Visual Builder

The visual builder provides a point-and-click interface for creating drift detection rules without writing code or complex expressions.

Overview

The visual builder helps you:

• Create baselines without technical expertise
• See real-time preview of what will be monitored
• Test rules before activating them
• Iterate quickly on rule configuration

Accessing the Visual Builder

1. Navigate to Drift Detection > Baselines
2. Click Create Baseline
3. Select Visual Builder

Building Rules

Step 1: Select Resource Type

Choose what to monitor:

Click a resource type to continue.

Step 2: Choose Specific Resources

Select which resources to include:

• All Resources - Monitor every resource of this type
• Specific Resources - Select individual items
• By Criteria - Filter by properties (e.g., "Policies named 'Admin*'")

Step 3: Select Properties

Choose which properties to monitor:

The builder shows available properties for your resource type:

☑ displayName
☑ state (enabled/disabled)
☑ conditions
   ☑ users
   ☑ applications
   ☑ locations
☐ grantControls (optional)

Check properties you want to monitor for changes.

Step 4: Configure Rules

For each selected property, define the comparison rule:

Simple Properties

For text and boolean values:

Complex Properties

For nested objects and arrays:

Step 5: Set Severity

Assign severity for drift events:

• Critical - Changes here pose immediate security risk
• High - Significant security concern
• Medium - Review recommended
• Low - Informational

Step 6: Preview and Test

Before saving, preview your rule:

1. Click Preview
2. See which resources match your criteria
3. View sample baseline data
4. Test against current configuration

The preview shows:

• Resources that will be monitored
• Current values for selected properties
• Any existing drift that would be detected

Rule Examples

Monitor MFA Policy State

Goal: Ensure MFA policy stays enabled

Resource: Conditional Access Policies
Filter: displayName contains "MFA"
Property: state
Rule: Exact Match = "enabled"
Severity: Critical

Track Admin Group Members

Goal: Detect changes to admin group membership

Resource: Groups
Filter: displayName = "Global Admins"
Property: members
Rule: Exact Match (current members)
Severity: High

Monitor External Sharing

Goal: Ensure SharePoint external sharing is restricted

Resource: SharePoint Tenant Settings
Property: sharingCapability
Rule: One Of ["Disabled", "ExistingExternalUserSharingOnly"]
Severity: High

Advanced Features

Conditional Rules

Create rules that only apply under certain conditions:

IF resource.displayName contains "Production"
THEN severity = Critical
ELSE severity = Medium

Combined Properties

Monitor multiple properties together:

Monitor when:
- state changes to "disabled" AND
- displayName contains "Security"

Exception Patterns

Exclude specific resources from monitoring:

Monitor: All Conditional Access Policies
EXCEPT: displayName contains "Test" OR "Dev"

Testing Rules

Dry Run

Before activating:

1. Click Test Rule
2. Scan runs against current configuration
3. Results show what would be detected
4. Adjust rules based on results

Simulation Mode

Enable simulation mode:

• Rule runs on schedule
• Generates preview events (not actual alerts)
• Review simulation results
• Activate when confident

Editing Visual Rules

Modify Existing Rules

1. Open the baseline
2. Click Edit in Visual Builder
3. Modify any step
4. Save changes

Convert to Advanced

For complex rules, convert to code:

1. Open the baseline
2. Click Convert to Expression
3. Edit the JSON/expression directly
4. Visual builder link is removed

Best Practices

Start Simple

• Begin with basic exact-match rules
• Add complexity as needed
• Test thoroughly before production

Use Descriptive Names

Name baselines clearly:

• ✅ "CA Policy - Require MFA for Admins - State Check"
• ❌ "Policy Check 1"

Group Related Rules

Create baselines that cover related configurations:

• All Conditional Access policy states
• All mail flow rule settings
• All SharePoint sharing settings

Document Intent

Add descriptions to explain:

• Why this rule exists
• What security risk it mitigates
• Who to contact for questions

Troubleshooting

Properties Not Showing

If expected properties don't appear:

• Verify resource type selection
• Check API permissions
• Some properties require specific licenses

Rule Too Broad

If rule matches too many resources:

• Add filter criteria
• Select specific resources instead of all
• Use more specific property selectors

Rule Not Matching

If expected resources aren't monitored:

• Check filter criteria for typos
• Verify resource exists with expected properties
• Preview rule to see what matches

What's Next?

• Baselines - Learn more about baseline management
• History - View configuration snapshots
• Alerts - Configure notifications