schedule is active
• Check for scan errors in logs
• Ensure resource type is monitored

Incomplete Data

If snapshots have missing data:

• Review API permissions
• Check for license requirements
• Some data may have propagation delays

Comparison Issues

If comparison shows unexpected results:

• Verify snapshots are for same resource type
• Check for resource ID changes
• Review data format differences

What's Next?

• Baselines - Define expected configuration
• Alerts - Configure change notifications
• Monitoring Schedules - Set scan frequency